application.cfc

We've been failing our PCI scans because ColdFusion has predictable CFIDs. The exact FAIL we get is "Predictable Cookie Session IDs". Now the CFTOKEN is no longer predictable since I've configured CF to use UUID for CFTOKEN, however, the CFID is still predictable and unaffected by any changes in CF Admin. I don't really know why the CFID being predictable is a threat, but they want us to fix it. I have been unable to find anything on the matter by googeling, and I'm really not sure what else to do. Has anyone else dealt with something like this? Any suggestions? EDIT:Here is what my

I need a reality check - and hopefully an explanation (if my reality is wrong). The way the CF application framework evaluates things is this (my understanding) - request is passed to cfserver cf finds an application.cfm or cfc (based on traversing rules) application.cfc executes (if found) the THIS scope is set (a series of application specific vars can be set here but some are required - such as "applicationTimeout" - then a series of events takes place -and methods fired if needed. -- onApplicationStart() ----onSessionStart() ------onRequestStart() etc. so my questions 1) The THIS settings

I have the following two files and would like the second to extend the first: wwwroot\site\application.cfc wwwroot\site\dir\application.cfc However, when I go to declare the component for the second file, I'm not sure what to put in the extends attribute. My problem is that several dev sites (with a shared SVN repository) are running off the same instance of ColdFusion , so I can't just create a mapping in the CF admin like so: <cfcomponent extends="site.application"> However, ColdFusion doesn't like: <cfcomponent extends="..application"> or any dynamic input like: <cfcomponent extends="