Is it possible to reset jsessionid?

genadi_mak  wrote We have new requirement from security department to reset jsessionid after a user resets his password.

Why get involved with the session apparatus every time users reset their password? Imagine having to tinker with the engine every time a driver gets in or out of a car! A neater solution is to decouple driver permission from the workings of the engine.

This analogy suggests one way to solve your problem.

1) Enable the use of JsessionId in the ColdFusion Administrator;

2) Use the cflogin framework - including cflogout - to log users in and out;

3) In Application.cfc, set the value of the loginStorage attribute to "session".

That's it. It is tight in security terms, and quite convenient, too. You don't have to worry about the sessionId.

When the user is logged in, then

• session.cfauthorization_yourApplicationName exists
• getAuthUser() returns the username (with which ColdFusion logged the user in, for example, by means of cfloginuser)
• isUserLoggedIn() returns Yes

When the user is logged out, then

• session.cfauthorization_yourApplicationName does not exist
• getAuthUser() returns an empty string
• isUserLoggedIn() returns No

This cookie is set by Tomcat, not by CF really. It's a session cookie, and you can't just create a new one from CF. It uses a system-generated UUID, and you can't just put whatever value you want in there. You should be able to expire the current one with CFCOOKIE, though, and Tomcat will automatically set a new one on the following response to the request without a session cookie.

Dave Watts, Fig Leaf Software