Skip to main content
paulm1677332
paulm1677332
Inspiring
May 13, 2020
Answered

J2EE Session rotation query

  • May 13, 2020
  • 2 replies
  • 1626 views

Hi,

 

I have Use J2EE session variables enabled on my server and now want to rotate the corresponding jessionid on login. I used to rotate the inbuilt coldfusion session variables using sessionRotate but now have no need so replaced this in my code with jeeSessionRotate (https://www.petefreitag.com/item/829.cfm). 

 

I have also added the relevant code in onSessionStart but I keep getting an error a few lines after calling jeeSessionRotate. The error happens when I try and set some session variable and I get an "set attribute... session has already been invalidated" error because its trying to use the previous session. I assume the code in onSessionStart would cater for this. Am I missing something along the line here? I'm calling jeeSessionRotate on successful login and later on in that file i'm setting some variables.

 

Seems from the post that all required was to create the new function and add the code to onSessionStart and it should work. Anyone any ideas?

 

Thanks

 

    This topic has been closed for replies.
    Correct answer paulm1677332

    Hi,

     

    Yes that worked. Thought I might have been able to get it working all from the 1 page but calling onSessionStart directly or creating a new function with the code from onSessionStart and calling that directly after the rotate also didnt work. Sending it to the new page did the job.

     

    Thanks

    2 replies

    Charlie Arehart
    Community Expert
    Charlie ArehartCommunity Expert
    Community Expert
    May 17, 2020

    Paul, I think you'd be wise to add a comment on Pete's post, either asking the same question or (perhaps better) pointing to this, not only to get Pete's attention but also that of others who may have used that function.

     

    And since it's a post from 2014 and talking about cf10 (cf11 came out in 2014 also), perhaps things have changed, either in those (per updates) or in cf2016 or 2018, so you may want to clarify also which you're using, to better help those who may want to help you. 

    /Charlie (troubleshooter, carehart. org)
      paulm1677332
      paulm1677332Author
      Inspiring
      May 21, 2020

      Hi Charlie,

       

      Thanks for that. I did see some comments on Petes article but hadn't seen any recent replies so I didn't think he was replying. BKBK's way worked, I just thought the J2EE session rotation would have worked similiarly to the sessionRotate function and not required alterations to my login process.

       

       

      BKBK
      Community Expert
      BKBKCommunity Expert
      Community Expert
      May 17, 2020

      An idea.

      You're perhaps getting an error because, even though the old session has been invalidated, it is still in effect in the current page. So, if a line of code writes to the session scope, ColdFusion will attempt to write to the invalidated session.

       

      You therefore have to initiate the new session directly after session rotation. That is, before any line of code that writes to session. One way to do this is by starting a new request to a CFM page.

       

      Start by copying all the code that comes after the call jeeSessionRotate() from the login page to a new page, postLogin.cfm. The pseudocode follows.

       

      login.cfm

      <!--- Login code --->

      <!--- Code that invokes the function jeeSessionRotate()  --->

      <cflocation url="postLogin.cfm">

       

      postLogin.cfm

      <!--- Code that comes after jeeSessionRotate() in the previous login page --->

       

      In this way, the new session will be in effect on the page postLogin.cfm.

       

        paulm1677332
        paulm1677332AuthorCorrect answer
        Inspiring
        May 21, 2020

        Hi,

         

        Yes that worked. Thought I might have been able to get it working all from the 1 page but calling onSessionStart directly or creating a new function with the code from onSessionStart and calling that directly after the rotate also didnt work. Sending it to the new page did the job.

         

        Thanks

        Terms & ConditionsAccessibility statement
        Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices