problem with session variable

[vpnr]

I have a cfm page that list employees reporting to a manager. The manager can drill down on employee ID to see more info about the employee and can update some information. I set a session variable to capture the employee ID when manager selects a particular employee. Now if the same manager opens a second tab/window on the same browser and opens the same app select a second employee the session variable gets overwritten with the second employee ID. How can i keep the value of both session variables separate? Any help is highly appreciated. Thanks.

[Charlie Arehart]

On the surface, I'd say the answer is "you can't". The session variable can't vary based on what tab a user opened.

But I have a workaround to propose, and clever people may offer a still-different answer.

My first thought on this is that instead you could use a url variable (a query string) to identify the ID of the employee to view. Of course, that's risky if you're not careful: someone could bookmark or share the url, or it could be found in their browser history, or someone could observe the url via network packet sniffing, etc.  And the solution to that is that the page should check that the user is authenticated, to make sure only someone logged into your system can access that page. You probably already do that. 

But you could and should go a step further, to ensure that only authorized managers can see their own employees and not others. You could have a session var that holds a list of a manager's employee id's, or you could just do a db lookup at the top of the page.

Or let's see what others may propose. 

[BKBK]

You have described the issue well. That helps us to arrive at the cause of the issue. Then my guess is that the session stores just one variable for employee ID. Hence the overwriting. 

Let's assume that manager ID and employee ID may change dynamically as you move from one page to the next. Then you could define a session variable that is updated whenever manager ID or employee ID changes. Something like

session.activeMgrEmployeeSession[managerID][employeeID]

 You could assign this variable a boolean value to keep track of the manager ID and employee ID.

<cfscript>
// Values obtained dynamically
managerID="mgr12";
employeeID="emp567";

// Current manager is "mgr12" and current employee is "emp567" 
session.activeMgrEmployeeSession[managerID][employeeID]=true;

if (managerID is "mgr12" and employeeID is "emp567") {
	writeoutput("Value of session.activeMgrEmployeeSession[managerID][employeeID] is: " & session.activeMgrEmployeeSession[managerID][employeeID]);
}

</cfscript>