Weirdness with hyperlinks and cflocation

Hi all,

I created 4 pages all in the same directory.
1. Application.cfm
2. loginForm.cfm
3. loginAction.cfm
4. adminIndex.cfm

The login form sends input data to the action page which checks the inputs against a query. The query joins three tables and fills session structure variables with data.
I then check inside the action page with CFOUTPUT to see if the variables were filled and they are.

THEN I have a link on the bottom of the page that links to the adminIndex.cfm template. The adminIndex.cfm template will then check to see if the session variables are defined.

Here's the problem: If I use the hyperlink, the variables are NOT defined. Then if I changed the link to a CFLOCATION tag the session variables ARE defined!

Can someone please explain why this happens?
That way I can do it right the first time...

thanks,
Nathan

Look at your cfapplication tag, are you specifying that session cookies be used? I bet you are not. When you do the URL link, your cfid and cftoken are not passed so the application doesn't know what your session is. By default cflocation will pass the id and token, so the application does know which session you have.

You're right....No cookies were set in the App file.

But there are two choices. SetDomainCookies and SetClientCookies.

Which is the correct one and why the choice?

Nathan

Both will work, but domain cookies work across multiple servers in a cluster, while the other is server-specific.

How can I programatically get rid of CFIF and CFTOKEN on the server once I've deleted the structure in my logout page?

I want to use the ID and TOKEN ONLY while the structure is active NOT after the structure is deleted. Right now if I save the URL with the ID and TOKEN, I can go directly to that secured page as if I never logged in. This is a bad security risk in secured pages.

I also use CFHEADER tags to prevent caching but the saved ID and TOKEN bypass that...

Any ideas?
Nathan

You need to handle this yourself by comparing a "logged in time" with the current time, and only letting them back in if they haven't exceed the timeout period. I believe the cflogin tag does this automatically, or you can handle it yourself if you have your own authentication system.

Note that this would happen on any system that was passing an id to identify the current user and facilitate session management. In other words, it's a general web application issue and not just a CF issue.