Good morning,
We used CF2021 and we installed the lates update 17. Started having issues with our login system in one box losing the cfathentication session var.
I created a test login to trace the issue in the same box, because in other box works fine. The security team applied some stigs to the box lately and not sure if that is afecting the browser.
When user login the first time the cfauthentication is not showing.
Here is the application.cfc
<cfcomponent output="false" hint="I define the application settings and event handlers.">
<cfscript>
//Define the application settings.
this.clientManagement = false;
// define the cflogin storage
this.loginStorage = "session";
this.name = listLast(getDirectoryFromPath(getCurrentTemplatePath()), "\");
this.applicationTimeout = createTimeSpan( 0, 0, 0, 10 );
this.sessionManagement = true;
this.sessionTimeout = createTimeSpan( 0, 0, 5, 0 );
this.setClientCookies = true;
this.secureJSONPrefix = "";
</cfscript>
<!--- Define the request settings. --->
<cfsetting showdebugoutput="false"/>
<cffunction name="onApplicationStart" access="public" returntype="boolean" output="false" hint="I initialize the application.">
<cfscript>
// root and upload folder
application.root_folder = this.name;
application.upload_folder = Left(getDirectoryFromPath(getBaseTemplatePath()), FindNoCase('\', getDirectoryFromPath(getBaseTemplatePath()), FindNoCase(application.root_folder, getDirectoryFromPath(getBaseTemplatePath())))) & "UPLOAD_" & uCase(this.name);
application.absolute_folder = Left(getDirectoryFromPath(getBaseTemplatePath()), FindNoCase('\', getDirectoryFromPath(getBaseTemplatePath()), FindNoCase(application.root_folder, getDirectoryFromPath(getBaseTemplatePath()))));
</cfscript>
<!--- Initialize the application settings. --->
<cfset application.dateInitialized = now() />
<cfset application.debug = debug />
<cfset application.sqlRegEx = "<[^>]*>|insert|select|delete|update|create|drop|alter|&|%|" />
<!--- Return true so that the page can load. --->
<cfreturn true />
</cffunction>
<cffunction name="onApplicationEnd" output="no" returnType="void">
<cfargument name="applicationScope" required="true" />
</cffunction>
<cffunction name="onRequestStart" output="true" returnType="boolean">
<cfargument name="thePage" type="string" required="true" />
<cfif NOT isDefined("session.loggedIn")>
<cfset session.loggedIn = false />
</cfif>
<cfreturn true />
</cffunction>
<cffunction name="onSessionStart" access="public" returntype="void" output="false" hint="I initialize the session.">
<!--- Initialize the session settings. --->
<cfset session.dateInitialized = now() />
<cfset session.id = createUuid() />
<cfif NOT isDefined("session.loggedIn")>
<cfset session.loggedIn = false />
</cfif>
<!--- Return out. --->
<cfreturn />
</cffunction>
<cffunction name="onRequest" returnType="void">
<cfargument name="thePage" type="string" required="true" />
<!--- <cfset applicationStop() /> --->
<cflogin applicationtoken="#this.name#" idletimeout="#this.sessionTimeout#">
<cfif (isDefined("form.j_username") and len(trim(form.j_username)) GT 0 and isDefined("form.j_password") and len(trim(form.j_password)) GT 0)>
<!--- check for SQL injection and script since log in form is semi-public --->
<cfset cflogin.name = REReplaceNocase("#trim(cflogin.name)#", application.sqlRegEX, "", "ALL") />
<cfset cflogin.password = REReplaceNocase("#trim(cflogin.password)#", application.sqlRegEX, "", "ALL") />
<cfif authenticateUser(cflogin.name, cflogin.password)>
<cfset session.loggedIn = true />
<cfloginuser name="#cflogin.name#" password="#cflogin.password#" roles="SUPER USER">
<cfelse>
<cfset variables.loginError = "Username and/or Password is Invalid." />
</cfif> <!--- END IF: authenticateUser() --->
</cfif>
<!--- <cfset application.debug(session)/><cfabort> --->
<cfif isDefined("session.loggedIn") AND NOT session.loggedIn>
<cfinclude template="login.cfm" />
<cfabort />
<cfelse>
<cfinclude template="index.cfm" />
</cfif>
</cflogin>
</cffunction>
<cffunction name="authenticateUser" output="no" returntype="boolean">
<cfargument name="userName" required="yes" type="string" />
<cfargument name="passWord" required="yes" type="string" />
<cfset var returnValue = FALSE />
<cfset var qryAuthUser = "" />
<cfquery name="qryAuthUser" datasource="myDatabase">
SELECT *
FROM users u
WHERE u.user_id = <cfqueryparam cfsqltype="CF_SQL_VARCHAR" value="#trim(arguments.userName)#" />
