ColdFusion Authentication Cache Problem After Browser Closes

Posted on 2004-10-15
Last Modified: 2013-12-20
I'm having this problem with my browser caching login information, even after the browser is closed and reopened.  I have checked the box to use J2EE sessions ( a setting in CF Admin) so I thought that should take care of the problem, but it has not.  Also, I’ve waited until the session timeout period is over inside the CFAPPLICATION tag (5 minutes) (with all browers closed) and it is still cached. It does loose it when session timeout period is over from CF ADMIN 20 min.  However, I thought the sessiontimeout period in the tag overrides the timeout period in ColdFusion Administrator?   Please help!

Scenario:  I am authenticating users using their Oracle username and password.  I also have a form that allows them to change their password.  I am able to successfullly change my password.  I close my browser.  Then I try to log in and I am able to use my username and BOTH passwords work (original and new).  Where is this being cached?  If you look at my logout code below, you'll see I've tried to delete every session variable.  

Please be kind, I've tried many suggestions and can't get it to work.

ColdFusion MX (using standalone on pc for development right now, will move to CFMX on IIS in a couple months)
Windows 2000
Internet Explorer 6

I have tried to use the CFLOGIN framework but that doesn't work either.  

The four primary pages are listed here.  Note: all code is attached for each page.

1.  application.cfm
2.  loginform.cfm
3.  logincheck.cfm
4.  logout.cfm


<!--- Set application to no-cache allowed --->
<cfheader name="Expires" value="-1">
<cfheader name="Pragma" value="no-cache">
<cfheader name="cache-control" value="no-cache, no-store, must-revalidate">

<!--- Name the application, enable application variables --->
<cfsetting showDebugOutput="Yes">
<cfset Main_DataSource = "prod" >

<cfif not isdefined("session.auth.isloggedin")>
<cfif isdefined("form.userlogin")>
<cfinclude template="logincheck.cfm">
<cfinclude template="loginform.cfm">

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "">
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>Login Form</title>

<!--- Place cursor in "User Name" field when page loads --->
<body onLoad="document.UserLoginForm.UserLogin.focus();">
<h1>Login form</h1>
<!--- Start Login Form --->
<cfform action="#CGI.SCRIPT_NAME#" name="UserLoginForm" method="post">
<!--- make the username and password fields required --->
  <input type="hidden" name="UserLogin_required">
  <input type="hidden" name="UserPassword_required">
<p>Please enter your username and password to access your account. </p>
<table width="600" border="0">
    <td width="328" height="146"><table width="100%" border="0" background="../../gifs/loginbox.gif">
          <td height="142" valign="top"><br>
            <table width="283" border="0">
                <td width="119"><div align="right">User Name</div></td>
                <td width="154"><cfinput
      message="Please type your username first"></td>
                <td><div align="right">Password</div></td>
      message="Please type your password"></td>
            <div align="center"><br>
                <input type="submit" value="Log In">
    <td width="262" valign="top"><br>
      <ul><li>forgot your password?</li>
      <li>new account</li>

<!--- <cfparam name="form.userlogin" type="string">
<cfparam name="form.userpassword" type="string">--->

<cfquery name="GetUser" datasource="#Main_Datasource#" username="#Form.userlogin#" password="#Form.userpassword#">
Select sysdate
From dual

<!--- If the GetUser query is processed, Oracle username and password are correct --->
<CFIF GetUser.RecordCount EQ 1>

<cfquery name="EnableRoles" datasource="#Main_Datasource#" username="#Form.UserLogin#" password="#Form.UserPassword#">
Set Role All

<cfquery name="GetUserRoles" datasource="#Main_Datasource#" username="#Form.UserLogin#" password="#Form.UserPassword#">
Select Granted_Role

<!--- Retrieve employee id number that matches to user login name, used to set emp_id session variable below --->
<cfquery name="GetUserID" datasource="#Main_Datasource#" username="#Form.UserLogin#" password="#Form.UserPassword#">
Select userid, emp_id, system_id
From employee_accounts
Where system_id = 'ORACLE' AND
userid = '#UCase(FORM.UserLogin)#'

<!--- Consider the user "logged in" --->
<cflock scope="session" type="Exclusive" timeout="20">
<cfset session.auth = structnew()>
<cfset session.auth.isloggedin = "yes">
<cfset session.auth.userlogin = "#GetUserID.userid#">
<cfset session.auth.userpassword = "#Form.UserPassword#">
<cfset session.auth.emp_id = "#GetUserID.emp_id#">
<cfset session.auth.roles = "#ValueList(GetUserRoles.Granted_Role)#">
<cfset session.auth.cfid = "#Cookie.CFID#">
<cfset session.auth.cftoken = "#Cookie.CFTOKEN#">

