ColdFusion SessionTracker and Force Termination

Question

I am using ColdFusion 9 coldfusion.runtime.SessionTracker to monitor registered users using the following code.

 app = application.getApplicationSettings().name; sessiontracker = createObject("java","coldfusion.runtime.SessionTracker"); sessionCollection = sessionTracker.getSessionCollection(app); 

Which returns a struct of jsessionid and session variables for all currently active sessions.

Is it possible to forcefully end a session if I have a jsessionid that effectively forces the user to log out?

Thanks,

Richard

Answer 1

So, when the user logs in, I set the user structure in their session, so I delete their login state. Using sessionTracker , I can get a specific user session and just delete the user structure in the current session.

 app = application.getApplicationSettings().name; sessiontracker = createObject("java","coldfusion.runtime.SessionTracker"); sessionCollection = sessionTracker.getSessionCollection(app); userSession = sessiontracker.getSession(app, sessionID)); structDelete(userSession, "user"); 

Not sure if this is the best way to do this, but it seems to work for me. Hope this helps people.

Answer 2

Have you tried using onSessionEnd in application.cfc? Since we can start it manually during the logout process or it automatically works if the user closes the browser or something that works fine. This is how we use it.

In application.cfc, we run onSessionEnd, and it runs the logout function, which is also located in application.cfc, and does all the clean stuff and logging.

 <cffunction name="OnSessionEnd" access="public" returntype="void" output="false" hint="Fires when the session is terminated."> <cfargument name="SessionScope" type="struct" required="true" /> <cfargument name="ApplicationScope" type="struct" required="false" default="#StructNew()#" /> <cfargument name="timedOut" type="boolean" required="false" default="true"> <cfinvoke thisSessionScope="#SessionScope#" timedOut="#arguments.timedOut#" method="logout"> </cfinvoke> <cfset structClear(arguments.sessionScope) > <!--- Return out. ---> <cfreturn /> </cffunction> 

Hope this helps