Session Variable Not Persisting?

[ColdFusion_Confusion]

Hola!
I hope all is well.

I'm running into an issue in a ColdFusion (CF) app and I was hoping someone could help. I took over an app that someone else wrote that's running ColdFusion v11,0,19,314546; IIS v10.0.14393.0; Windows 2016 Server. I know, I know. A little old school. But that's what I gotta work with.

The CF app works. It has been in Production for years. Decades, actually! So I know the code works. I'm in the process of moving the app from Apache Tomcat to IIS. And that's where I'm running into problems.

I'm new to ColdFusion so please excuse my description, but this CF app is made up of ColdFusion scripts that are "hosted" in SharePoint Online (SPO) pages. In other words, the app consists of a number of SharePoint Onlne webpages.  Each SPO webpage is made up of webparts. These webparts are ColdFusion scripts that execute when the SPO pages load.

Every time a SPO page loads, the application.cfm is called which grabs the user's identify from the SPO page, by referencing "#user#". That user's identity is then stored in a CF session variable which is referenced throughout the app using "session.userloginId". That works fine. No problems. The session variable in this case works great!

I'm running into issues when I a parent page opens a child page (via an include or calling it). When a parent page calls and opens/includes a child page, the session variable (session.userloginId) does not persist even though it's the same session and I get an error saying "Variable User is undefined". That "Variable User" is the "#user#" I mentioned a bit ago; the user variable that's accessed in application.cfm, which is called each time a SPO page is loaded.

I only get this error when a parent page opens a child page. I do not get this error if I click on a link and go from one SPO page to another. The session variable maintains the user's identity in that case. This error only occurs when there's an INCLUDE or a call from one page to another page within the CF script. Only then will I get that Variable User is Undefined error message.

This same exact code works fine on the servers that use Apache Tomcat. So it would seem that the session and client variable settings are set correctly in CF Adminiatrator. Caching too.

IIS is set to Keep Alive. Windows Authentication and Anonymous Authentication in IIS are set to ENABLED. Like I mentioned, session variables work fine across pages. Except when a child page is called by a parent. Oh, and I should mention, the parent page is https. The child page is http. And then the child calls a parent that https, but the app crashes before I get to that point.

I also traced the variables and set debugging to robust. That shows me that the session variable is undefined as the error says I just can't figure out if it's an IIS setting that I have to set, or what, but the code works fine in Tomcat, so I'm assuming it's an IIS setting?

Anyway, I'm sure I'm missing a bunch of info in this description, but I hope you have enough to go on. Any suggesstions would be greatly appreciated!

Thanks!!

JR

[WolfShade]

Hi, CC,

I'm not trying to be critical, but Apache Tomcat and IIS are two different beasts.  Apache Tomcat is the Java that CF wraps around to allow us to code as we do.  IIS is the webserver.  So I'm assuming you mean that you are switching from Apache Server to IIS.  To which I would question 'why'.  Even if running the Windows version of Apache Webserver, IMHO Apache is the better webserver.  But that's just my opinion.

I've  never tried to integrate SharePoint with CF, but I've long known that it's possible.  But when you say "parent page opening a child page", I'm not quite understanding the internal process.  Are both parent and child SPO files that include some .cfm functionality?  If that's the case, then there shouldn't be any issues as the session ID should be static.

However, I have (a few years ago) run into scenarios where every page load would provide a different JSESSIONID, which will interfere with session variables.  Unfortunately, I do not remember what I had to do to fix that.  But as long as the JSESSIONID is static/never changing, it should work.  So it might be the IIS webserver is not set to keep JSESSIONID values.

HTH,

^ _ ^

[Dave Watts]

First, thanks for posting a bunch of info! I wish more people did that. So don't apologize for that. Second, the problem is probably related to the fact that some of these pages are being served by https and others by http. I bet you would see that you have different sessions across the two if you used CFDUMP to dump your session scope or other indicators.

Now, why aren't they using the same session? That's a little more complicated. Maybe it's because you have the "secure" attribute checked in the CF Administrator. Maybe it's because something in IIS is rewriting the ones with HTTPS for you - that's not a default behavior, but it's possible. IIS has a lot of stuff going on in it.

Finally, when you say "Apache Tomcat" I assume you mean the built-in web server that comes with CF, not Apache HTTPD Server.

Dave Watts, Eidolon LLC

[WolfShade]

Finally, when you say "Apache Tomcat" I assume you mean the built-in web server that comes with CF, not Apache HTTPD Server.

I completely forgot about the built-in webserver!  *facepalm*

V/r,

^ _ ^