Session variable and Iframe

[plarts]

I have an application inside an Iframe,
in the first CFM page, I set a session variable,
when I go to the next page in the Iframe, the session variable have disappeared.
It seems that session variables are not working inside an Iframe ?

Thansk for any comment.
Pierre.

[Dan_Bracuk]

What makes you think that it's not there? Did you cfdump the session scope? Did you look at the debugging info?

Is the iframe page in the correct directory path to be controlled by your application.cfc/cfm file?

[AvantSG]

so... 11 years later and I got this same problem. If I run the app outside of the iframe, it works fine. I can set session vars and everything works great. I run the same app inside the iframe and it won't set session variables.

Anyone have an idea what's happening?

[BKBK]

@AvantSG , Could you please create a new thread? 11 years is a long time in software. The contributors might have moved on. ColdFusion certainly has.

In any case, I can already guess what causes the observed session behaviour. Session is working fine, but your application fails to maintain session when the user navigates from one page to the next inside the IFrame.

[AvantSG]

Possibly true... here's what I discovered last night after some trial and error. I can get it to work in firefox, just not Edge. So it is maintaining session but somehow MS Edge isn't playing ball with it.

[BKBK]

Include the following session code in your Application.cfc, and see if it helps.

<!--- Application.cfc excerpt --->
<cfcomponent>
<cfset this.sessionmanagement = "true">

<cffunction name="onSessionStart">
    <cfif not structKeyExists(cookie, "CFID") or not structKeyExists(cookie, "CFToken")> 
        <cfcookie name="CFID" value="#session.cfid#">
        <cfcookie name="CFToken" value="#session.cftoken#">
    </cfif>
</cffunction>
<cfcomponent>

[AvantSG]

Unfortunately it didn't work.

Here's what's interesting. The cookie values are as follows:

CFID: Z5cmju6xz2ts8lyy95jtgdc4qh699a7mp8vzob5emp50rr3zypi-115867312
CFTOKEN: Z5cmju6xz2ts8lyy95jtgdc4qh699a7mp8vzob5emp50rr3zypi-cc8a7dae0940aa4f-957A2756-AB92-A864-5F524BEA4E1FF158
JSESSIONID: 1E63F377C9AF2F8FD848C3BB2C373293.cfusion

When I dump out what's in SESSION, here's what I see:

sessionid: 9F6CC69CBA4885FE892659A77D7F1883.cfusion

urltoken: CFID=115867318&CFTOKEN=ece01b4dafb9756c-957AE093-0F39-B883-6C63927C334C9AD9&jsessionid=9F6CC69CBA4885FE892659A77D7F1883.cfusion

What's in session and what's in the cookies don't match. That would likely explain why I can't get to the session data I set. The question is why. I can run the app independent of the iframe and have no problems. As soon as it's run inside the iframe, it's almost like it gets confused.

[AvantSG]

So the last post with the cookie/session info was the app running in the iframe. I ran it again separately and here's what I get:

CFID: Z5cmju6xz2ts8lyy95jtgdc4qh699a7mp8vzob5emp50rr3zypi-115867312
CFTOKEN: Z5cmju6xz2ts8lyy95jtgdc4qh699a7mp8vzob5emp50rr3zypi-cc8a7dae0940aa4f-957A2756-AB92-A864-5F524BEA4E1FF158
JSESSIONID: 1E63F377C9AF2F8FD848C3BB2C373293.cfusion

When I dump out what's in SESSION, here's what I see:

sessionid: 1E63F377C9AF2F8FD848C3BB2C373293.cfusion

urltoken: CFID=115867312&CFTOKEN=cc8a7dae0940aa4f-957A2756-AB92-A864-5F524BEA4E1FF158&jsessionid=1E63F377C9AF2F8FD848C3BB2C373293.cfusion

and i see the session data I set which wasn't the case in the iframe...

[AvantSG]

And now I'm going to really trip you out. The inconsistent behavior is NOT happening in Firefox. I see the issue in every other browser but FF. The cookie data and session data match AND I see my session variables I set which normally disappear in the other browsers because of the data mismatch.

The question is, why? What does FF do that the other browsers (including safari on Mac) don't???

[AvantSG]

I think CF can't set cookies in iframes on browsers other than FireFox. That appears to be the problem.

[BKBK]

Hi @AvantSG ,

I now understand what you're trying to do. I realize we've been talking at cross purposes.

Please note: when you create an IFrame within a CFM page, then there are potentially 2 different sessions. Hence, 2 different sets of CFID/CFToken values. 

The source of the IFrame is in effect a separate application. For example, if you refreshed the CFM page several times, I would expect the CFID/CFToken values for the page to stay the same, but those of the embedded page to change each time.