asked on

How do I stop losing my cookies and stay logged in?

Hi Guys!

I am running CF Server 5. After the rash of MS updates a few weeks ago, sometimes when I click on a form link, I lose my User_Info cookie that tells me if I'm logged in or not. This causes the Application.cfm to cf include the login page and abort.

To start off with, I have logged in and have my User_Info cookie. Next, I click on a link like this:

<form
action="http://www.myproductionserver.net/the/path/to_my_script_is.cfm?CFID=39639&CFTOKEN=74431736&Tab=7&Type=Supervisor&E5180B05-1ED5-4B72-BFBE5AF173D2E69F"
method="post"
name="tab7Form"
style="margin-bottom: 0px; margin-top: 0px;"
><a
href="javascript:this.document.forms['tab7Form'].submit()"
class="nameLinkSmall"
onmouseout="window.status=' ';return(true);"
onmouseover="window.status='http://www.myproductionserver.net/the/path/to_my_script_is.cfm?CFID=39639&CFTOKEN=74431736&Tab=7&Type=Supervisor&E5180B05-1ED5-4B72-BFBE5AF173D2E69F';return(true);"
>Supervisor</a></form>

and be forced to log in!!

Application.cfm looks like this:


<cftry>
<cfif IsDefined('Cookie.User_Info')>
<cfwddx
action="WDDX2CFML"
input="#Cookie.User_Info#"
output="Access"
>
<cfelse>
<cfif IsDefined('Client.User_Info')><cfwddx
action="WDDX2CFML"
input="#Client.User_Info#"
output="Access"
></cfif>
</cfif>
<cfcatch><cfabort></cfcatch>
</cftry>


<cfapplication
name="MyProductionServerzApplicationName"
clientmanagement="Yes"
sessionmanagement="Yes"
sessiontimeout="#MySessionTimeOut#"
>

<cfif NOT (IsDefined('Access') OR ListFindNoCase(MyTrustedTemplateList, CGI.SCRIPT_NAME) OR IsAuthenticated('MyProductionServerzApplicationName'))>


<cfscript>
ShowLogin = "False";
</cfscript>
<cftry>
<cfscript>
if((NOT IsDefined('Form.User_Logon')) OR (NOT Len(Trim(Form.User_Logon)))) {
if(IsDefined('URL.User_Logon') AND Len(Trim(URL.User_Logon))) {
/* This sometimes blows up if the value to be decrypted is not valid */
Form.User_Logon = Decrypt(URL.User_Logon, 'MyUserLogonDecryptionKey');
}
}
if((NOT IsDefined('Form.User_Password')) OR (NOT Len(Trim(Form.User_Password)))) {
if(IsDefined('URL.User_Password') AND Len(Trim(URL.User_Password))) {
/* This sometimes blows up if the value to be decrypted is not valid */
Form.User_Password = Decrypt(URL.User_Password, 'MyUserPasswordDecryptionKey');
}
}
</cfscript>
<cfcatch></cfcatch>
</cftry>
<cfif IsDefined('Form.User_Logon') and IsDefined('Form.User_Password')>


<cftry>
<cfauthenticate
securitycontext="MyProductionServerzApplicationName"
username="#Form.User_Logon#"
password="#Form.User_Password#"
setcookie="YES"
>
<cfif NOT (IsDefined('Access') OR ListFindNoCase(TrustList, CGI.SCRIPT_NAME))>
<cfinclude template="/includes/check_userz_password.cfm">
<cfif PleaseTryAgain>
<cfoutput><table
height="100%"
width="100%"
><tr><td
align="center"
>The login name and password you supplied were incorrect.</td></tr></table></cfoutput>
<cfabort>
<cfelse>
<cfinclude template="/path/log_user_into_central_station.cfm">
</cfif>
</cfif>
<cfcatch type="security">


