Thanks to everyone who gave their views and advice regarding this
problem I posted yesterday. The more we investigate, the more we feel
that is down to the proxy settings of the problem users below.
Has anyone else had bad experiences with proxies/firewalls and session
variables swapping?
Thanks again
Chris.
-----Original Message-----
From: Chris Bohill
Sent: 28 January 2002 15:04
To: CF-Talk
Subject: Session Swapping" incident
We are developing an web based application, and have recently been
experiencing a number of "Session swapping" incidents. On two occasions
a user has been navigating the system, only to "Swap" sessions with
another user, who (we are not 100% sure) may also be viewing the site at
the same time.
Because a lot of the site is user-profile based, the user can tell
straight away that they have "Swapped". The user in question returned to
the welcome page, but another users name and details were there. This
other user was in the same building but different floors, so they may
have been on the same network.
For this to happen is pretty awkward, as much of the data is of a
sensitive nature, but we feel we have done as much as we can to reduce
the chance of this happening.
We have locked all session variables and only refer to them as local
variables on pages that need them. see below:
<cflock timeout="10" type="READONLY" scope="SESSION">
<cfset Variables.VarOne= session.VarOne>
<cfset Variables.VarTwo= session.VarTwo>
</cflock>
When writing to a Session Variable we again use cflock, with type set to
"Exclusive".
All Session variables are locked when created on the Application page,
and are set to "Exclusive".
When the user logs out of the system we use the following code to kill
all the session variables:
<cflock timeout="20" throwontimeout="No" type="EXCLUSIVE"
scope="SESSION">
<CFCOOKIE NAME="CFID" VALUE="" expires="NOW">
<CFCOOKIE NAME="CFTOKEN" VALUE="" expires="NOW">
<cfscript>
StructDelete(Session, "VarOne");
StructDelete(Session, "VarTwo");
StructClear(Session);
</cfscript>
</cflock>
Are there known issues with session variables or is there something
vital that we are missing?
Is there something we should be doing on the Administrator to protect
"session swapping"?
For this to happen, even once is not acceptable to our client, so it is
essential that we resolve this issue. Speed is an important issue with
this application so using single thread sessions would not be a
straightforward solution for us.
Any responses would be greatly appreciated.
Thanks,
______________________________________________________________________
Why Share?
Dedicated Win 2000 Server · PIII 800 / 256 MB RAM / 40 GB HD / 20 GB MO/XFER
Instant Activation · $99/Month · Free Setup
http://www.pennyhost.com/redirect.cfm?adcode=coldfusionc
FAQ: http://www.thenetprofits.co.uk/coldfusion/faq
Archives: http://www.mail-archive.com/cf-talk@houseoffusion.com/
Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists
