SessionRotate solution for JEE Sessions

March 28, 2014
coldfusion

As you may know the new ColdFusion 10 function SessionRotate works great if you are using ColdFusion sessions (CFID, CFTOKEN), but it doesn't actually rotate the session id or invalidate the underlying J2EE session if you are using JEE sessions. This is documented and by design, because a single J2EE session can span multiple ColdFusion applications on the same domain.

You can still rotate your J2EE sessions, but keep in mind that if you have multiple CF applications on the same domain it will only keep info for the current session (you could probably modify the code to get that working).

<cffunction name="jeeSessionRotate" output="false" returntype="string">
	<cfset var sessionScope = Duplicate(session)>
	<cfset var req = getPageContext().getRequest()>
	<cfset StructDelete(sessionScope, "sessionid")>
	<cfset StructDelete(sessionScope, "urltoken")>
	<!--- invalidate old session --->
	<cfset req.getSession().invalidate()>
	<!--- create a new JEE session --->
	<cfset local.newSession = req.getSession(true)>
	<!--- copy the old session scope into a temp key in the new session, handled in onSessionStart --->
	<cfif NOT StructIsEmpty(sessionScope)>
		<cfset local.newSession.setAttribute("jeeSessionRotateOldSession", sessionScope)>	
	</cfif>
	<cfreturn local.newSession.getId()>
</cffunction>

In your code call the above function to rotate the J2EE session, it will then store the old session scope in the new J2EE session directly with the key jeeSessionRotateOldSession.

Then in the onSessionStart function of your Application.cfc add the following to bring the old session data back into the new CF session:

<cffunction name="onSessionStart">
	<cfset session.startTime = now()>
	<cfset local.oldSession = getPageContext().getRequest().getSession().getAttribute("jeeSessionRotateOldSession")>
	<cfif NOT IsNull(local.oldSession) AND NOT structIsEmpty(local.oldSession)>			
		<cfloop list="#StructKeyList(local.oldSession)#" index="local.key">
			<cfif NOT StructKeyExists(session, local.key)>
				<cfset session[local.key] = local.oldSession[local.key]>
			</cfif>
		</cfloop>	
		<cfset getPageContext().getRequest().getSession().removeAttribute("jeeSessionRotateOldSession")>
	</cfif>
</cffunction>  

This is needed because the CF session scope is no longer usable after you run jeeSessionInvliadate(), so we need to wait until onSessionStart is invoked again with the new jee session to copy the old CF session scope back over.

Note: that the jeeSessionRotate function above only copies values set via CF's session scope, it doesn't copy any values that other JEE applications might have set, it could be modified to do that if you needed to.



Related Entries

2 people found this page useful, what do you think?

Comments

Great post Pete! Although I'm left wondering how this holds up with async requests? Are there concurrency down sides to this approach?
This article helped me Pete, so thanks.

Just on the "This is documented and by design, because a single J2EE session can span multiple ColdFusion applications on the same domain".

Should the "design" level here be the application, not CF? Whilst it *might* be the case that JEE sessions are spanned across multiple CF applications on the same domain, this is not essential nor vital to JEE-based session operations. Nor would I think it's actually the most common happenstance.

It should be down to the application to make judgement calls as to how / when session rotation is managed, not down to some engineer in the Adobe CF office, shouldn't it?

That aside, if sessionRotate() doesn't actually do what it says on the tin in these situations, it should raise an exception when used in a JEE-session-using environment, not simply "run" and not do anything?

Cheers for the insight though. Excellent stuff.

--
Adam
@Adam - Good points, I agree with you that is should be up to the application to decide if it is ok to rotate the entire session. I suppose there may be some sandbox type concerns as to if it is really ok to allow an application to do something to another application. Perhaps it would make sense to have an argument to "force" rotation on JEE sessions, if not just allowing it to work.
@Jan - good question, that is not something I have tested, but you could always wrap it in cflock if that turns out to be necessary.

Post a Comment




  



Spell Checker by Foundeo

Recent Entries



foundeo


did you hack my cf?