Do I need to delete the cookie in Coldfusion when I change other session variables -

i have problem session variables in app. make short, coldfusion application inside dot net application using iframe. main application using dot net user login dot net app. once user login can access coldfusion app. through link. there no login coldfusion app. (boss not want our users login twice!).

to differentiate each user, dot net app pass 2 url variables, url.userid , urlusergroup coldfusion app. created session variables based on these url variables, such session.userid , session.usergroup, differentiate each user , roles when roaming in coldfusion app. how create sessions: in application.cfc (coldfusion 10) onsessionstart have:

 <cfset session.userid= url.userid>  <cfset session.usergroup= url.usergroup> 

if login user a, 2 sessions created when log out (through dot net app), login again user b, set of sessions created user b session variables belong user still exist. mess everything.

to maintain 1 set of sessions running @ time, following in index.cfm:

   <cfif structkeyexists(session,"userid") >       <cfif session.usergroup neq url.usergroup , session.userid neq url.userid>          <cfset sessioninvalidate() />          <cfset session.userid = url.userid>          <cfset session.usergroup = url.usergroup>       </cfif>    </cfif 

this work, can login , log out different users different roles , access 1 thing notice still stay same cookie. when cfdump var="#cookie#" see same jsessionid=c2aee274a09334eb98ccb2d332d6cada.cfusion

my question is: should cookie? should make expired , rebuilt cookie every new user did sessions? how delete cookie , how rebuild 1 user?

not quite answer looking for, seems me have bigger problem though - of url params numeric or 'plain text'? if user can see url params being passed via iframe, change userid and/or usergroup presumably give them access things shouldn't.

for example if iframe calls: http://mycfapp.com/?userid=123&usergroup=2

then tampering params potentially login different user: http://mycfapp.com/?userid=1&usergroup=2

you need think securing these. .net application call cf server-side authenticate , token can pass in iframe. way can provide time-sensitive token without user ever seeing ids being passed simple url params.

you have .net application call cf when user logs out invalidate token.