Session is invalid errors

Glad that it solves the problem for you.

We have released the official fix for the issue. Please see http://blogs.adobe.com/coldfusion/2011/09/16/updated-bug-83514-session-is-invalid-issue/ for more information.

Thanks,

Shilpi Khariwal

Coldfusion Server Team

We are currently investigating this issue. Feel free to add your comments via votes to the bug.

Hemant

CF Team

twitter - khandelwalh

This latest hot fix (updated as recently as July 20, 2011) might help: http://kb2.adobe.com/cps/907/cpsid_90784.html

It could be that the application times out before the session. What is the value of applicationTimeout?

We're seeing the same error on Linux/CF 9.0.1 with June 14 2011 hotfix hf901-00002 (not 00001 - that was Feb 8 2011), but it looks like it's being triggered only when a user requests a template that has been 'recently' updated (we push source updates quite frequently). Seems like the recompilation is interfering with the J2EE sessions.

We don't have any solution to this, other than to catch the exception and blow away the client's cookies to give them a new session.

Thanks for the response. It sounds like we're looking at the same error, alright.

I had seen those two articles you mentioned, but the thing that I found curious was that our problems started after we applied the patch that came out in June and not the one that others were talking about from February (which we applied several months ago).

Our particular issue seems not to be relieved by manipulating the J2EE session timeout. We've experimented quite a bit with changing timeout settings in our test environment. I was able to reliably reproduce the error by reducing the session timeout values to numbers way lower than our J2EE timeout of 37 minutes. For example, I reduced the timeout of one of our applications to 2 minutes and then set the timeout of another to 1 minute. After waiting over a minute, I get the "session is invalid" error in the application with a timeout of two minutes. The issue remains until I quit the browser. This experiment would seem to rule out the solution that others have suggested of raising the J2EE timeout value higher than that of the CF application.

We experienced the same thing with our CF 8.0.1 standard servers, the only solution we've found so far is forcibly expiring the jsessionid cookie from an affected user's browser, either using cfcookie in the exception handlers or manually intervening at their browser. I hate to call that a solution really, it's more a work around. It's certainly not giving a good user experience. It's definately not affecting all of our users and it's more prevalent in those CF applications with a longer than average session timeout

My working hypothesis is that since the latest security update was applied, JRun's sessions are now being cleaned up more thoroughly when they time out, but CF doesn't always issue a new, clean, J2EE session when a browser attempts to resume an expired session.

Some people have reported benefits from setting JRun's session-timeout to be greater than Coldfusion's session timeout (JRun's default was 30 minutes for our Coldfusion servers), but that didn't work for us.

There are quite a lot of references to this particular issue on the internet: http://forums.adobe.com/message/1002510#1002510 http://shilpikm.blogspot.com/2011/03/update-on-security-hot-fix-feb-2011.html

To make sure we're talking about a similar thing, the stack trace of our exceptions are all this:

java.lang.IllegalStateException: Session is invalid
        at jrun.servlet.session.JRunSession.checkSessionValidity(JRunSession.java:394)
        at jrun.servlet.session.JRunSession.getMaxInactiveInterval(JRunSession.java:111)
        at coldfusion.runtime.J2eeSessionScope.SetMaxInactiveInterval(J2eeSessionScope.java:99)
        at coldfusion.runtime.AppHelper.setupJ2eeSessionScope(AppHelper.java:738)
        at coldfusion.runtime.AppHelper.setupSessionScope(AppHelper.java:793)
        at coldfusion.tagext.lang.ApplicationTag.doStartTag(ApplicationTag.java:279)
        at coldfusion.runtime.CfJspPage._emptyTcfTag(CfJspPage.java:2661)
        at cfApplication2ecfm496389954.runPage(/path/to/our/Application.cfm:6) <- the line with the <cfapplication> tag or equivalent in Application.cfc