Tracking the CFTOKEN

[umuayo]

Hello,

How do I track the CFTOKEN of a logged in user through out the whole site.

I have seen cases where the CFTOKEN is passed through as a FORM submit from page to page.

Is this a proper way to track the CFTOKEN?

Thanks

[BKBK]

Yes, that is one way to track session tokens, of which CFTOKEN is one. But I can think of a more convenient way.

Enable application and session variables in the ColdFusion Administrator. If you're using Application.cfm, apply something like

<cfapplication applicationTimeout="#createTimespan(1,0,0,0)#" sessionTimeout="#createTimespan(0,0,20,0)#" sessionManagement="yes" loginStorage="session">

If using Application.cfc, apply

<cfset this.applicationTimeout="#createTimespan(1,0,0,0)#">

<cfset this.sessionTimeout="#createTimespan(0,0,20,0)#">

<cfset this.sessionManagement="yes">

<cfset this.loginStorage="session">

Then, if you use <cflogin> and <cfloginuser> to log the user in, ColdFusion will automatically maintain the user's CFID and CFToken as the user navigates from page to page, until the user logs out or until his session expires.

[umuayo]

The Site is not using a <cflogin> and <cfloginuser>.

[BKBK]

How then does the site log the user in?

[12Robots]

Do you have session management enabled?  If so, the CFToken is in the user's session and is already being tracked. The CFID and CFToken cookies are already passed on each request.

If you don't have session management enabled, why not?

Passing tokens on every request is a GINORMOUS PITA. You don't want to have to do that.

Jason

[BKBK]

12Robots wrote:

Passing tokens on every request is a GINORMOUS PITA.

Let alone tying the tokens with authentication.

[parkerst]

I think it sounds like he wants a new session for each browser/tab etc.

[12Robots]

In my personal opinion, that is madness.

[parkerst]

Agree, I've only ever seen real justification for this once, in my entire career.