I would first check the settings for session variables in both the dev and prod CF administrator and ensure they're both set to the same timeout. I've found that cf session variables get dumped *in theory* on browser exit. Two methods I've considered are setting up a logout screen; however that does not address users who (often) do not use logout functionality. I then encountered this bit of code which solved the same problem that I was having:
<!--- code to force session end on browser close --->
<cfif IsDefined("Cookie.CFID") AND IsDefined("Cookie.CFTOKEN")>
<cfset localCFID = Cookie.CFID>
<cfset localCFTOKEN = Cookie.CFTOKEN>
<cfcookie name="CFID" value="#localCFID#">
<cfcookie name="CFTOKEN" value="#localCFTOKEN#">
</cfif>
Not *exactly* sure why it works, but it does /shrug
Slap that in your application.cfm and presto!
Anyone have any explanation for why it works? Hope that helps you...
>Good afternoon.
>
>On both my development server and live server I have an application
>running which requires login.
>
>I have two scenarios that are occuring despite both servers having the
>same session settings and using the same code:
>
>On the live server, if you log in on one browser, you can then cut and
>paste the url into a new browser and you will be automatically logged
>in, alternatively, you can shut down all browsers, launch a new one,
>paste the url in and again be logged in automatically.
>
>What should happen, and which does happen on the dev server is that you
>should always be required to log in in a new browser as obviously this
>is a new session.
>
>As I said, both servers have the same settings (though now I'm
>wondering), use the same code and both run off fusebox 3.
>
>Basically, sessions are not being killed when the browser is closed and
>even so, they should not be transerable to a new browser, which would
>appear to be what they are doing.
>
>Has anyone come across something like this before? Any ideas what this
>could be?
>
>Thanks in advance,
>Dave
[Todays Threads] [This Message] [Subscription] [Fast Unsubscribe] [User Settings]
