Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


How to reset JsessionID at login for a coldfusion application?

Posted on 2011-02-10
Medium Priority
Last Modified: 2013-12-24
Using CF 6.1, I have JSessionID as the session ID. I need to reset the session ID after user logs in and when the user logs out.  

Currently JSessionID is set upon user connection to the website and is only destroyed when the user closes the browser.  I need to be able to modify the value on log in and log out.
Question by:FFNOKC
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
  • 2
LVL 36

Expert Comment

ID: 34864123
you can kill a session using

<cfset structclear(session)>

however I don't believe it's possible to -not- set a jsessionid on first connect. You could kill the existing session and create a new one on log in r. Not sure why you'd need to however.
LVL 39

Expert Comment

ID: 34864815

If the problem is that you used the session ID as the identifier for your user's shopping art of something, I would change that instead.  

You can create a unique identifier using the session ID and some other values like the time or IP address

<cfset uniqueNUmber = hash(session.sessionID & IPaddress & timeFormat(now(),"miss")>

You should tell us what problem you're trying to resolve to address it directly.  I am not sure if you can continue using the session after your destroy the session ID or that you're guaranteed you'd get a different value

Author Comment

ID: 34865032
Thank you for the suggestions.  Here is a more detailed description of the problem:

Currently when a user visits the homepage of the site they are assigned a cookie with a JessionID. If the user goes on to login to a secure portion of the website they keep the same JsessionID after a successful login.

 We have had a recommendation to do one of the following to make the application more secure:

1. Do not set a JsessionID until after the user logs in.
2. Change the JsessionID after the user logs in.

Survive A High-Traffic Event with Percona

Your application or website rely on your database to deliver information about products and services to your customers. You can’t afford to have your database lose performance, lose availability or become unresponsive – even for just a few minutes.

LVL 39

Accepted Solution

gdemaria earned 2000 total points
ID: 34865170

3.  Use a different identifier to track their login session, this was my suggestion above.

That would keep you from messing with core CF functionality and make it more secure.

>  1.  Do not set a JsessionID until after the user logs in.

This is not under your control.   If you no longer use the jsession ID as the user's identifier then you can set it and change it as you please.   Leave the jsessionID to CF and you use your own.

LVL 36

Expert Comment

ID: 34865480
agree 100% with gd - if you different functionality roll your own session. I use <cfset session.uid = createuuid()>

doing anything may result in unexpected results.

Author Comment

ID: 34873717
Thanks for the help. It sounds like creating your own session identifier is the preferred method.

Featured Post

Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Hi, I will be creating today a basic tutorial on how we can create a Mail Custom Function and use it where ever we want. The main advantage about creating a custom function is that we can accommodate a range of arguments to pass to the Function and …
CFGRID Custom Functionality Series -  Part 1 Hi Guys, I was once asked how it is possible to to add a hyperlink in the cfgrid and open the window to show the data. Now this is quite simple, I have to use the EXT JS library for this and I achiev…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
In this video, Percona Solution Engineer Rick Golba discuss how (and why) you implement high availability in a database environment. To discuss how Percona Consulting can help with your design and architecture needs for your database and infrastr…

721 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question