CFID and CFTOKEN are not clearing out for me in Lu...
# cfml-generalr
Randy L. Smith
02/27/2023, 10:29 PMCFID and CFTOKEN are not clearing out for me in Lucee when I explicitly tell them to. I've thrown the kitchen sink at it, but they still appear. Any ideas?
<cfset StructClear(session)>
<cfcookie name="cftoken" expires="now"/>
<cfcookie name="cfid" expires="now"/>
<cfset delete_cookie=StructDelete(session,"cftoken") />
<cfset delete_cookie=StructDelete(session,"cfid") />
<cfset delete_cookie=StructDelete(session,"sessionid") />
<cfset delete_cookie=StructDelete(session,"urltoken") />
b
bdw429s
02/27/2023, 10:31 PMWhat is your goal here?
bdw429s
02/27/2023, 10:32 PMGenerally speaking, if you don't want session cookies, then turn that feature off. If session cookies is turned on, then I assume Lucee is going to make sure those cookies always exist because that's what you've asked it to do.
bdw429s
02/27/2023, 10:32 PMIf your goal is just to invalidate a given user's session, then I'd look into
sessionInvalidate()e
Evil Ware
02/27/2023, 10:38 PMThis works for us in lucee for NUKING a user session, your mileage may vary.. <cfset getPageContext().getSession().invalidate()>
✅ 1
r
Randy L. Smith
02/27/2023, 10:44 PMGoal is to sign someone out and clear the area. I have two customers in two completely different locations sharing a session because one was once located in the other's area. It's very odd but when one signs on they assume the identity of the other person. I've logged their cookies and they are identical.
b
bdw429s
02/27/2023, 10:45 PMDid one user share a URL with the other user which may have contained CFID and CFToken in the query string?
e
Evil Ware
02/27/2023, 10:59 PMYou need a secondary check to see if the user already has an active session, and if so, log that session out.
r
Randy L. Smith
02/27/2023, 11:02 PMThey might have shared a URL, but we don't use the cfid/cftoken in URL's so that would be a stretch.
I created a way for them for now to run a session rotate (e.g. it runs "<cfset sessionRotate()/>" if they use ?rotate in the URL) and that seems to be making the switch we need.
Not sure why my logout routine isn't being hit properly though. I have to check through this legacy code and find out where that's being hijacked.
d
dswitzer
02/28/2023, 11:56 AM@Randy L. Smith Something to keep in mind, while you might not be passing CFID/CFTOKEN, they can be passed via CFLOCATION automatically.
✅ 1
6 Views