We have been trying to track down a strange bug for a while and I believe it is Coldbox that is causing it. We are using Coldbox with a Legacy application based on this example repo: https://github.com/bdw429s/coldbox-legacy-app-demo It has been in place for years but occasionally we get errors where session variables that are supposed to exist don't, it seems like any session variables we set ourselves get wiped out. I created a repo that seems to reproduce the error we are having. https://github.com/Yamaha32088/ColdboxSessionError You will need a Redis instance for this to work. The steps to reproduce after booting up the server would be to make requests to the

test.cfm

page and you will notice that every once in a while the variable

trackingId

disappears, it seems to be random. Sometimes it will exists for several sequential requests and then it will disappear. If however you comment out line 59 inside of

Application.cfc

the variables seem to be kept every request.

I'm probably slipping some sort of gear, but how can sessions be maintained without cookies?

They are not supposed to be maintained in this case.

But you're seeing that part way through the request, sometimes your explicitly set session vars don't exist? Can you tell if the whole session scope is empty, or if it's only some particular vars that are gone? Any chance this gets triggered when some other request hit that same session? Just guessing here, but is this about simulating sessionless bot requests?

Yes the session variables that are set inside of

onRequestStart

and

onSessionStart

get lost part way through the request. It will happen regardless if there are several concurrent requests or just a single request. When the problem occurs the session scope looks like a brand new session before any of our session variables were set. The CFID is exactly the same though. It is like the session is getting completely reset part way through the request with the initial session variables from when the session was first created.

Are they there if you check them immediately after they get set?

Yes