I am having the same issue, but I noticed something very strange...
Here is my Application.cfc
<cfcomponent>
<cfset This.name = "WebsiteCMS">
<cfset This.applicationTimeout = "#createTimeSpan(5,0,0,0)#">
<cfset This.datasource = "CMS">
<cfset This.loginStorage = "session">
<cfset This.Sessionmanagement = true>
<cfset This.Sessiontimeout = "#createTimeSpan(0,0,0,10)#">
<cfset This.mappings["/www"] = getDirectoryFromPath(getCurrentTemplatePath())>
<!--- Application Starts --->
<cffunction name="onApplicationStart">
<cfset APPLICATION.DOMAIN = "http://localhost/website/">
<cfset APPLICATION.DIRECTORY = "C:\inetpub\wwwroot\website\">
</cffunction>
<!--- A Page Request is made --->
<cffunction name="onRequestStart" access="public">
<cfargument type="string" name="targetPage" required="true">
<cflogin idletimeout="#createTimeSpan(0,0,0,10)#">
<cfif IsDefined("CFLOGIN.name") and Len(Trim(CFLOGIN.name)) and Len(Trim(CFLOGIN.password))>
<!--- Check if User has Access --->
<cfif CFLOGIN.name is "USERWITHACCESS">
<!--- Check if User Exists --->
<cftry>
////////////////////////// LDAP Minified for obvious reasons //////////////////////////////
<cfldap action="query"
name="CheckIfUser"
>
<cfcatch type="any">
<cfset LoginMessage = "Username or Password Incorrect">
</cfcatch>
</cftry>
<cfif CheckIfUser.recordCount gt 0>
<!--- If User Exists and HAS Access --->
<!--- Authenticate user to check password --->
<cftry>
///////////////////////////// LDAP Minified for obvious reasons //////////////////////////////
<cfldap action="query"
name="AuthenticateUser"
>
<cfset LoginMessage = "Success">
<cfcatch type="any">
<cfset LoginMessage = "Username or Password Incorrect">
</cfcatch>
</cftry>
</cfif>
<!--- If User authentication succeeded --->
<cfif LoginMessage is "Success">
<cfloginuser name="#CFLOGIN.name##createUUID()#" password="password" roles="user">
<cfelse>
<cfinclude template="loginForm.cfm"><cfabort>
</cfif>
<cfelse>
<!--- User Does NOT have access --->
<cfset LoginMessage = "You do not have access to this System">
<cfinclude template="loginForm.cfm"><cfabort>
</cfif>
<cfelse>
<!---#### they didn't fill out form, return to the login form. ####--->
<cfinclude template="loginForm.cfm"><cfabort>
</cfif>
</cflogin>
</cffunction>
</cfcomponent>
Please take note of the <cfloginuser> line:
<cfloginuser name="#CFLOGIN.name##createUUID()#" password="password" roles="user">
I was attempting to force each login to be unique to see if it was a SESSION causing the issue.
I login and refresh the page a couple of times, but then something interesting happened.
I was greated with the login screen with the error message:
"You do not have access to this System"
What this means is that for some reason the CFLOGIN.name and CFLOGIN.password fields were resent to the server. However because this message came up that means the userID was NOT "USERWITHACCESS"
So to test my theory I modified the alert message:
<cfset LoginMessage = "You do not have access to this System " & CFLOGIN.name>
SURE ENOUGH this is what I got:
You do not have access to this System USERWITHACCESS17E0C4A160-EAEB-5C23-FDF8DB569F65D3C2
What this means is the <cfloginuser> tag is resubmitting the CFLOGIN variables.
So I logged in again, and started refeshing the page to keep the <cflogin> timeout from firing.
I Timed it. I get that error at Exactly 10 Seconds after I log in which is the Timeout I have set for the SESSION Variables.
It seems like when the SESSION variable times out but the <cflogin> has not coldfusion resubmits the Login information that was stored in the <cfloginuser> tag. However the User is retaining the OLD Session ID instead of being re-assigned to the new ID.
Can anyone else verify my logic?
Also the only reason I have the <cfif CFLOGIN.name is "USERWITHACCESS"> in there is because of a last minute "Hey we only want these people to have access!" And we have yet to create the Group on our AD server (to check with LDAP) So it was quickly thrown in there. Which luckily caused me to notice this!
40
Replies
AdChoices