Hi All. I've got a quick question about ACF upgrades impacting cookies or client variables. We've seen some logins disrupted post-update of ACF 2021. Have others seen similar issues with logins or similar being disrupted? I'm trying to understand why this is happening and whether there are easy fixes that don't involve resetting logins and passwords.

Are you aware of the encryption and hashing changes from a bit ago? Maybe check if they impact you.

@Dave Merrill I did see something about that but thought that it related to an older encryption standard. I'll re-look at that.

It's changes to the default encryption and hashing methods.

Is this ACF 2021 u15 to u16 ?

@aliaspooryorik yes it is!

Shouldn't be changes to hashing then as that was not in this update

no not clustered

Just a thought but do you run your code on subdomains? So you run as

<http://a.mysite.com|a.mysite.com>

and

<http://b.mysite.com|b.mysite.com>

? We had an issue recently which turned out to be nothing to do with CF - it was a change to how browsers handled the HTTP

Clear-Site-Data

security headers (or rather they started to support it fully)

@Dave Merrill You were right - it turned out that some of our older clients were subject to the default hashing - when that changed, there was some breakage.

It's a new security header so quite likely you don't have it. It was just an idea. Glad you've tracked that down. The hash change was in Update 14 though so I don't understand why it's only just started to break.

@aliaspooryorik I held off on some CF updates due to the scoping changes around the same time, or in the previous update - I was concerned that scoping requirement might cause some breakage

ah OK - that was why I asked

Is this ACF 2021 u15 to u16 ?

😄

@aliaspooryorik Yes, we were a few updates behind due to concerns about the scoping change and wanting to ensure that there was no breakage relative to scopes. The breakage due to hashing sort of snuck in without me realizing it would also have an impact on some of our older clients.

Yeah no problem. Was just trying to narrow down what could be causing it. Hash changes makes total sense if you were a few patches back.

@nickg You know that you disable/postpone the scoping change with a java arg, yes? Our major code bases have been around for a very long time, so tightening up scoping is a BIG job. I've deferred it for now.

@Dave Merrill Yes, that's this flag, right? this.searchImplicitScopes=true;

I think there's also a flag that can log all attempts to reference implicitly scoped vars, to understand what will need to be done.

There is a patch you can apply https://helpx.adobe.com/coldfusion/kb/view-unscoped-variables-log-file.html