Skip to main content
A
Anonymous
May 19, 2011
Question

application logout and session clearing

  • May 19, 2011
  • 1 reply
  • 541 views

i have a logout button that deletes the user session variables and brings them to the login screen again. it runs this if statement (i found this somewhere on the internet years ago)

    <CFIF Not ListFindNoCase('CFID,CFTOKEN,DEV_SITE,SERVER_ROOT,URL_ROOT,SESSIONID,URLTOKEN', Key)>
        <CFSET StructDelete(Session, Key)>
    </CFIF>

why shouldn't i also delete the CFID and CFTOKEN. aren't those associated with the user login? i notice in my CFADMIN server monitor for CF8 that even if a user logs out... they show as an active session in the cfmonitor until the 45 min session clears (i set it to 45 min in the application.cfc). i want them to be completely logged out with no trace and if they log back in get a new CFID and CFTOKEN... maybe someone can tell me why this could be a bad thing?

    This topic has been closed for replies.

    1 reply

    ilssac
    ilssac
    Inspiring
    May 19, 2011

    BosDog wrote:

    shouldn't i also delete the CFID and CFTOKEN. aren't those associated with the user login?

    Tagently, yes.  The CFID and CFTOKEN (and|or the JSESSIONID) values are how ColdFusion maintains state with a client browser.  Without this, there would be no way to know what client requests belong to any previous client request.

    If you want to delete these, then you can, I beleive.  But I don't think it is necessary, if you have already removed any state data that indicated a given user was logged in.

    It is fairly common to make the CFID and CFTOKEN memory session cookies (so they are deleted when a browser is closed) rather then the default permanent cookies that they are.  JSESSIONID is a memory session cookie by default.

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices