I'm having this problem with my browser caching login information, even after the browser is closed and reopened. I have checked the box to use J2EE sessions ( a setting in CF Admin) so I thought that should take care of the problem, but it has not. Also, Ive waited until the session timeout period is over inside the CFAPPLICATION tag (5 minutes) (with all browers closed) and it is still cached. It does loose it when session timeout period is over from CF ADMIN 20 min. However, I thought the sessiontimeout period in the tag overrides the timeout period in ColdFusion Administrator? Please help!
Scenario: I am authenticating users using their Oracle username and password. I also have a form that allows them to change their password. I am able to successfullly change my password. I close my browser. Then I try to log in and I am able to use my username and BOTH passwords work (original and new). Where is this being cached? If you look at my logout code below, you'll see I've tried to delete every session variable.
Please be kind, I've tried many suggestions and can't get it to work.
ColdFusion MX (using standalone on pc for development right now, will move to CFMX on IIS in a couple months)
Windows 2000
Internet Explorer 6
I have tried to use the CFLOGIN framework but that doesn't work either.
The four primary pages are listed here. Note: all code is attached for each page.
1. application.cfm
2. loginform.cfm
3. logincheck.cfm
4. logout.cfm
application.cfm
__________________________
__________
__________
_________
<!--- Set application to no-cache allowed --->
<cfheader name="Expires" value="-1">
<cfheader name="Pragma" value="no-cache">
<cfheader name="cache-control" value="no-cache, no-store, must-revalidate">
<!--- Name the application, enable application variables --->
<CFAPPLICATION Name="Main"
applicationtimeout="#creat
etimespan(
0,0,5,0)#"
sessiontimeout="#createtim
espan(0,0,
5,0)#"
clientmanagement="no"
sessionmanagement="yes"
setclientcookies="yes">
<cfsetting showDebugOutput="Yes">
<cfset Main_DataSource = "prod" >
<cfif not isdefined("session.auth.is
loggedin")
>
<cfif isdefined("form.userlogin"
)>
<cfinclude template="logincheck.cfm">
</cfif>
<cfinclude template="loginform.cfm">
<cfabort>
</cfif>
__________________________
__________
__________
____
loginform.cfm:
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "
http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>Login Form</title>
</head>
<!--- Place cursor in "User Name" field when page loads --->
<body onLoad="document.UserLogin
Form.UserL
ogin.focus
();">
<h1>Login form</h1>
<!--- Start Login Form --->
<cfform action="#CGI.SCRIPT_NAME#"
name="UserLoginForm" method="post">
<!--- make the username and password fields required --->
<p>
<input type="hidden" name="UserLogin_required">
<input type="hidden" name="UserPassword_require
d">
</p>
<p>Please enter your username and password to access your account. </p>
<table width="600" border="0">
<tr>
<td width="328" height="146"><table width="100%" border="0" background="../../gifs/log
inbox.gif"
>
<tr>
<td height="142" valign="top"><br>
<table width="283" border="0">
<tr>
<td width="119"><div align="right">User Name</div></td>
<td width="154"><cfinput
type="text"
name="UserLogin"
value=""
maxlength="100"
required="Yes"
message="Please type your username first"></td>
</tr>
<tr>
<td><div align="right">Password</di
v></td>
<td><cfinput
type="Password"
name="UserPassword"
value=""
maxlength="100"
required="Yes"
message="Please type your password"></td>
