I have an issue with Cflocation same code, same variables same setup. Except one server is using CF2023 and the other CF2018, The cflocation tag works in CF2018 and redirects to where it needs to go but the same code in CF2023 returns a 302. Is there any reported issues with CF23 and cflocation ?

Returning a

302

is what

<cflocation>

does.

ok but on CF2023 its coming back to the sites login page and CF2018 is going to the website that the cflocation is supposed to go to. No diff in code, server settings nothing. So bizarre

<cflocation>

will send a status code (as above) and a

Location

header with a URL to redirect to. The browser will then... relocate to that URL. What URL is being sent to the browser? I suspect the problem is more "your code's logic is not giving

<cflocation>

the correct URL, for... [reasons]"

Yeah possibly code is same as CF2018 though exact same

OK, don't look for reasons why it should work. That won't get you very far. Look for reasons why it isn't working.

Yep agree. Ill have a dig around and see whats different on each environment. Cheers Adam

Follow the logic through... don't assume any variable values... check them.

will do 🙂

Monitor the HTTP traffic using the Dev Tools. I suspect there's some differences in the URLs. Wasn't there a chance in behavior in the addtoken argument at some point?

But first verify my hypothesis that the

<cflocation>

and browser are doing exactly what they're supposed to, but it's that the code is giving

<cflocation>

the wrong URL

@Adam Cameron, Reading the docs, it defaults to "false" when the secure profile is enabled, so maybe in his 2018 environment it's still defaulting to "true"

no cookie.

No cookie! Hmm could be. Where is Secure profile set in the cfadmin ?

buuuuut... cookies should still go with the 302 response. Never really understood why CFML has that

addtoken

option..?

Well, unless something is going on and the cookies are persisting. Like maybe he's going from x.site.com to y.site.com or from a domain name to an IP, etc.

yeah so @mauzer would the behaviour be - if the request is a new session - to bounce them to the login screen?

Yes correct it is

OK, so look at the network panel in dev tools. I bet your sessions aren't sticking

ok cool will check it

(probs cos the CFID bumpf is new each time)

so how do you prevent that happening ?

[this is beyond my recollections of how CF works. I've never had to deal with it, so never needed to find out / know]

If you are changing subdomain on the redirect, if you look at the cookies in browser dev tools on the request is the domain set as

.<http://mydomain.com|mydomain.com>

or

<http://x.mydomain.com|x.mydomain.com>

?

ok @aliaspooryorik cheers im taking a look now 🙂

From what I vaguely recall (assuming that's the issue) - the I think you want be able to do something like this in your Application.cfc:

this.sessioncookie.samesite = "Lax";
this.authcookie.samesite = "Lax";