Skip to main content
D
Dr.Bob
Participant
May 15, 2011
Question

Problem with Sessions & CFID Changing Unexpectedly

  • May 15, 2011
  • 2 replies
  • 708 views

MY SETUP...

  • ColdFusion version 8.01 Standard
  • Hotfix version hf801-00002.jar 
  • Java version 1.6.0_04
  • server OS Windows 2008 Enterprise 32bit
  • webserver IIS 7.0.6
  • database MySql 5.0.67

THE PROBLEM

For some visitors, every page on the website gives them a new CFID/CFTOKEN. I tried to narrow it down to a particular browser, but it's happening in every browser. It's only happening for some people. It was happening to me, then it stopped. Not sure what I did to fix it, but it's still happening to others.

I'm using CFID/CFTOKEN (or more recently, a random number stored in a session.variable) as their temporary ID when they add something to their shopping cart. Problem is, when the CFID or session value changes, the items in their cart are no longer associated with them anymore - their cart appears to be empty at that point.

For the love of God, what is causing the CFID and Session variables to change on every page? I am storing the client global variables in a MySql table which was setup by CF Administrator and appears to be working properly.

Lastly, this site has been working fine for years, all of the sudden after some PCI Compliance conformity and CF Patches, this problem arose, so I want to blame it on the patches, but I'm not sure.

Has anyone else ever had this problem? How did you fix it?

    This topic has been closed for replies.

    2 replies

    ilssac
    ilssac
    Inspiring
    May 16, 2011

    It can also be (and will always be caused) by any user who's browser (or any part of the connection) does not maintain the cookies.

    If the request does not contain a cookie with currently valid cfid|cftoken and|or cfsessionid values, ColdFusion will generate new ones.  This can be cause by security settings in the browser, OS, firewall, proxy etc.

    This has become an increasingly rare issue in modern Internet computing, but it was a fairly common back in the day when cookies where a new idea.

    M
    Mike Chabot
    Inspiring
    May 15, 2011

    Your recent problems could be caused by a recent buggy ColdFusion hotfix

    that impacts session variables. Adobe released a fix to the hotfix in

    March 2011 to fix some of the reported problems. Details are here:

    http://www.adobe.com/support/security/bulletins/apsb11-04.html

    -Mike Chabot

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices