Is there a Cloudflare setting that corresponds to the creation of the
__cfduid session cookie?
I'm currently trying out CF; mostly for the neat DNS management and the implicit CDN. But the basic WAF is possibly just as nice an addition atop Apaches mod_security/CRS. However I'm not sure what said cookies purpose is, and would prefer to get rid of that.
The most obvious setting
Seems to also have essentially no effect on the creation of
__cfduid with every HTTP response. The cookies purpose is presumably for opting out single users from firewall rules, repeated cloudflare captchas, etc.
Their support documentation alludes to that. Where the first revision from 09/2012 (https://support.cloudflare.com/hc/en-us/articles/200169536-What-does-the-cfduid-cookie-do-) says this behaviour can't ever be turned off. An entry two months later 11/2012 (https://support.cloudflare.com/hc/en-us/articles/200170156-What-does-the-CloudFlare-cfduid-cookie-do-) however omits that note.
While Cloudflares TOS itself check out as plausible, this cookie has all the properties of a tracking session,
dc41f5a78bc3e27d44b70fca4606e4262283407700773. The excessive cookie lifetime of 6 years is very odd for the exemplary internet cafe visitor use case. And since I'm personally avoiding needless sessions, and don't want to plaster a privacy note (in light of the infamous EU cookie law) like everyone else, I'd prefer to have it gone per default.
A workaround like:
Header add Set-Cookie "__cfduid= ; path=/; domain=.example.org; HttpOnly"
Does eschew its storage, but retains two needless headers, and doesn't seem overly reliable.
So, is there another CF setting for this?