CF10 Session Id changing on each page request?

in cf10, login not working in cf9.

session variables set 'unset' every time new page called, getauthuser.

to troubleshoot problem, found unexpected behavioral change cf9.

in case it's pertinent, using orm.

 

in application.cfc, had:

		this.sessionmanagement			= "true";
		this.sessiontimeout			= createtimespan(0,0,30,0);
		this.loginstorage			= "session";
		this.setclientcookies			= false;

 

in onsessionstart function, had:

			<cfset session.isloggedin		= 0/>
			<cfset session.username		= ""/>
			<cfset session.email		= ""/>
			<cfset session.termsaccept		= 0/>

 

in onrequeststart function, had:

<cfif session.isloggedin eq 0>

<cfif findnocase("login",requestedpage) eq 0 , findnocase("index",requestedpage) eq 0>

<cfinclude template="userinterface/session/login/login-v.cfm">

</cfif>

</cfif>

 

even after valid login, got login page.

dumping session variables, set application.cfc values @ beginning, , set correct values login @ end.

login-v.cfm posts login-cm.cfm, after validating user credentials has code:

<cflock scope="session" timeout="20" type="exclusive">

<cfset session.isloggedin = 1/>

<cfset session.username = "#appuserobj.getusername()#"/>

<cfset session.email = "#appuserobj.getemail()#"/>

<cfset session.termsaccept = "#appuserobj.gettermsaccept()#"/>

</cflock>

<cflogin>

<cfloginuser name = "#appuserobj.getusername()#"

password = "#appuserobj.getpassword()#"

roles= "#appuserobj.getuseraccessdata().getroles()#"/>

</cflogin>

 

so, changed onrequeststart dump session variables.

going login-v.cfm initially, onrequeststart dump gave me this:

email	[empty string]
isloggedin	0
sessionid	spnew2_3477_95978872
termsaccept	0
username	[empty string]

 

after successful post login-cm.cfm, setting session variables , cfloginuser,

a session dump gave me this:

email	testing@meltech.com
isloggedin	1
sessionid	spnew2_3477_95978872
termsaccept	1
username	testing

and getauthuser() = testing

i cflocation userinerface/portal/portal-v.cfm

going that, onrequeststart dump gave me this:

email	[empty string]
isloggedin	0
sessionid	spnew2_3479_18042427
termsaccept	0
username	[empty string]

a different session!

 

i able work around problem changing application.cfc to

this.loginstorage

= "cookie";

sessions maintained.

 

what's this? don't recall seeing in cf10 security release notes sessions changing request pages when use session login storage?

this problematic me, don't want use cookies!

 

any ideas?

 

edited -

also, onsessionstart increment sessions appears request based, rather session based

onsessionstart has

<cflock scope="application" throwontimeout="yes" timeout="7" type="exclusive">

     <cfset application.currentsessions = application.currentsessions + 1>

</cflock>

so, start currentsessions = 0 (new application start)

after login-v,login-cm , portal-v, have currentsessions = 3 instead of 1.

i confused when these events firing

More discussions in ColdFusion

adobe