New session on every request

Question

I have an issue with sessions on ColdFusion 10. I moved a site from CF 8 to CF10. CF8 resided in a different server. I put a WriteOutput(" testing") in the onSessionStart function of the Application.cfc to know how the site will behave. I ran the site, on the default page and the output "testing" appeared. When I clicked on the SignIn page, the "testing" word appeared again. It's calling the onSession start. Here is what's in my onSessionStart.

<cfscript>
    this.name="mysite";
    this.clientmanagement=false;
    this.sessionmanagement=true;
    this.setclientcookies=false;
    this.sessiontimeout="#CreateTimeSpan(0,0,40,0)#";//TODO: revert back to 40 mins as default
    this.applicationtimeout="#CreateTimeSpan(0,1,0,0)#";
    this.loginStorage = "Session";
    this.logFile = "mysite_LOG";
    this.scriptProtect = "all";
</cfscript>


<cffunction name="onSessionStart" returntype="void">        
    <cfif NOT StructKeyExists( cookie,"CFID" ) OR NOT StructKeyExists( cookie,"CFTOKEN" )>          
        <cfheader name="Set-Cookie"  value="CFID=#session.CFID#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">
        <cfheader name="Set-Cookie"  value="CFToken=#session.CFToken#; Expires=#GetHttpTimeString(DateAdd("yyyy", 40, Now()))#; Path=/;SECURE;HTTPOnly;">
    </cfif>
    <cfscript>
        WriteOutput("testing");
        StructClear(session);           
        session.pageRedirector = "";    //used for sending a user back to a previous requested page when authentication is required first
        session.profile = CreateObject("component","mysite.cfcs.user");
        session.shoppingCart = CreateObject("component","mysite.cfcs.cart");
        session.catalog = CreateObject("component","mysite.cfcs.catalog");          
    </cfscript>
</cffunction>

I'm using CSRFGenerateToken() to verify the page, so if the application keeps on calling the onSessionStart, the session will always be cleared and the user was not able to login.

Setting the setClientCookies to false calls onSessionStart on every request.

To fix the issue, I set setclientcookies to true. The session lost issue is solved but it gave a new issue - session is not terminated on browser exit.

If anybody can give some ideas, I would deeply appreciate it.

IIS version is = IIS 8.5
OS version = Win server 2012 R2

Closing the browser will not end a session. ColdFusion has no way of knowing if the browser was closed or if you are simply taking a long time to read the page or if you simply walked away from your computer. As Pankaj pointed out, with J2EE session variables, you will get a new session if you reopen the browser (browser window, not just a tab), but the old session will still exist until it times out. — Scott Stroz

Pankaj Pankaj · Accepted Answer · 2016-05-31T10:56:36

Enable J2EE sessions in CF Administrator (Server Settings > Memory Variables > Use J2EE session variables)

If you use ColdFusion session management, ColdFusion automatically ends sessions and deletes all Session scope variables if the client is inactive for the session time-out period. The session does not end when the user closes the browser.

If you use J2EE session management, ColdFusion ends the session and deletes all Session scope variables if the client is inactive for the session time-out period. However, the browser continues to send the same session ID, and ColdFusion reuses this ID for sessions with this browser instance, as long as the browser remains active.

Read this http://help.adobe.com/en_US/ColdFusion/9.0/Developing/WSc3ff6d0ea77859461172e0811cbec22c24-7c48.html#WSc3ff6d0ea77859461172e0811cbec22c24-7d2d

New session on every request

1 Answers