Application and Session Variables and Locking

when I say you do not need to lock these methods.. what i mean is... normal locking applies. some you may, some you may not...

I am using Application.cfm because I am more familiar with it than Application.cfc.  In the future, I am thinking about using Application.cfc.  When using Application.cfc, does it automatically lock session variables as well?  

Do I need to lock the application variable when using the application variable to call a function (ex. application.objSystem.listValuesFound(....)) in my pages?  In my application.cfm file, I am copying the session variables to the request scope (ex. request.userinfo = session.userinfo).  However, if I change let's say the last name in the session variable or the request object, does the other one pick up the change or do I have to reset them equal to each other (ex. session.userinfo.lastname = "BB" or request.userinfo.lastname="EE")?

I have never used locks when reading or setting session variables in any of my applications.  I just recently discovered that locking is required on session variables.  Plus, my colleagues  and I took a Coldfusion training course and the certified coldfusion instructor never mentioned anything about locking session variables.  I am a little confused about why it is required to lock session variables because I thought that they are suppose to be unique each user.

BTW, the Null error has been resolved.

> When using Application.cfc, does it automatically lock session variables as well?  

You don't need to lock application/session variables within the onApplicationStart and onSessionStart functions used inthe Application.cfc file.   So, the answer is Yes, sort-of, because it's not necessary there.  You would need to lock them in other places outside the app.cfc file..

> Do I need to lock the application variable when using the application variable to call a function (ex. application.objSystem.listValuesFound(....)) in my pages?

No, you don't need to lock application scope variables to use the components

>  However, if I change let's say the last name in the session variable or the request object, does the other one pick up the change or do I have to reset them equal to each other

No, there's nothing automated.  You are physically copying them and would need to keep them in sync.   To me, however, this is easy because my session variables are used only to maintain login and session states.   If the person changes their login profile, you simply call the function that reloads the request variables from the tables...   I never use session variables as local variables and change them all the time.  

> I am a little confused about why it is required to lock session variables because I thought that they are suppose to be unique each user.

I agree it's confusing.  I once read CF MX7 & 8 didn't need as much locking, but then I read it somewhere else it did.  I have been trying to find confirmation, but its hard to find someone to really say it definitively and explain under what circumstances.

> BTW, the Null error has been resolved.
cool! how?

The null error was resolved by changing some permissions on a file that coldfusion was trying to access and by restarting the server.

You said that I would need to keep the request and session objects in sync.  Can this be achieved if I set request.user = session.user in the Application.cfm file and only make changes to the session object variables whenever the variables need to be modified?  Or, do I still need to copy the session object back to the request object everytime I make a change to one of the variables?

As far as locking, is this the proper way to lock a session variable (see code below) and is there a way to lock a session variable within a cfscript tag?
<cflock timeout="5" throwontimeout="yes" type="EXCLUSIVE" scope="SESSION">
  <cfset session.message = "....">
</cflock

> Do I still need to copy the session object back to the request object everytime I make a change to one of the variables..

They are completely separate variables, so if you change one and need the other to be in sync, then you must change both.  There is no automation.  

But if you need to sync these, then ask yourself if you should be using a session variable for whatever it is...   I don't run into this because I think it's an overuse of the session variable.   For example, your session variable keeps your user's ID, that means he's logged in.  Then, in application.cfm file, you load request variables from the user's table to keep his Name and Email handy for that request.  No need to use session variables for those.  If the user modifies his email, you update the table and reload the request variables.. no synchronization needed and you're not constantly using the session variables for unnecessary things.

IMHO, if it's not maintaining the session, then you don't need the session variable.

Use type="EXCLUSIVE" when writing the session and use SHARED when reading the session variable.


So, what is session.message used for?   Why does it need to be session?