Session maintenance

[gasparrelli]

I am thoroughly confused on how CF maintains a session and could use a little insight... let me explain:

I have an application which relies heacily on session variables. I create no cookies and do not programatically pass cfid or cftoken between pages (or any other session variables). Yet somehow my CF server correctly connects variables with users. How is this happening?

When I search my client machines after a visit to my website I can find nothing new stored on the client machine. According to what I have read this should not work, but somehow it does.

Can anyone tell me why this works? Shouldn't my sessions turn to mush if I don't pass cfid & cftoken somehow?

 

[bankholdup]

Session variables are stored in the server's RAM, so you won't find cookies and you don't need to pass variables. However, it is important to use <cflock> when dealing with session variables to completely maintain seperate sessions.

bankholdup

 

[gasparrelli]

Use CF lock when you are creating the variables? I have never used it. There's nothing on the client side then?

 

[bankholdup]

Use <cflock> every time you access the session variable. And no, nothing on the client side (not a bit, pardon the pun).

bankholdup

 

[lazypos]

I am puzzled as well.

I am using session variables to keep track of shopping cart items. Items are added to the cart in a NON SSL page. So far, the cart works fine and you can see all the items. To check out the user is taken to a SSL area of the site. Now, I can't access my session variables anymore. I am not passing cfid or cftoken between pages in the URL.

I had read about passing those variables along, but everything was working without it so I just never did it.

Will adding the variables make it work, or is there some other trick needed to pass from Non-SSL to SSL and retain your variables?

Thanks

 

[gasparrelli]

I understand that session variables cannot be passed from non-SSL to SSL pages, so you must pass all your variables from the &quot;old&quot; session into the &quot;new&quot; one. I haven't done this yet but am adding SSL to my site so have researched it, but can't advise beyond that...

 

[iza]

i had the same problem as lazypos, except that i was NOT using ssl pages ... : i had used session variables without passing cfid or cftoken (i was also locking them, as bankholdup says), and the puzzling thing is that on the SAME machine it would sometimes works fine, sometimes not .... i still haven't understood why and i'm using cookies now :-/