CF11 : cflogin doesn't "stuck" after session/login timeout

Just wanted to jump in as a developer experiencing the same issue.

In most of my applications I am handling authentication on my own, using CFID/CFTOKEN to access a session scope where I keep credentials, those are not affected. The ones where I decided to use isUserInRole()/isUserLoggedIn(), I am affected. So one work around is to manage your roles in the session scope instead of the roles attribute of cfloginuser. Create your own UDF to replace the two previous functions that instead accesses whatever you've placed in the session scope.

Found this in security.log also. Time matches when I attempted to sign in:

"Information","ajp-bio-8014-exec-7","02/18/16","10:31:15",,"An error occurred while fetching element from authcache."

I hope this is resolved soon, I have several sites that started requiring you to log in twice at random due to upgrading to CF11.  I have Update 7.  I really don't want to have to go modify the code if it is just an update fix.

Other than in my example above:

<cfloginuser name="#CFLOGIN.name##createUUID()#" password="#CFLOGIN.password#" roles="ROLES">

Should fix the Double Login Issue. Although I am not sure if it creates any other issues.

I am having the same issue, but I noticed something very strange...

Here is my Application.cfc

<cfcomponent>

     <cfset This.name = "WebsiteCMS">

     <cfset This.applicationTimeout = "#createTimeSpan(5,0,0,0)#">

     <cfset This.datasource = "CMS">

     <cfset This.loginStorage = "session">

     <cfset This.Sessionmanagement = true>

     <cfset This.Sessiontimeout = "#createTimeSpan(0,0,0,10)#">

     <cfset This.mappings["/www"] = getDirectoryFromPath(getCurrentTemplatePath())>

     <!--- Application Starts --->

     <cffunction name="onApplicationStart">

          <cfset APPLICATION.DOMAIN = "http://localhost/website/">

          <cfset APPLICATION.DIRECTORY = "C:\inetpub\wwwroot\website\">

     </cffunction>

     <!--- A Page Request is made --->

     <cffunction name="onRequestStart" access="public">

          <cfargument type="string" name="targetPage" required="true">

          <cflogin idletimeout="#createTimeSpan(0,0,0,10)#">

               <cfif IsDefined("CFLOGIN.name") and Len(Trim(CFLOGIN.name)) and Len(Trim(CFLOGIN.password))>

                    <!--- Check if User has Access --->

                    <cfif CFLOGIN.name is "USERWITHACCESS">

                         <!--- Check if User Exists --->

                         <cftry>

                              //////////////////////////  LDAP Minified for obvious reasons //////////////////////////////

                              <cfldap action="query"

                                   name="CheckIfUser"

                              >

                              <cfcatch type="any">

                                   <cfset LoginMessage = "Username or Password Incorrect">

                              </cfcatch>

                         </cftry>

                         <cfif CheckIfUser.recordCount gt 0>

                              <!--- If User Exists and HAS Access --->

                              <!--- Authenticate user to check password --->

                              <cftry>

                                   ///////////////////////////// LDAP Minified for obvious reasons //////////////////////////////

                                   <cfldap action="query"

                                        name="AuthenticateUser"

                                   >

                                   <cfset LoginMessage = "Success">

                                   <cfcatch type="any">

                                        <cfset LoginMessage = "Username or Password Incorrect">

                                   </cfcatch>

                              </cftry>

                         </cfif>

                         <!--- If User authentication succeeded --->

                         <cfif LoginMessage is "Success">

                              <cfloginuser name="#CFLOGIN.name##createUUID()#" password="password" roles="user">

                         <cfelse>

                              <cfinclude template="loginForm.cfm"><cfabort>

                         </cfif>

                    <cfelse>

                         <!--- User Does NOT have access --->

                         <cfset LoginMessage = "You do not have access to this System">

                         <cfinclude template="loginForm.cfm"><cfabort>

                    </cfif>

               <cfelse>

                    <!---#### they didn't fill out form, return to the login form. ####--->

                    <cfinclude template="loginForm.cfm"><cfabort>

               </cfif>

          </cflogin>

     </cffunction>

</cfcomponent>

Please take note of the <cfloginuser> line:

<cfloginuser name="#CFLOGIN.name##createUUID()#" password="password" roles="user">

I was attempting to force each login to be unique to see if it was a SESSION causing the issue.

I login and refresh the page a couple of times, but then something interesting happened.

I was greated with the login screen with the error message:

"You do not have access to this System"

What this means is that for some reason the CFLOGIN.name and CFLOGIN.password fields were resent to the server. However because this message came up that means the userID was NOT "USERWITHACCESS"

So to test my theory I modified the alert message:

<cfset LoginMessage = "You do not have access to this System " & CFLOGIN.name>

SURE ENOUGH this is what I got:

You do not have access to this System USERWITHACCESS17E0C4A160-EAEB-5C23-FDF8DB569F65D3C2

What this means is the <cfloginuser> tag is resubmitting the CFLOGIN variables.

So I logged in again, and started refeshing the page to keep the <cflogin> timeout from firing.

I Timed it. I get that error at Exactly 10 Seconds after I log in which is the Timeout I have set for the SESSION Variables.

It seems like when the SESSION variable times out but the <cflogin> has not coldfusion resubmits the Login information that was stored in the <cfloginuser> tag. However the User is retaining the OLD Session ID instead of being re-assigned to the new ID.

Can anyone else verify my logic?

Also the only reason I have the <cfif CFLOGIN.name is "USERWITHACCESS"> in there is because of a last minute "Hey we only want these people to have access!" And we have yet to create the Group on our AD server (to check with LDAP) So it was quickly thrown in there. Which luckily caused me to notice this!

Hi Benoit,

I believe 3732198 resolved the java.lang.NullPointerException in CF10 Update 14.  I've added the following comment to 3839458:

-----------

Another workaround is duplicate the <cflogin>/cflogin(). Example:

<cflogin ..>

<cflogin ..>

When both have allowconcurrent=true (the default), then both will run. isUserLoggedIn() returns YES after the 1st, but the 1st login actually fails. The 2nd runs and logs in correctly.

Repro attached as Application.cfc

When THIS.loginStorage="cookie", then the issue does not reoccur if an old cfauthorization cookie is still present.

-----------

Thanks!,

-Aaron

<cfset this.name = hash( getCurrentTemplatePath() ) />

Problematic, as the application's name changes per page request. Sessions are dependent on the application name. Therefore, the session will break whenever the template path changes.

To verify this hypothesis, test it with

        <cfset this.name = hash("test string") />

<cfset this.applicationTimeout = createTimeSpan(1,0,0,0) />

<cfset this.sessionTimeout = createTimeSpan(0,0,20,0 ) />