How does Coldfusion Generate CFIDs?

Forum|Forum|15 years ago
December 3, 2010
2 replies
1186 views

I've searched long and hard all over various forums and cannot find an answer to this question and I beg your forgiveness if it has already been answered and I missed it.

How does Coldfusion generate unique CFIDs and how does it keep track of them? In other words, suppose I visit a site and am assigned a cfid of 1000 and someone else visits the site and they are assigned a cfid of 1025. How does coldfusion know that they already generated 1000 and that they need to use something other then that number? From what I've seen CFID's tend to be somewhat sequential and don't appear to be completely random. So Coldfusion must have a way to keep track of what it has already used.

Thanks for your help!

This topic has been closed for replies.

12Robots

Participating Frequently

They are not "somewhat sequential", they ARE sequential.

It knows to assign the next one because, clearly, it does store them somewhere, where is really immaterial, because that is not the part of the session token that is, or needs to be random.

The CFToken is the part that really matters.

Jason

B

bbn3dgrockAuthor

Participant

If I wipe out the client variables where I store them (i.e. in my CGLOBAL table in the DB) will that effect what cfids are generated next time?

12Robots

Participating Frequently

I doubt it. As far as I know, the only thing that will reset that counter is a server restart.

Jason

ilssac

Inspiring

bbn3dgrock wrote:
From what I've seen CFID's tend to be somewhat sequential and don't appear to be completely random. So Coldfusion must have a way to keep track of what it has already used.

Yes, I beleive they are, but I have no idea where ColdFusion stores this.

What do you think you can do with this information if you can find it? I ask because ColdFusion has multiple ways to generate session "state" identifiers. It can use cfid and cftoken OR jsessionid cookies and these can be either simple sequential and random numbers or UUID values.

Thus anything that I can imagine you doing with the knowledge of what past or future CFID values are going to be, may be much more difficult then you think.

B

bbn3dgrockAuthor

Participant

I suppose I should clarify my question. I'm more curious as to HOW coldfusion keeps track of what cfids have already been used rather then how it actually generates them.

ilssac

Inspiring

bbn3dgrock wrote:
I'm more curious as to HOW coldfusion keeps track of what cfids have already been used

I would still counter with WHY you think this is useful information. In over a decade of ColdFusion development I have never had to dig into the deep wiring of ColdFusion to find out HOW ColdFusion keeps track of CFID values.

I just know that it does and that it works well and I have never had trouble with it.

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded