Re: J2EE Sessions / session.urlToken

2004-10-13 Thread Jamie Jackson
Hi Chris, >Check the help on urlSessionFormat, I think there's a switch to turn off the token append. You mean to switch off CFID/CFTOKEN only? Otherwise, I don't see any utility in turning of the entire token in urlSession format... BTW, I don't believe there is a (documented) switch in urlSess

Re: J2EE Sessions / session.urlToken

2004-10-13 Thread Chris Norloff
CFID/CFTOKEN are still used to identify client variables stored in the database. Check the help on urlSessionFormat, I think there's a switch to turn off the token append. best, