Highlighted

CF10 keeps on calling onSessionStart

New Here ,
May 29, 2016

Copy link to clipboard

Copied

Hi,

I moved a site from CF 8 to CF10. CF8 resided in a different server.  I put a WriteOutput(" testing") in the onSessionStart function of the Application.cfc to know how the site will behave. I ran the site, on the default page the the "testing" appeared. When I clicked on the SignIn page, the "testing" word appeared again. It's calling the onSession start. Here is what's in my onSessionStart.

<cffunction name="onSessionStart" returntype="void">

  <cfif NOT StructKeyExists( cookie,"CFID" ) OR NOT StructKeyExists( cookie,"CFTOKEN" )>

  <cfheader name="Set-Cookie"  value="CFID=#session.CFID#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">

  <cfheader name="Set-Cookie"  value="CFToken=#session.CFToken#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">

  </cfif>

  <cfscript>

  WriteOutput("testing");

  StructClear(session);

  session.pageRedirector = ""; //used for sending a user back to a previous requested page when authentication is required first

  session.profile = CreateObject("component","mysite.cfcs.user");

  session.shoppingCart = CreateObject("component","mysite.cfcs.cart");

  session.catalog = CreateObject("component","mysite.cfcs.catalog");

  </cfscript>

</cffunction>

 

I'm using CSRFGenerateToken() to verify the page, so if the application keeps on calling the onSessionStart, the session will always be cleared and the user was not able to login.

Here are some of the variables:

  <cfscript>

  this.name="mysite";

  this.clientmanagement=false;

  this.sessionmanagement=true;

  this.setclientcookies=false;

  this.sessiontimeout="#CreateTimeSpan(0,0,40,0)#";//TODO: revert back to 40 mins as default

  this.applicationtimeout="#CreateTimeSpan(0,1,0,0)#";

  this.loginStorage = "Session";

  this.logFile = "mysite_LOG";

  this.scriptProtect = "all";

  </cfscript>

 

To fix the issue, I set setclientcookies to true. The session lost issue is solved but it gave a new issue - session is not terminated on browser exit.

IIS version is = IIS 8.5

OS version = Win server 2012 R2

If anybody can give some ideas, I would deeply appreciate it.

Thank you in advance.

Views

207

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more

CF10 keeps on calling onSessionStart

New Here ,
May 29, 2016

Copy link to clipboard

Copied

Hi,

I moved a site from CF 8 to CF10. CF8 resided in a different server.  I put a WriteOutput(" testing") in the onSessionStart function of the Application.cfc to know how the site will behave. I ran the site, on the default page the the "testing" appeared. When I clicked on the SignIn page, the "testing" word appeared again. It's calling the onSession start. Here is what's in my onSessionStart.

<cffunction name="onSessionStart" returntype="void">

  <cfif NOT StructKeyExists( cookie,"CFID" ) OR NOT StructKeyExists( cookie,"CFTOKEN" )>

  <cfheader name="Set-Cookie"  value="CFID=#session.CFID#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">

  <cfheader name="Set-Cookie"  value="CFToken=#session.CFToken#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">

  </cfif>

  <cfscript>

  WriteOutput("testing");

  StructClear(session);

  session.pageRedirector = ""; //used for sending a user back to a previous requested page when authentication is required first

  session.profile = CreateObject("component","mysite.cfcs.user");

  session.shoppingCart = CreateObject("component","mysite.cfcs.cart");

  session.catalog = CreateObject("component","mysite.cfcs.catalog");

  </cfscript>

</cffunction>

 

I'm using CSRFGenerateToken() to verify the page, so if the application keeps on calling the onSessionStart, the session will always be cleared and the user was not able to login.

Here are some of the variables:

  <cfscript>

  this.name="mysite";

  this.clientmanagement=false;

  this.sessionmanagement=true;

  this.setclientcookies=false;

  this.sessiontimeout="#CreateTimeSpan(0,0,40,0)#";//TODO: revert back to 40 mins as default

  this.applicationtimeout="#CreateTimeSpan(0,1,0,0)#";

  this.loginStorage = "Session";

  this.logFile = "mysite_LOG";

  this.scriptProtect = "all";

  </cfscript>

 

To fix the issue, I set setclientcookies to true. The session lost issue is solved but it gave a new issue - session is not terminated on browser exit.

IIS version is = IIS 8.5

OS version = Win server 2012 R2

If anybody can give some ideas, I would deeply appreciate it.

Thank you in advance.

Views

208

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
May 29, 2016 0
Most Valuable Participant ,
May 30, 2016

Copy link to clipboard

Copied

This forum is to discuss the forums, not products

List of Forums https://forums.adobe.com/thread/1929760 to find a forum for your program

-or Direct to the Forum Index https://forums.adobe.com/welcome

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
May 30, 2016 0
Guru ,
May 30, 2016

Copy link to clipboard

Copied

Moved to ColdFusion forum at ColdFusion

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
May 30, 2016 0
Most Valuable Participant ,
May 31, 2016

Copy link to clipboard

Copied

Looks like this question was also asked over on StackOverflow: http://stackoverflow.com/questions/37539628/new-session-on-every-request

Likes

Translate

Translate

Report

Report
Community Guidelines
Be kind and respectful, give credit to the original source of content, and search for duplicates before posting. Learn more
Reply
Loading...
May 31, 2016 0