CFID & CFTOKEN

[wmanu]

Hi there,

I’m creating a cart & payment system using Coldfusion MX 6.1. I have two application servers which are load balanced. So I cannot use sessions to track user logins and other variables because if the load balancer diverts a request to the other server where the session does not exist then the person will be logged out.

So I’m forced to use client variables. I’m against using cookies for better security. So the option left for me is store client variables in database. So I’m using the help of CFID & CFTOKEN to track logins and store client variables in database.

Now the problem is I’m using URLSessionFormat function to pass CFID & CFTOKEN to all pages after login. I have following problems:

1) If I copy the URL, which contains the CFID & CFTOKEN, close the browser and paste it in another browser window – it opens up the page with out any authentication.
2) If I copy and paste the same URL on a browser window in another PC, it works.

These two scenarios fail my security to the application. Can anyone please advice a way to kill the CFID & CFTOKEN on browser close or some mechanism to stop this occurring?

Any help is greatly appreciated.

Many thanks / Manu.

[JPfeff]

Well, you can manually set the cookie.CFID and cookie.CFTOKEN to override the expiration used by CF and set them to expire when the browser closes. There should be many examples of that code in this forum.

But have you considered using sticky sessions? Most load balancing systems support this, it will keep the user on the same server for all requests and only send additional users to your other server(s) as needed. Not quite the same as true load balancing, but close enough for most sites. Session vars just tend to work better for shopping carts since with client vars any complex data has to be transformed to strings (WDDX).

[wmanu]

Hi,

Thanks for your time. So I must use cookies! I was aware of this facility but was trying to avoid the client access to the variables I use to avoid hijacking variables.

Sticky sessions will not work for me as my load balancing is controlled by a piece of hardware rather than software. So it won’t recognise the sessions. So I’m storing complex data types with WDDX encoded.

Cheers / Manu.

[wmanu]

Hi,

Thanks for your time. So I must use cookies! I was aware of this facility but was trying to avoid the client access to the variables I use to avoid hijacking variables.

Sticky sessions will not work for me as my load balancing is controlled by a piece of hardware rather than software. So it won’t recognise the sessions. So I’m storing complex data types with WDDX encoded.

Cheers / Manu.

[wmanu]

Hi,

Thanks for your time. So I must use cookies! I was aware of this facility but was trying to avoid the client access to the variables I use to avoid hijacking variables.

Sticky sessions will not work for me as my load balancing is controlled by a piece of hardware rather than software. So it won’t recognise the sessions. So I’m storing complex data types with WDDX encoded.

Cheers / Manu.