Skip to main content
W
weezerboy
Inspiring
October 27, 2017
Answered

Session Variables Testing

  • October 27, 2017
  • 3 replies
  • 2658 views

Is there a way to test how long session variables persist?

I have a site I am working on where the session timeout is set in the CF admin for 4 hours.

I now have a new application within that site that I need a NEVER session timeout.

So I have this in my application.cfc


<cfset This.name = "my_app">

<cfset This.Sessionmanagement="true">

<cfset this.applicationTimeout = createTimeSpan( 100, 0, 0, 0 ) />

<cfset this.sessionTimeout = createTimeSpan( 100, 0, 0, 0 ) />

I am hoping that this overwrites the 4-hour session timeout and sets the timeout at 100 days, which is fine.

Is there a way I can test this without waiting for 4 hours to see if my session variables persist?

This topic has been closed for replies.
Correct answer Carl Von Stetten

This is my current application.cfc..is this all I need ?


<cfcomponent output="no">

<cfset this.name = "my_app">

<cffunction name="onApplicationStart" output="no">

<cfset this.applicationTimeout = createTimeSpan( 7, 0, 0, 0 ) />

</cffunction>

</cfcomponent>


Your line:

<cfset this.applicationTimeout = createTimeSpan( 7, 0, 0, 0 ) />

should not be inside the onApplicationStart function.  It should be right next to where you set the application name.

 

Catching up on the thread from above, your timeclock "application" is sort of a module of the main "application" or site.  You don't want users to be logged out after your 4-hour session timeout.

Charlie has done an excellent job explaining session and client variables and the appropriateness of use in this case.  Keep in mind that the session timeout counter will reset each time a call is made to the server (either by browsing to a page or any AJAX calls to the server).  So as long as the user is doing something periodically, you probably won't hit the session timeout.  However, if you want sessions to survive overnight or throughout the week, that is not really how sessions are intended to work (as Charlie stated above).

Do people in your organization leave their browsers open and their computers logged in overnight or continuously throughout a week?  (If so, that's probably not optimal behavior from a security standpoint).

There are probably a number of ways to keep users "logged in" via client variables (if you choose to use client variables to solve this, please use a database and DO NOT use the registry - that's the path to serious problems).

3 replies

W
weezerboyAuthor
Inspiring
October 28, 2017

OK this makes sense

How come this application.cfc doesn't overwrite the 4-hour session timeout on the server?
<cfcomponent output="no">

<cfset This.name = "my_application">

<cfset This.Sessionmanagement="true">

<cfset this.applicationTimeout = createTimeSpan( 100, 0, 0, 0 ) />

<cfset this.sessionTimeout = createTimeSpan( 100, 0, 0, 0 ) />

</cfcomponent>

What should be in the application.cfc to make this never timeout?

BKBK
Community Expert
BKBKCommunity Expert
Community Expert
October 28, 2017

Are you implying that the session times out after 4 hours?

BKBK
Community Expert
BKBKCommunity Expert
Community Expert
October 28, 2017

weezerboy  wrote

Is there a way to test how long session variables persist?

There is a way you can test whether a session has ended, without having to hang around. Add the following test code to your application file:

<cfset this.name = "my_app">

<cfset this.sessionmanagement="true">

<cfset this.applicationTimeout = createTimeSpan( 1, 0, 0, 0 ) />

<cfset this.sessionTimeout = createTimeSpan( 0, 0, 5, 0 ) />

<cffunction name="onSessionEnd" returntype="void">

       <cfargument name = "sessionScope" required="yes">

       <cfargument name = "appScope" required="yes">

     

        <cflog file="#this.name#" type="Information" text="Session: #arguments.sessionScope.sessionid# ended at #now()#">

</cffunction>

Open the URL of any test CFM page of my_app in the browser.

Note down the time.

Wait just a little over 5 minutes (during which time you shouldn't interact with the my_app application); go make yourself a cup of tea.

Check the logs. You should see an entry confirming that the session ended and that onSessionEnd has run.

H
haxtbh
Inspiring
October 28, 2017

Change the CF admin to a really low value i.e. 5 minutes and set your sessionTimeout to 10 minutes and then see it does as you expect.

I assume you have a development server you can do this on!

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices