new cfid with every refresh

Question

I updated a test server from ColdFusion 10 to ColdFusion 11 30 days Enterprise trail edition with update 7.

However, every time I hit refresh in my browsers, I get a new cfid. As a result, a valid session is not found so the login page doesn't work.

I checked the session in coldfusion admin page and my cookie in my browsers, they are both created correctly.

This is what I have in my application.cfm

<CFAPPLICATION NAME="TESTWEB"

CLIENTMANAGEMENT="Yes"

SETCLIENTCOOKIES="Yes"

SESSIONMANAGEMENT="Yes"

SESSIONTIMEOUT = "#CreateTimeSpan(7,0,0,0)#"

SETDOMAINCOOKIES = "No">

However, when I open the page from the host computer, then the cfid doesn't get change everytime I hit refresh, so everything works.

During login, I had code that set cfid/cftoken to cookie, but since I changed to SETCLIENTCOOKIES="Yes", I removed those code. The only other place would be in logout.

I am not using jsessionids, only coldFusion session id.

Timeout for all session variables is 7 days.

Any idea what can cause my problem?

Anonymous · Accepted Answer

OK.You said:I am not using jsessionids, only coldFusion session id.But later you added:What I meant before is my browser at least contain cfid cookie. It also contain cfid, cftoken, jessionid, Did you disable JEE sessions in the administrator?In ColdFusion Admin page, I go to Server Settings -> Memory Variable and I see Use J2EE session variables uncheck, Enable Application Variables and Enable Session Variables checked. I have 7 days for timeout for Application Variables and 7 days 20 minutes for Sessions Variables in both Maximum and Default Timeout. In Session Cookie Setting, cookie timeout is 15768000 minutes and HTTPOnly is checked.Do you think these setting are correct? This is where JEE session is set right?

BKBK · Answer

dzhaos wrote:This is what I have in my application.cfmTimeout for all session variables is 7 days.It is uncllear what the problem is. First you say sessions don't work, then you say they do.In any case, you should switch to Application.cfc, using a more realistic value of sessiontimeout.Application.cfc this.name = "TESTWEB"; this.applicationTimeout = "#createTimespan(1,0,0,0)#"; this.clientManagement = "yes"; this.clientStorage = "cookie"; this.sessionManagement = "yes"; this.sessionTimeout = "#createTimeSpan(0,0,20,0)#"; this.setClientCookies = "yes"; this.setDomainCookies = "no";

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.

Scanning file for viruses.

This file cannot be downloaded