</tr>
</table>
<div align="center"><br>
<input type="submit" value="Log In">
</div></td>
</tr>
</table></td>
<td width="262" valign="top"><br>
<ul><li>forgot your password?</li>
<li>new account</li>
</ul></td></tr>
</table>
<p> </p>
</cfform>
</body>
</html>
__________________________
__________
__________
__
Logincheck.cfm:
<!--- <cfparam name="form.userlogin" type="string">
<cfparam name="form.userpassword" type="string">--->
<cfquery name="GetUser" datasource="#Main_Datasour
ce#" username="#Form.userlogin#
" password="#Form.userpasswo
rd#">
Select sysdate
From dual
</cfquery>
<!--- If the GetUser query is processed, Oracle username and password are correct --->
<CFIF GetUser.RecordCount EQ 1>
<cfquery name="EnableRoles" datasource="#Main_Datasour
ce#" username="#Form.UserLogin#
" password="#Form.UserPasswo
rd#">
Set Role All
</cfquery>
<cfquery name="GetUserRoles" datasource="#Main_Datasour
ce#" username="#Form.UserLogin#
" password="#Form.UserPasswo
rd#">
Select Granted_Role
From USER_ROLE_PRIVS
</cfquery>
<!--- Retrieve employee id number that matches to user login name, used to set emp_id session variable below --->
<cfquery name="GetUserID" datasource="#Main_Datasour
ce#" username="#Form.UserLogin#
" password="#Form.UserPasswo
rd#">
Select userid, emp_id, system_id
From employee_accounts
Where system_id = 'ORACLE' AND
userid = '#UCase(FORM.UserLogin)#'
</cfquery>
<!--- Consider the user "logged in" --->
<cflock scope="session" type="Exclusive" timeout="20">
<cfset session.auth = structnew()>
<cfset session.auth.isloggedin = "yes">
<cfset session.auth.userlogin = "#GetUserID.userid#">
<cfset session.auth.userpassword = "#Form.UserPassword#">
<cfset session.auth.emp_id = "#GetUserID.emp_id#">
<cfset session.auth.roles = "#ValueList(GetUserRoles.G
ranted_Rol
e)#">
<cfset session.auth.cfid = "#Cookie.CFID#">
<cfset session.auth.cftoken = "#Cookie.CFTOKEN#">
</cflock>
<cflocation url="#cgi.SCRIPT_NAME#">
</cfif>
__________________________
__________
__________
___
Logout.cfm:
<!--- Disable roles for current session only--->
<cfquery name="DisableRoles" datasource="#Main_Datasour
ce#" username="#Session.auth.Us
erLogin#" password="#Session.auth.Us
erPassword
#">
Set Role None
</cfquery>
<cflogout>
<cfif IsDefined("COOKIE.CFAUTHOR
IZATION_Ma
in")>
<CFCOOKIE name="CFAUTHORIZATION_Main
" EXPIRES="NOW">
</cfif>
<cfif IsDefined("COOKIE.CFID")>
<CFCOOKIE name="CFID" EXPIRES="NOW">
</cfif>
<cfif IsDefined("COOKIE.CFTOKEN"
)>
<CFCOOKIE name="CFTOKEN" EXPIRES="NOW">
</cfif>
<cfset session.auth.UserLogin = "">
<cfset session.auth.UserPassword = "">
<!--- Terminate the user's session by deleting all session variables --->
<cflock timeout=20 scope="Session" type="Exclusive">
<CFSCRIPT>StructClear(Sess
ion.Auth);
</CFSCRIPT
>
<cfset StructDelete(session.auth,
"isloggedin")>
<cfset StructDelete(session.auth,
"CFID")>
<cfset StructDelete(session.auth,
"CFTOKEN")>
<cfset StructDelete(session.auth,
"UserLogin")>
<cfset StructDelete(session.auth,
"UserPassword")>
<cfset StructDelete(session.auth,
"emp_id")>
<cfset StructDelete(session, "CFID")>
<cfset StructDelete(session, "CFTOKEN")>
<cfset StructDelete(session, "URLToken")>
<cfset StructDelete(session, "SessionID")>
</cflock>
<CFAPPLICATION Name="AIS_Main"
applicationtimeout="#creat
etimespan(
0,0,0,0)#"
sessiontimeout="#createtim
espan(0,0,
0,0)#"
clientmanagement="no"
sessionmanagement="yes"
setclientcookies="yes">
<cflocation url="/test/index.htm">
__________________________
__________
__________
_____
Start Free Trial
