[midasxl]

OK, maybe I'm just not understanding how this works. I have an application.cfc with the following code:

<cfcomponent
	displayname="Application"
	output="true"
	hint="Handle the application.">
 
 
	<!--- Set up the application. --->
	<cfset THIS.Name = "Marks CFC App"/>
	<cfset THIS.ApplicationTimeout = CreateTimeSpan( 0, 2, 0, 0 )/><!--- days, hours, minutes, seconds --->
	<cfset THIS.SessionManagement = true/>
	<cfset THIS.SetClientCookies = true/><!--- without this the CFID and CFTOKEN need to be passed in the URL between pages --->
	<cfset THIS.SessionTimeout = CreateTimeSpan( 0, 0, 0, 10 )/>
    
    <cfif not IsDefined("cookie.cfid")>
       <cflock scope="session" type="readonly" timeout="5">
          <cfcookie name="cfid" value="#session.cfid#">
          <cfcookie name="cftoken" value="#session.cftoken#">
       </cflock>
    </cfif>

Then I have a .cfm page that outputs the application data:

<cfoutput>

<!--- Create a new instance of the application object. --->
<cfset applicationInstance = createObject(
	"component",
	"Application"
	) />
 
<!--- Dump out the application instance. --->
<h4>Application Instance Dump</h4>
<cfdump
	var="#applicationInstance#"
	label="Application Instance"
	/>
    
    <h4>Session Dump</h4>
    <cfdump var="#session#">
</cfoutput>

I navigate to this page and see the structs, and the session struct shows me a cfid of 2690. I then sit on this page for way longer than the session timeout of 10 seconds, and refresh the page. Shouldn't the cfid change? I even close the browser and reopen to this page and the cfid is still 2690. I imagine ColdFusion is getting this from the cookie, but I thought I was expiring those when the browser closes.

Any help with understanding this would be pretty cool! Thanks!

[Craig328]

Hm. I'm wondering if you could explain what it is you're doing with createObject code in your .cfm page. If all you're wanting to do is dump the application scope then all you need to do is

<cfdump var="#application#">

. I'm not saying this is your problem but I'm wondering what you're trying to do there.

Also, you might try setting the application timeout to like 2 minutes. My recollection may not be all there but I seem to recall that changing the session timeout variable without refreshing the application scope didn't allow a new session timeout value to take. In fact, to restart the application scope, you may need to set an application variable within your code somewhere (and not as a "this" variable in the component). If you originally started your test with a session timeout of like 2 hours or so and your original application timeout was 2 days...it could be that any subsequent changes you make to the session timeout value won't take effect until the application scope restarts. Mind you, that's a complete guess.

But try that and let us know what you find. I'll see if I can reproduce your results on a dev machine I can access in the meantime. Tell me again, what version of CF are you using and on what OS?

This post has been edited by Craig328: 03 February 2011 - 06:53 AM

[midasxl]

Hello, thanks for your reply and for tolerating me once again. I am running coldfusion 9,0,0,274733 on Apache 2.2.16 web server. OS is Solaris SPARC 9. This is my development environment.

Craig328, on 03 February 2011 - 06:52 AM, said:

Hm. I'm wondering if you could explain what it is you're doing with createObject code in your .cfm page. If all you're wanting to do is dump the application scope then all you need to do is

<cfdump var="#application#">

.

I was simply experimenting with several methods of application introspection. I discovered four ways to do it and this was one of them. They are as follows:

#1
<cfdump var="#application#">

#2
<cfdump var="#this#">

#3

<cfdump var="#application.getApplicationSettings()#" />

#4
<cfset applicationInstance = createObject(
"component",
"Application"
) />

<cfdump
var="#applicationInstance#"
label="Application Instance"
/>

I have modified my application.cfc (not much) to the following:

<!--- Set up the application. --->
	<cfset THIS.Name = "Marks CFC App"/>
	<cfset THIS.ApplicationTimeout = CreateTimeSpan( 0, 0, 2, 0 )/><!--- days, hours, minutes, seconds --->
	<cfset THIS.SessionManagement = true/>
	<cfset THIS.SetClientCookies = true/><!--- without this the CFID and CFTOKEN need to be passed in the URL between pages --->
	<cfset THIS.SessionTimeout = CreateTimeSpan( 0, 0, 0, 10 )/>
    
    	<cfif IsDefined("cookie.CFID") AND IsDefined("cookie.CFTOKEN")>
<cfset cfid_local = "#cookie.CFID#">
  <cfset cftoken_local = "#cookie.CFTOKEN#">
    <cfcookie name="CFID" value="#cfid_local#">
    <cfcookie name="CFTOKEN" value="#cftoken_local#">
    </cfif>

The application timeout is now 2 minutes, and the session timeout is 10 seconds. I ran the index page of the application. The session scope dump revealed a cfid of 2701. I let it sit for about 5 minutes to make sure the application timed out. I performed a page refresh and the cfid in the session scope dump remained the same at 2701.

So now I'm thinking maybe the changes didn't take so I need to restart the application as you suggested. Next I created a page called stopApp.cfm and included the following:

<cfset applicationstop() />

From what I understand this will stop the application and then the next time I open a page of the application it will restart it? I ran stopApp.cfm, and then I then ran the index page of the application (thereby restarting the application?) and the session scope dump still had a cfid of 2701. I let it sit well past the session and application timeouts, and hit refresh; the cfid is still 2701.

When I close the browser and ran the index page again the cfid changed to 2702 because of the code in the application.cfc that expires the CFID and the CFTOKEN when the browser is closed.

So am I to understand that I SHOULD be seeing the CFID change on refresh with the current settings that I have in the application.cfc? Or is what I am seeing the way it should be, with the cfid persisting throughout the life of the browser regardless of a session timeout.

When I set clientCookies to true I assume an identifier cookie is set but I don't actually see it in my temp files folder in ie8. Is this because it is not being written to my computer and is being held in browser memory because of the code in the application.cfc? If so, a browser refresh doesn't seem to be expiring it the way a browser close does.

When I do this in firefox I DO see the cfid and cftoken in my cookies folder and they are set to expire at end of session. All other behavior in FF is the same as IE8.

Maybe it's not supposed to change on refresh with the current settings I have. I always thought when the session times out, and I hit refresh, then CF would send another CFID and CFTOKEN. After all the session is over; any new requests to the application should be a new session right? But the session ending and the cookie expiring are two separate things. The session can timeout and when I hit refresh it looks for the cookie on my computer (either in browser memory or on hard drive) and if it finds it will use it if it matches the data that ColdFusion has in its memory.

Let me know what you think of my ramblings. Thanks for your help!