Session.Security error

[programmher]

I am assigning security levels to certain pages within my site.<br><br>The security is supposed to be determined after the user logs in on the welcome page.&nbsp;&nbsp;The login authentication is performed by the below code:<br><br><br><br>&quot;&lt;CFSET Session.LoggedIn = FALSE&gt; <br><br>&lt;html&gt;<br><br>&lt;head&gt;<br><br> &lt;title&gt; Welcome - UserID Authenticate&lt;/title&gt;<br><br>&lt;/head&gt;<br><br>&lt;cfquery name=&quot;LogginIn&quot; datasource=&quot;MyDatabase&quot; &gt; SELECT&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*<br>FROM&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dbo.Users <br>WHERE&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;(UserId = '#form.UserID#') AND (Password = '#form.password#')<br>&lt;/cfquery&gt;<br><br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;cfif LogginIn.RecordCount GREATER THAN 0&gt;<br> &lt;CFIF LogginIn.Password IS Form.Password&gt;<br> &lt;CFSET Session.LoggedIn = TRUE&gt; <br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;CFSet Session.UserID=&quot;#Form.UserID#&quot;&gt; <br>&lt;!---&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;CFSet Session.Security=&quot;#Form.Security#&quot;&gt;&nbsp;&nbsp;&nbsp;&nbsp;---&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;CFSET Session.AddToken = &quot;cfid=#cfid#&cftoken=#cftoken#&quot;&gt; <br> <br> <br>&nbsp;&lt;CFELSE&gt;<br> &lt;CFSET Reason = &quot;The password you typed is invalid.&nbsp;&nbsp;Please Try again&quot;&gt; <br> <br>&lt;/CFIF&gt;<br>&nbsp;&lt;CFELSE&gt;<br>&lt;CFOUTPUT&gt;<br> &lt;CFSET Reason = 'Can not find a user named #Form.UserID#'&gt;<br>&lt;/CFOUTPUT&gt;<br><br>&lt;/CFIF&gt;&nbsp;&nbsp;<br><br>&lt;CFIF Session.LoggedIn&gt;<br><br>&lt;cflocation url=&quot;Home.cfm&quot; addtoken=&quot;Yes&quot;&gt; <br> <br><br> &lt;cfelse&gt; <br> &lt;CFOUTPUT&gt;<br><br> &lt;Script&gt;<br> alert(&quot;Sorry!&nbsp;&nbsp;Your login was unsuccessful&quot;<br> self.location=&quot;welcome.cfm&quot;;<br> &lt;/script&gt;<br> <br> &lt;/cfoutput&gt; <br><br>&lt;/cfif&gt;&quot;<br><br>Needless to say, when I refer to the Security session variable in my home.cfm page, I get an error.&nbsp;&nbsp;What am I missing?&nbsp;&nbsp;Why does my CF &quot;read&quot; the session variable before the session.security and the session variable after the session.security variable???<br><br><br><br><br><br>

 

[celley]

I think that there might be an easier way to manage this.&nbsp;&nbsp;Along with username and password in the database, you should assign authorization codes.&nbsp;&nbsp;And when you pull a users records, pull the auth code.&nbsp;&nbsp;And then &lt;cfset session.security = #database.authcode#&gt;&nbsp;&nbsp;And then on each page, check to make sure that the session user has the correct session auth code to be on that page.&nbsp;&nbsp;I hope I understood your question.... and that this answered it for you.<br><br>And if I misunderstood your question... this may be another answer... if you are checking to see if the user has logged in to the application before viewing some pages, make sure that the session.username exists before the page can be viewed.

 

[programmher]

Celley,<br><br>Thanks for your suggestion!&nbsp;&nbsp;You perfectly understand whatn I'm trying to accomplish.&nbsp;&nbsp;&nbsp;&nbsp;But, I am still getting the same error - whether I clal my variable &quot;authcode&quot; or &quot;security&quot;.&nbsp;&nbsp;The authcode will determine who has access to what pages.&nbsp;&nbsp;The userid is recognized - not my security level (or authcode).<br><br>Can you&nbsp;&nbsp;- or anyone&nbsp;&nbsp;- see any error in my coding that may explain this?<br><br>

 

[ntm0n]

As I see it, your trying to get your security level from your form (Which you have commented out). Secondly - did you add a security/authcode level to the database and get that on the call?

You need to add your auth codes to the database, and then assign that to your session variable. Currently in the code provided you have no authcode defined.

Hope this helps...

Gary



><cfif LogginIn.RecordCount GREATER THAN 0>
<CFIF LogginIn.Password IS Form.Password>
<CFSET Session.LoggedIn = TRUE>
<CFSet Session.UserID=&quot;#Form.UserID#&quot;>
<!--- <CFSet Session.Security=&quot;#Form.Security#&quot;> --->
<CFSET Session.AddToken = &quot;cfid=#cfid#&cftoken=#cftoken#&quot;>