Remembering passwords 2

[Shlomo]

Is it possible for CF to remember a password from the time it has been entered until the remainder of the session.&nbsp;&nbsp;<br>e.g. To enter the ask the doctor page you need to enter a password. (The doctor page is a link on a ubiquitous frame) Say after submitting first question the user decides to go back and ask another question.&nbsp;&nbsp;Is it posiible to work it so that there's need to reenter it and one is taken directly to the question entry page.

 

[philcha]

I think the effect you want can be achieved as follows:<br>*&nbsp;&nbsp;the login action page sets a Session-level variable to record the user's id, e.g.<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfset Session.UserId = #form.UserId#&gt;<br>*&nbsp;&nbsp;each page which provides a service to the user checks this variable and, if it hasn't been set, shows the login page, e.g.<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfparam name=&quot;Session.UserId&quot; default=&quot;&quot;&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfif Session.UserId IS &quot;&quot;&gt;&nbsp;&nbsp;&nbsp;&nbsp;&lt;!--- not logged in ---&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;cflocation url=&quot;loginpage.cfm&quot;&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfelse&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;!--- do something useful for the user ---&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/cfif&gt;<br><br>The advantage of remembering user id is that it enables other pages to check the user's authorisation&nbsp;&nbsp;&nbsp;-&nbsp;&nbsp;you might not need this now but you might need it for some later extension to your system.

 

[philcha]

Update on my last response:<br><br>I've just found this article -<br><A HREF="

http://www.advantex.net/ColdFusion/CFClustering.htm"

TARGET="_new">

http://www.advantex.net/ColdFusion/CFClustering.htm</A><br><br>where

the author says (to cut a very long story short):<br>*&nbsp;&nbsp;&nbsp;if there's any possibility of your using <b>clustered servers with load-balancing</b>, use Client variables rather than Session variables.&nbsp;&nbsp;If a user gets switched from server A to server B, server doen't know about the Session variables which were stored on server A (which may have gone down).&nbsp;&nbsp;If you think your organisation / any of your clients may use clustered servers with load-balancing, you'll need to read the article as it's long and I haven't taken it all in yet.<br>*&nbsp;&nbsp;&nbsp;if there's <b>no</b> possibility of your using clustered servers with load-balancing, use Session variables because they're much simpler.<br>

 

[Shlomo]

OK, well I think your solution would work, <font color=red>but</font> , there's one point I didn't specify before and it might be the key.<br>As is the site doesn't have a login page per se, instead when you click to enter 'page x' well, that page requires a registered user.<br>So the problem becomes that <font color=red>since</font> it's the home page link that accesses the login page and the setting for the session variable would be on the login page (which is cfif(loggedin=true) cfincluded in to the 'welcome' page) if there is a cfparam in the home page there is an error since at least for the first time accessesed the variable in the cfparam (session.userid) is not defined. <br>(I hope I explained this clearly !)<br>Is the only solution to create a separate login page?<br>Actually at Tek-Tips it seems that what's been done, there is a separate form to log in on on the side of the page!!!!<br>And from there on you get a whole new set of templates.<br>Thanks ,<br>Shlomo

 

[philcha]

cfparam allows you to specify a <b>default</b> value if the variable is not already defined, and that prevents an error if the user has not logged in:<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfparam name=&quot;Session.UserId&quot; <b>default=&quot;&quot;</b>&gt;<br><br>And you need to include the &quot;check login&quot; code on every page, because even if your site has a login page someone will try to by-pass it.<br><br>So put the &quot;check login&quot; code in <b>Application.cfm</b>, which is processed at the start of every page request&nbsp;&nbsp;-&nbsp;&nbsp;then no-one needds to remeber to include it in each display page.

 

[Shlomo]

OK, I hear what you are saying.&nbsp;&nbsp;<i><font color=red>but</font></i>this is what has happened. I typed the following exact words in the login page:<br>&lt;cfparam name=&quot;session.userid&quot; default=&quot;&quot;&gt;<br>&lt;cfif session.userid is &quot;&quot;&gt;<br>&lt;cfinclude template=&quot;pass.cfm&quot;&gt;<br>&lt;cfabort&gt;<br>&lt;/cfif&gt;<br><br>And it parsed the whole template as if session.userid were something other than &quot;&quot;.<br>Hrumph!!!!!<br>Thanks again

 

[philcha]

Don't know how you've got your whole app set up, but this bit from DWAC might be relevant:<br>To enable session variables, set SESSIONMANAGEMENT=&quot;Yes&quot; in the CFAPPLICATION tag in your Application.cfm file. Note that when you turn on session management in the CFAPPLICATION tag, you must specify the application's name.<br><br>Also I notive you typed &quot;session&quot;.&nbsp;&nbsp;All the examples say &quot;Session&quot; and I think it needs a capital &quot;S&quot;.<br><br>Given what you said about Ben Forta's basic book not mentioning Session variables, I suspect you need to read through DWAC at least to the end of the chapter &quot;Using the Application Framework&quot; in order to have all the info you need.

 

[Shlomo]

And yes I put in <br>&lt;cfset session.userid = #form.registered#&gt;<br>on the login action page.&nbsp;&nbsp;(which is the same page that provides a service)

 

[Shlomo]

Just to clarify:Ben Forta mentions them , but in pasing and doesn't demonstrate how they work or how to set them up.