Daft question (google ain't helping me) how is the

session.sessionid

value derived in Lucee? Looks to be something like...

[application_name]_[a GUID]_0

. Is there anything more I should know beyond that?

I suppose one case would be in the psudo constructor of your Application.cfc since it would not know if you have yet set this.sessionManagement - I haven’t tested that claim, but logically it would make sense for it to not be available yet

yep, coz sessions are tied to applications, the 0 is the cftoken which in lucee is always 0

Cool thanks man. For belt 'n' braces, I'm using

session?.sessionid

anyhow. It's just for some logging, and it's not the end of the world if it ain't there.

any idea when

onSessionEnd

will be functional again? https://luceeserver.atlassian.net/browse/LDEV-3264

Wow. And it's been broke for a year. 😕

yeah... got nailed on an application pen-test last week and some of the things I thought were being cleaned up in the function really were not. It's an internal web application so the vector opened up because of this wasn't terrible... but I was personally rather embarrassed that I had never realized some of the session manipulations I was doing weren't ever happening!

Thanks for pointing it out, added to 5.3.9 sprint

j2ee