<h3>Invalid Login</h3>
<cfset ShowLogin="Yes">

</cfcatch>
</cftry>
<cfelse>


<cfset ShowLogin="Yes">

</cfif>
<cfif ShowLogin>
<cfset EmailTitle="Forced Login From the Application Template">
<cfinclude template="/includes/send_email_to_the_developer.cfm">
<cfinclude template="/index.cfm">
<cfabort>
</cfif>
</cfif>

The email the developer gets when this forced login happens is in HTML form. It's just a series of cf dumps:

Forced Login From the Application Template

--------------------------------------------------------------------------------

TheLast5StaffWhoHaveLoggedInAtThisAddress
AGENCY_NAME LOGIN_TIME NAME_FIRST NAME_LAST PROGRAM_NAME USERS_ID
My Agency, Inc. 2003-03-20 08:48:26 Dave Babbitt My Program 443
My Agency, Inc. 2003-03-20 08:47:27 Dave Babbitt My Program 443
My Agency, Inc. 2003-03-20 08:46:26 Dave Babbitt My Program 443
My Agency, Inc. 2003-03-20 08:45:27 Dave Babbitt My Program 443
My Agency, Inc. 2003-03-20 08:44:42 Dave Babbitt My Program 443

Application
APPLICATIONNAME MYPRODUCTIONSERVERZAPPLICATIONNAME
DATEMASK m/d/yyyy
DEFAULTFONT Trebuchet MS
TIMEMASK h:mm tt

CGI
AUTH_PASSWORD
AUTH_TYPE
AUTH_USER
CERT_COOKIE
CERT_FLAGS
CERT_ISSUER
CERT_KEYSIZE
CERT_SECRETKEYSIZE
CERT_SERIALNUMBER
CERT_SERVER_ISSUER
CERT_SERVER_SUBJECT
CERT_SUBJECT
CF_TEMPLATE_PATH X:\INETPUB\WWWROOT\whatever\the\path\to_my_script_is.cfm
CONTENT_LENGTH 0
CONTENT_TYPE application/x-www-form-urlencoded
GATEWAY_INTERFACE CGI/1.1
HTTP_ACCEPT image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/x-shockwave-flash, */*
HTTPS off
HTTPS_KEYSIZE
HTTPS_SECRETKEYSIZE
HTTPS_SERVER_ISSUER
HTTPS_SERVER_SUBJECT
PATH_INFO /the/path/to_my_script_is.cfm
PATH_TRANSLATED X:\INETPUB\WWWROOT\whatever\the\path\to_my_script_is.cfm
QUERY_STRING CFID=39639&CFTOKEN=74431736&Tab=8&Type=Mail&6870E1EB-219B-41BD-88A28FC5A7AFAC25
[Edited by Cerebro]
REMOTE_ADDR 127.0.0.1
REMOTE_HOST 127.0.0.1
[Edited by Cerebro]
REMOTE_USER
REQUEST_METHOD POST
SCRIPT_NAME /the/path/to_my_script_is.cfm
SERVER_NAME www.myproductionserver.net
SERVER_PORT 80
SERVER_PORT_SECURE 0
SERVER_PROTOCOL HTTP/1.1
SERVER_SOFTWARE Microsoft-IIS/5.0
WEB_SERVER_API ISAPI

Cookie
CFID 39639
CFTOKEN 74431736

Form

Request
CFADUMPINITED FALSE

Session
CFID 39639
CFTOKEN 74431736
SESSIONID MYPRODUCTIONSERVERZAPPLICATIONNAME_39639_74431736
URLTOKEN CFID=39639&CFTOKEN=74431736

URL
CFID 39639
CFTOKEN 74431736
OVERRIDE_DEBUG_MODE DEBUG
TAB 8
TYPE Mail

Client Variables
CFID 39639
CFToken 74431736
URLToken CFID=39639&CFTOKEN=74431736
HitCount 4
TimeCreated {ts '2003-03-20 08:50:51'}
LastVisit {ts '2003-03-20 08:51:05'}

How do I stop losing my cookies and stay logged in?