The built-in `sessionRotate()`and `sessionInvalida...
# lucee
l
The built-in `sessionRotate()`and
sessionInvalidate()
functions do not work with JEE sessions...
Are these two rather old articles still the recommended replacements: https://www.petefreitag.com/item/829.cfm https://www.petefreitag.com/item/913.cfm If so, I note that the older article uses a slightly different method of invalidating the session ( it adds an extra
.getRequest()
call) and am curious if it should be replaced with the method in the newer article... or are they doing different things?
c
This is what I'm using atm:
Copy code
//rotate
GetPageContext().getRequest().changeSessionId()
// invalidate
GetPageContext().getSession()?.invalidate()
l
@cfsimplicity thank you! So much _cf_simpler 😉 Are you aware of any reason Lucee wouldn't already incorporate such logic into their versions of these functions (i.e. is there anything you can think of that I should be aware of in using these?)
c
@leftbower I have no insight into what Lucee is doing here. All I can add is that
changeSessionId()
was introduced in the servlet 3.1 spec, so for Tomcat that would be version 8.5+ I think.