<cflocation url="#cgi.SCRIPT_NAME#">


<!--- Disable roles for current session only--->

<cfquery name="DisableRoles" datasource="#Main_Datasource#" username="#Session.auth.UserLogin#" password="#Session.auth.UserPassword#">
Set Role None

<cfif IsDefined("COOKIE.CFID")>
<cfif IsDefined("COOKIE.CFTOKEN")>

<cfset session.auth.UserLogin = "">
<cfset session.auth.UserPassword = "">

<!--- Terminate the user's session by deleting all session variables --->

<cflock timeout=20 scope="Session" type="Exclusive">
      <cfset StructDelete(session.auth, "isloggedin")>
      <cfset StructDelete(session.auth, "CFID")>
      <cfset StructDelete(session.auth, "CFTOKEN")>
      <cfset StructDelete(session.auth, "UserLogin")>
      <cfset StructDelete(session.auth, "UserPassword")>
      <cfset StructDelete(session.auth, "emp_id")>
      <cfset StructDelete(session, "CFID")>
      <cfset StructDelete(session, "CFTOKEN")>
      <cfset StructDelete(session, "URLToken")>
      <cfset StructDelete(session, "SessionID")>

<cflocation url="/test/index.htm">


Question by:sphay
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
LVL 21

Expert Comment

ID: 12323510
Hi sphay,

    Try this this is from my application.cfc and it will help you. As this is working sucessufully.

        <cfset StructClear(application)>
        <cfset StructDelete(application, "yoursession")>
        <cfset StructClear(session)>
        <cfset session.cfid = cfid>
        <cfset session.cftoken = cftoken>
        <cfset session.urltoken = "cfid=#session.cfid#&cftoken=#session.cftoken#">


Author Comment

ID: 12341412

The .cfc is new to me - Will I need to create alot more than what you're showing here?  So, my application.cfm isn't going to work the way I have it now?


LVL 21

Expert Comment

ID: 12341468
Please ignore the word CFC that has nothing to do with this.
I am sorry if i am ambigous.
Just use ths structclear and  structdelete like I did they should work that is what I mean.
Save the day with this special offer from ATEN!

Save 30% on the CV211 using promo code EXPERTS30 now through April 30th. The ATEN CV211 connects a laptop directly to any server allowing you instant access to perform data maintenance and local operations, for quick troubleshooting, updating, service and repair.


Author Comment

ID: 12341629
Can you suggest where to specifically put the structclear and  structdelete?  If you look at the bottom of the first message, under the logout.cfm code, you can see that I've tried to clear and delete all structures.  Still doesn't seem to work.  I thought that was the place to put it.

LVL 11

Expert Comment

ID: 12345164
you able to use both the passwords indicates that its not a session or cookie deletion hassle.

Now in some projects where people use LDAP for authentication, the change of password gets updated only after 40 min or so..
Till then both new and old can be used...

Now i don't know if there are any issues like that in oracle... As from ur code i can see that u r creating oracle db users rather than creating users in a table....



Author Comment

ID: 12351199
I don't believe this is the case with Oracle.  Immediately following the password change, I test with SQLPlus and am only allowed to use the "new" password.  I've been working on this all day and caching is still a problem.
LVL 21

Expert Comment

ID: 12490097
Please put this in application.CFM

        <cfset StructClear(application)>
        <cfset StructClear(session)>

This should do the job.

Author Comment

ID: 12493115
I've actually found the solution to this, thanks to  In case anyone else comes across this problem, it happened to be caused by a setting in the ColdFusion Administrator.  Uncheck the 'Maintain Connections' box.

Accepted Solution

ee_ai_construct earned 0 total points
ID: 12527334
Question answered by asker or dialog valuable.
Closed, 500 points refunded.
ee_ai_construct (replacement part #xm34)
Community Support Admin

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Linux Hosting 16 102
The Best Website Creation Tools 14 119
WebSite Direction 1 76
Is there any way to delete a Google Maps label? 7 50
Article by: kevp75
Hey folks, 'bout time for me to come around with a little tip. Thanks to IIS 7.5 Extensions and Microsoft (well... really Windows 8, and IIS 8 I guess...), we can now prime our Application Pools, when IIS starts. Now, though it would be nice t…
Introduction In this tutorial, I'll explain how to create an animated progress meter in a wireframe prototype developed using Axure RP 7.0 - a leading prototyping tool for designing web sites and software. (For more information about Axure and gett…
The purpose of this video is to demonstrate how to create a Printer Friendly PDF on a WordPress Page. This will be demonstrated using a Windows 8 PC. Tools Used are Photoshop, Awesome Screenshot” Google Chrome Extension, and Log…
The purpose of this video is to demonstrate how to make a WordPress Site faster and smaller in size by cleaning up the database. This will be demonstrated using a Windows 8 PC. Plugin WP Optimize will be used. Go to your WordPress login page. T…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question