CFTOKEN PROBLEM IN CF10

Forum|Forum|13 years ago
October 15, 2012
3 replies
7500 views

Hi,Irecently installed Coldfusion 10.When i login from first browser it logs me in and when i try to login from another browser it is throwing me out that there is active session which doesnt happen in CF9.I noticed that CFTOKEN is not genearating new token when i try login from second browser.Any Help would be appreciated.

This topic has been closed for replies.

BKBK

Braniac

@Mucharla,

Go back to the bug report, and scroll down to the post by Hemant Khandelwal. He gives a workaround, involving the Java flag

-Dcoldfusion.session.protectfixation=false

A

Anonymous

Hi BKBK,

can you please let me know where exactly bug report means.

regards

raja.

A

Anonymous

Wait... what?

Are these two browsers on the same computer? If they are then that is not two browsers, that is one browser. You cannot open two instances of IE on the same machine and expect them to maintain different sessions.

If that is what you are doing then when you "delete the cookies in the second browser" you are also deleting the cookies in the first.

When you were doing this in CF9, what version were you using? Did you have any of the security hotfixes installed?

Of course CF10 allows multiple browser sessions, but to do that you have to actually use multiple browsers, not the same browser twice.

jason

In CF9 when i use two IE browsers on same machine it allowed me to login into two browsers,but CF10 doesnt allow me.

this is what my problem.

A

Adam Cameron.

Inspiring

Yes, this is a new (and somewhat hamfisted/misguided in its implementation) "feature" of CF10. I think it only comes into play if you select the "secure profile" option when installing though? I dunno how to switch it off.

I recommend voting to get this reverted back to the default behaviour of CF prior to CF10, and the new feature made optional.

Details here:

https://bugbase.adobe.com/index.cfm?event=bug&id=3339008

--

Adam

A

Anonymous

hi Adam Cameron.,

can you give any quick solution for this as this needs to tide up soon.

regards

raja.

A

Adam Cameron.

Inspiring

Yes, the solution was to not install the secure profile in the first place. As to solve it after the fact: I have no idea. I've never had to deal with it.

If you're in a hurry, you should be soliciting paid-for support from a consultant, not asking questions on a community-based forum.

--

Adam