You should only need to maintain "sessions" to maintain state for a user across either an application and/or across servers.
If you want to "remember" the username a visitor last used to login to your site (eg: the userid form field of the login field is pre-filled) use either a cookie or a ColdFusion client variable. However, and this is VERY important, "sessions" can be stolen, often accidentally, and here are a few reasons why this can happen: 1. A user "logs in" and is authenticated with say a database. 2. You use a CFLOCATION but do NOT include the addtoken="yes" attribute (eg <cflocation template="userok.cfm" addtoken="yes">). 3. The user is presented with a Thank you message. Click here to continue. But the URL Token is not appended to the URL (eg <a href="http://mypage.cfm&#URLToken#";>Click here</a>. 4. You are not including the URL Token, either as a hidden form field in the form or appending it to the action page. 5. You "bookmark" someone elses CFID/CFTOKEN and take over the session. If you do not maintain STATE ColdFusion will not do it for you. You must code your application to test for sessions, and to maintain them until you kill the session or the user closes their browser. LINKS BELOW ARE FAKED (samples only) Off the top of my head those are enough to lose sessions (or have them stolen). There is a nastier one I haven't encountered myself and that would be "bookmarking" your own session only to take over someone elses with a little URL manipulation. Eg you bookmarked my site and would be added like http://www.mysite.com/ but what they actually get is there session included like http://www.mysite.com/mypage.cfm&CFID=341230&CFTOKEN=57114587 My website host only recently turned on J2EE sessions (only come with ColdFusion MX 6.x+ however (maybe even Enterprise only) and this may be specific to a J2EE install like they are now using. All they have done is, in the CF Administrator is turn ON "use J2EE session variables". A "J2EE" enabled CF session looks like this in the address bar: http://www.mysite.com/index.cfm?fuseaction=Welcome&CFID=341230&CFTOKEN=57114 587&jsessionid=be301600971104813866890 Using the JSESSIONID ensures a unique session until the source browser closes the session (client browser). Mike Kear said: >> Huh? Session vars pulled from a database? This is the second time I've heard this mentioned in the last 3 months, and I dont know how it's possible. I thought it was only Client vars stored in a database, and that sesion vars COULDN"T be stored in a database because they can contain complex variables like structs. Can you expand on this a bit please Steve? << --- You are currently subscribed to cfaussie as: [email protected] To unsubscribe send a blank email to [EMAIL PROTECTED] Aussie Macromedia Developers: http://lists.daemon.com.au/
