Kill Session

> i should have mentioned that nothing really 'kills' a
> session.

Google "SessionTracker coldfusion".

--
Adam

all true, Ian. i just went for a quick post without delving into the
details... my bad. i should have mentioned that nothing really 'kills' a
session.

Azadi Saryev
Sabai-dee.com
http://www.sabai-dee.com/

Azadi wrote:
> easy way: use j2ee sessions (check corresponding box on the CF Admin
> Memory Variables page).
>
> hard way:
> look here: http://cfteeps.blogspot.com/2008/09/undocumented-goodness.html
>
> and here: http://cfteeps.blogspot.com/2008/09/i-shot-session.html
>
> Azadi Saryev
> Sabai-dee.com
> http://www.sabai-dee.com/

I feel it is important to note that these are not ways to 'kill a
session when a browser closes'.

By using j2ee sessions, or any other method that makes the session id
cookies 'memory' cookies that are discarded when a browser is closed,
will dissociate a session from a client making it very unlikely that the
session will every be used again. But it does not 'kill' the session.
That only happens when the session times out. Or the ColdFusion
service|server is restarted.

I just glanced at the posted blogs, but they seem to be describing
undocumented ways to work with ColdFusion session data and includes a
way to kill a session from code external to that session. But there is
no guaranteed way to have this happen when a user just closes their
browser. The server is never told when that happens. The concept of
the second post seems to be that a previous session could be killed if a
known user returns at a later time, before their previous session times out.

dchard wrote:
> How would I kill a session after closing the browser?

Ultimately you do not, because that is not how web application works.
The browser is running on a client and never tells the the server when
it is being closed.

Just imagine how that would work. Would you expect your browser to go
and tell every web site you visited today that it is now being closed?

And what about that. What would you expect the browser to say when you
go to a different web site. Is it supposed to tell the last web server
that it is not coming back?

Saying all that, there are some JavaScript tricks that may get you some
of this by pinging some 'close session' page on some event. Trouble is
that this will work very inconsistently from browser to browser and is
easily circumvented.

easy way: use j2ee sessions (check corresponding box on the CF Admin
Memory Variables page).

hard way:
look here: http://cfteeps.blogspot.com/2008/09/undocumented-goodness.html

and here: http://cfteeps.blogspot.com/2008/09/i-shot-session.html

Azadi Saryev
Sabai-dee.com
http://www.sabai-dee.com/