I have an issue with sessions on ColdFusion 10. I moved a site from CF 8 to CF10. CF8 resided in a different server. I put a WriteOutput(" testing") in the onSessionStart function of the Application.cfc to know how the site will behave. I ran the site, on the default page and the output "testing" appeared. When I clicked on the SignIn page, the "testing" word appeared again. It's calling the onSession start. Here is what's in my onSessionStart.
<cfscript>
this.name="mysite";
this.clientmanagement=false;
this.sessionmanagement=true;
this.setclientcookies=false;
this.sessiontimeout="#CreateTimeSpan(0,0,40,0)#";//TODO: revert back to 40 mins as default
this.applicationtimeout="#CreateTimeSpan(0,1,0,0)#";
this.loginStorage = "Session";
this.logFile = "mysite_LOG";
this.scriptProtect = "all";
</cfscript>
<cffunction name="onSessionStart" returntype="void">
<cfif NOT StructKeyExists( cookie,"CFID" ) OR NOT StructKeyExists( cookie,"CFTOKEN" )>
<cfheader name="Set-Cookie" value="CFID=#session.CFID#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">
<cfheader name="Set-Cookie" value="CFToken=#session.CFToken#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">
</cfif>
<cfscript>
WriteOutput("testing");
StructClear(session);
session.pageRedirector = ""; //used for sending a user back to a previous requested page when authentication is required first
session.profile = CreateObject("component","mysite.cfcs.user");
session.shoppingCart = CreateObject("component","mysite.cfcs.cart");
session.catalog = CreateObject("component","mysite.cfcs.catalog");
</cfscript>
</cffunction>
I'm using CSRFGenerateToken() to verify the page, so if the application keeps on calling the onSessionStart, the session will always be cleared and the user was not able to login.
Setting the setClientCookies to false calls onSessionStart on every request.
To fix the issue, I set setclientcookies to true. The session lost issue is solved but it gave a new issue - session is not terminated on browser exit.
If anybody can give some ideas, I would deeply appreciate it.
Enable J2EE sessions in CF Administrator (Server Settings > Memory Variables > Use J2EE session variables)
If you use ColdFusion session management, ColdFusion automatically ends sessions and deletes all Session scope variables if the client is inactive for the session time-out period. The session does not end when the user closes the browser.
If you use J2EE session management, ColdFusion ends the session and deletes all Session scope variables if the client is inactive for the session time-out period. However, the browser continues to send the same session ID, and ColdFusion reuses this ID for sessions with this browser instance, as long as the browser remains active.