Terminating a session

ACS LLC wrote: I remember reading an article that terminating a session was not as simple as you would hope and that often happened were that the session variables were removed but the session was still active. I have this <cfset tempvariable = StructClear(session)> to clear the session, but I want to make sure that the session is completely and utterly terminated. I have to create a session when a user visits my script, but then depending on what country they are in I may immediately terminate the session and no content will be served to them, so the last thing I need are a huge amount of dead sessoins hanging around. Could anybody confirm the best way to do this

Terminating a session is indeed a far from simple matter. (I am assuming you are using ColdFusion session management). Commonly, ColdFusion terminates a session if the session has remained idle during the period given by the sessionTimeout. ColdFusion has been designed to handle millions and millions of sessions in memory, which is why using structClear(session) is usually frowned upon. There is really no need to use it!

StructClear(session) instructs ColdFusion to delete not only user-defined variables like session.myVar, but also the system variables session.sessionID, session.CFID and session.CFToken. However, if the session had not timed out and the user continued to navigate beyond this page, which is often the case, ColdFusion would continue to maintain the session until the browser closed.

The usual advice is to use structDelete, and to remove just the user-defined session variables. The only drawback is when your application has many user-defined session variables. It would then be tedious to remove them all, one by one.

There is however a solution for that. Define one struct, and store all your session variables in it, thus

<cfset session.myData = structNew()>

<cfset session.myData.myVar001 = "...">

...

<cfset session.myData.myVar100 = "...">

To clear the session data later, it will be sufficient for you to do something like

<cfset session.isUserSessionDeleted = structDelete(session,"myData")>

Read this:

http://www.bennadel.com/blog/1131-Ask-Ben-Ending-ColdFusion-Session-When-User-Closes-Browser.htm

Typically, you do delete session variables but leave the session active. If you don't want a huge amount of dead sessions hanging around, keep the session timeout short. I don't think I'd worry about it beyond that, until you run into an actual problem.

Dave Watts, CTO, Fig Leaf Software