I generally set a non-persistent (expires when browser closes) cookie with a value of the Session_ID from the DB that was created when the user logged in. Then as part of the security routine I check for the existence of that cookie...if it's there the user is logged in. To get info about the user I store their ID with the session record when they logged in. So I can use the value of the cokie to grab their user_ID and any info I need about them.
This means: -clustered servers is no problem -no manually handling a tonne of hidden form fields The potential downside is a database hit for each page request. This is minor IMHO because if done via a stored procedure it processes very fast and your code is scalable and maintainable. My 2 cents HTH Bryan Stevenson B.Comm. VP & Director of E-Commerce Development Electric Edge Systems Group Inc. t. 250.920.8830 e. [EMAIL PROTECTED] --------------------------------------------------------- Macromedia Associate Partner www.macromedia.com --------------------------------------------------------- Vancouver Island ColdFusion Users Group Founder & Director www.cfug-vancouverisland.com ----- Original Message ----- From: "David Notik" <[EMAIL PROTECTED]> To: "CF-Talk" <[EMAIL PROTECTED]> Sent: Thursday, October 24, 2002 3:27 PM Subject: SESSION scope or HIDDEN INPUTS? > Hi all: > > I always hear this issue discussed, and I have my own ideas, but I > wanted to know what others think because I don't know that I've reached > any conclusions as to what method is the best. I will not say how I do > it, so as to promote unfiltered views. :-) > > There is an application. Users can log in to it. There are obviously > variables that must persist (e.g. username, password). > > SESSION SCOPE > > If we use session variables, I always hear the argument that when it > comes time to scale (i.e. a server farm), it's a headache because the > session scope is server-dependant. > > Is this the only real reasoning behind not using the session scope? > Aren't there solutions that make this a non-issue? > > HIDDEN INPUTS > > If we use hidden inputs, scalability isn't an issue, but we have to keep > track of all the variables manually. We could write a control that > handles this for us. But then there's the issue with timing out the > session. We could solve this using some database table with some ID and > timestamp of last post solution. But it gets complex. > > What are some of your thoughts? What is the best way to go about this? > > --Dave > > > ################### > David Notik > Digital202, LLC > Imagination gone digital. > Web: <http://www.digital202.com/> www.digital202.com > E-mail: <mailto:dave@;digital202.com> [EMAIL PROTECTED] > Office: (206) 575-1717 > Mobile: (206) 351-3948 > ################### > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Archives: http://www.houseoffusion.com/cf_lists/index.cfm?forumid=4 Subscription: http://www.houseoffusion.com/index.cfm?sidebar=lists&body=lists/cf_talk FAQ: http://www.thenetprofits.co.uk/coldfusion/faq Signup for the Fusion Authority news alert and keep up with the latest news in ColdFusion and related topics. http://www.fusionauthority.com/signup.cfm