AND u.user_password = <cfqueryparam cfsqltype="CF_SQL_VARCHAR" value="#hash(trim(arguments.passWord))#" />
</cfquery>
<cfif qryAuthUser.recordCount eq 1>
<cfset returnValue = TRUE />
</cfif>
<cfreturn returnValue />
</cffunction>
<cffunction name="debug" access="public" output="true" returntype="void">
<cfargument name="input" required="No" default="" />
<cfset var debugFile = '#application.absolute_folder#debug.cfm' />
<cfset var debugInfo = "" />
<cfsavecontent variable="debugInfo">
<p><strong>DEBUGGING</strong>: <cfoutput> #dateFormat(now(),'mm/dd/yyyy')# #timeFormat(now(), 'HH:mm:ss tt')# </cfoutput><br>
<cfdump var="#arguments.input#" label="custom" format="html">
<cfdump var="#form#" label="form" format="html">
<cfdump var="#url#" label="url" format="html">
<cfdump var="#cgi#" label="cgi" format="html">
<cfdump var="#application#" label="application" format="html">
</cfsavecontent>
<cffile action="WRITE" file="#debugFile#" output="#debugInfo#" />
</cffunction>
</cfcomponent>
And login.cfm
<!DOCTYPE html>
<cfsilent>
<cfparam name="session.lastLoginDate" default="" type="string">
<cfparam name="variables.user_id" default="" type="string">
<cfparam name="FORM.j_username" type="string" default="" />
<cfparam name="FORM.j_password" type="string" default="" />
</cfsilent>
<!--- <cfset application.debug(session)/><cfabort>--->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title><cfoutput>Test Site</cfoutput></title>
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=10, user-scalable=yes">
</head>
<body>
<h1>
Application Login
</h1>
<form action="#CGI.script_name#" method="post">
<label>
Username:
<input type="text" name="j_username" size="20" />
</label>
<br />
<br />
<label>
Password:
<input type="password" name="j_password" size="20" />
</label>
<br />
<br />
<input type="submit" value="Login" />
</form>
</body>
</html>and the Index.cfm
<cfoutput>
<cfset application.debug(session)/>
<cfif isDefined("session.loggedIn") and session.loggedIn >
<h1>We are in </h1>
</cfif>
<h1>
Application And Session Overview
</h1>
<p>
Application initialized:
#dateDiff(
"s",
application.dateInitialized,
now()
)#
seconds ago.
</p>
<p>
Session initialized:
#dateDiff(
"s",
session.dateInitialized,
now()
)#
seconds ago.
</p>
</cfoutput>The first time I do the login the session var cfathentication is not showing
If I refresh the browser the session var shows.
What am I doing wrong? Any ideas?
Thanks in advanced.
Johnny
33
Replies
What is the issue? can you explain?
By @jfb00
Sure. I shall explain.
The suggestios
- placed the cflogin tag within <cfif (isDefined("form.j_username") ...></cfif>, not the other way round.
- added the following when authentication fails
<cflogout> <cfset session.loggedIn = false>​ - corrected the logic to
<cfif NOT isDefined("session.loggedIn") OR NOT session.loggedIn>​in place of
<cfif isDefined("session.loggedIn") AND NOT session.loggedIn>
I used GetAuthUser() in my real site, later in the header page after the login.
The GetAuthUser() value is empty, any ideas why? Is this part of the security fixed?
By @jfb00
Your code is much improved, and should work. The problem you are getting with getAuthUser() is unlikely to be related to any ColdFusion settings or fixes.
I think the problem is caused because the copy of the debug function that the application uses is cached in application scope. Therefore the application initializes the function just once, when the application begins, and that's it.
However, ColdFusion stores the function itself in memory in the variables scope. It seems to me that that is the copy of the function that the application needs.
Secondly, recent updates of ColdFusion pay greater attention than before to scoping.
Putting these 2 points together, I would make the following additional suggestions:
- Change the line from
<cfset application.debug = debug />​to
<!--- 'Variables' scoping important ---> <cfset application.debug = variables.debug /> - Move the line from onApplicationStart to onRequestStart or to onSessionStart, depending on whether you wish to debug at request or session level.
In fact, let's suppose you don't intend to use application.debug anywhere else in the application, say in CFM or CFC pages. If so, I would suggest you delete that line altogether. Then replace every call
application.debug(xxx)with
variables.debug(xxx)
AdChoices