Cflogin imbulit function not working

[Janaki30364817ulno]

We have moved from old sever to new server using Coldfusion 2016 version. We have below queries regarding this migraton.

1.       Using CFlogin we are validating the current user logged in application or not with help of Isuserloggedin() function.

2.       The IsUserloggedin() is working before (cflocation)redirection, once redirected(cflocation) to another page it’s not working.

3.       IsUserroles(),GetUserroles() are also not working after redirection(cflocation).

[Charlie Arehart]

I'm not aware of any change in functionality for those functions in the last few releases, let alone cf2016 (which is unsupported and was last updated in March 2021. Since then cf2018, cf2021, and cf2023 have come out, as you may know.)

I suspect your problem has another explanation, not the "functions not working", but "something else about your code or configuration making it look like 'those functions aren't working' ".

I would recommend you resort to traditional debugging, to confirm the code you are asking about is even being called. You could use cfoutput, cfdump, cfabort, cflog and the like. Or with the right tools and configuration you can even do interactive step debugging, line by line. That's way beyond trying to explain here, of course.

Let us know what you may find. 

[Janaki30364817ulno]

Coldfusion 2016 supported on Window server 2012?

[Charlie Arehart]

Yes, it did. So, no, that's not the cause of your issue. But sure, anytime you move to a new server there's a risk of some unexpected impact, including differences in how the new box is configured, such as system resources, network config, firewalls, a/v tools, and more.

Still, you've not responded to trying the suggestion in my first reply. Doing that should be far more effective than trying to guess "what changed"? 

[BKBK]

First, a question. Do you mean IsUserInRole instead of IsUserRoles ?

The issue you're facing tells me something. Your application might not be maintaining session from one page to the next. If so, then the things to look at are the settings in Application.cfc. 

Suggestion:

• Your application should make use of an Application.cfc file (if it does not yet do so). A simple Application.cfc, such as the following, is sufficient:
  

  <cfcomponent>
  <!---*********** Make sure to include the next 5 settings ***********--->
  <cfset This.name = "MyApplication">
  <cfset This.loginstorage="Session">
  <cfset This.sessionmanagement="True">
  <cfset This.sessiontimeout="#createtimespan(0,0,20,0)#">
  <cfset This.applicationtimeout="#createtimespan(2,0,0,0)#">
  
  <cffunction name="onApplicationStart" returntype="boolean" >
  	<cfreturn true>
  </cffunction>
  
  <cffunction name="onApplicationEnd">
  <cfargument name="ApplicationScope" required="true"/>
  </cffunction>
  
  <cffunction name="onRequestStart">
  <cfargument name = "targetPage" type="String" required="true"> 	
  	<cfreturn true>
  </cffunction>
  
  <cffunction name="onRequestEnd">
  <cfargument type="String" name = "targetTemplate" required=true/>
  </cffunction>
  
  <cffunction name="onSessionStart">
  </cffunction>
  
  <cffunction name="onSessionEnd">
  <cfargument name = "SessionScope" required="yes"/>
  <cfargument name = "AppScope" required="yes">
  </cffunction>
  
  </cfcomponent>​

[Janaki30364817ulno]

Yes, you are right session is not maintaing in my application.

For example:

Log in page: 

http://xxxxxxxx:8080/test_public_1?CFID=2946&CFTOKEN=68589b4d9f6afac0-1971ECBF-EBEA-AA83-1F1F4AA9A71...

After Logged : CFID and CFToken changing 

http://xxxxxxxx:8080/test_public_1?CFID=2982&CFTOKEN=f9dab549db54f880-19A99525-E145-B538-B6D6C2E04AFFFC8B

I have written the code as mentioned in above statement still not working.

Anything need to change in Coldfusion server setting?

[BKBK]

Anything need to change in Coldfusion server setting?

By @Janaki30364817ulno

Yes.

1. Make use of an Application.cfc file.
2. In it, apply at least the 5 settings I mentioned in the code sample.

[Janaki30364817ulno]

Yes, I am using the 5 setting plus below setting in my application
<cfset THIS.name="testapplication">

<cfset This.loginstorage="Session">
<cfset THIS.clientManagement=True>
<cfset THIS.sessionManagement=True>
<cfset THIS.setClientCookies=true>
<cfset THIS.sessioncookie.secure = true>
<cfset THIS.sessioncookie.httponly = true>
<cfset THIS.applicationTimeout=createtimespan(0,2,30,0)>
<cfset THIS.sessionTimeout=createtimespan(0,0,30,0)>
<cfset THIS.sessioncookie.httponly=true>

[Charlie Arehart · Accepted solution]

Do you realize that in using THIS.sessioncookie.secure=true, that means that if you're accessing your pages with http rather than https, it will indeed seem not to maintain your session--as it tells the browser that cf's session cookie should only be sent back if the request uses https. And since you're also using this.loginstorage="Session", that's why your cflogin processing would also not work as expected.

But again, none of this is a change in behavior between cf2016 and other recent versions before or since. (You've not said what version you were on before this "new server". Was the old also running cf2016? If not, what version?)