I have a legacy application running on Lucee 5 4+ and we hav cfml #lucee

I have a legacy application running on Lucee 5.4+ ...

davla

09/13/2023, 10:23 AM

I have a legacy application running on Lucee 5.4+ and we have seem to have an issue with cookies (session/client). The Application.cfc has the following config:

Copy code

<cfset this.ApplicationTimeout = CreateTimeSpan(1,0,0,0) />
<cfset this.SessionManagement = true />
<cfset this.SessionTimeout = CreateTimeSpan(0,1,0,0) />
<cfset this.ClientManagement = false />
<cfset this.SetClientCookies = true />

for session management (I don’t think it intentionally needs/uses client variables). We use the cftoken to maintain the session in the application. The cookies I see being set are as follows:

Copy code

CF_CLIENT_[appname]_HC expires: 2023-12-12T10:16:34.970Z
CF_CLIENT_[appname]_LV expires: 2023-12-12T10:16:34.970Z
CF_CLIENT_[appname]_TC expires:  2023-12-12T10:16:34.970Z
cftoken expires: 2024-10-17T09:46:46.236Z
cfid expires: 2024-10-17T09:46:46.236Z

Why is cfid/cftoken not set to expire after just 1 hour as specified by this.SessionTimeout above?

zackster

09/13/2023, 10:26 AM

Copy code

this.SetClientCookies = true

davla

09/13/2023, 10:27 AM

If I set that to false will cfid/cftoken and therefore sessions still function? It’s been a while since I have had to deal with these!

zackster

09/13/2023, 10:30 AM

so you see those cookie with just those settings in a bare application.cfc and index.cfm?

davla

09/13/2023, 10:31 AM

I would need to check that. Let me put together a simple app on my local and see what happens.

👍 1

cfsimplicity

09/13/2023, 10:53 AM

this.sessionTimeout

controls the timeout on the server. Cookies are client-side and just provide a hook into that server session. Their expiry is irrelevant really: once the server session has timed out, the cookie will stop working. I've never seen the need for long-lived cfid/token cookies though. They should expire on browser close, which is what J2EE

jsessionid

cookies do.

☝🏻 1

👍 2

Andreas

09/13/2023, 12:36 PM

On default Lucee won't set session cookies. Session cookies will be deleted/removed from the brwoser after you close your browser. What I do to create strict session cookies is: setSessionManagement to true, but setClientCookies to false and set the cookies yourself with cfcookie and no expiration value.

👍 2

Andreas

09/13/2023, 12:40 PM

Also important to know is that session cookies is EU GDPR compliant if you use it to store data that your app needs for pure functionality (and not for tracking or marketing stuff), thus if you don't do anything else on your page, you won't even need a Cookie Consent request then.

☝️ 1

davla

09/13/2023, 1:05 PM

Thanks, I have tracked down the culprit - the api has its own Application.cfc which shares the application name with the main application and should have the same config regarding client vars - except of course it had

setClientManagement = true

- changed to false and now not seeing the client cookies (except cfid/cftoken which we still need).

davla

09/13/2023, 1:06 PM

Fortunately this is an internal intranet application so don’t need to worry about EU cookie law.

zackster

09/13/2023, 1:07 PM

yeah, shared application names are always a doozy

davla

09/13/2023, 1:09 PM

This app was originally coded with CF6 as the app server and still limps along with ColdSpring and Reactor frameworks with Taffy thrown in to the mix with a BackboneJS client side app. Still runs quite well on Lucee 5.4+. My brain hurts when I have to do any work on this.

zackster

09/13/2023, 1:10 PM

i really miss having CF write out java source files and then compile them on the flllllllllllllllllllly

head wall 1

3 Views

Open in Slack

Previous Next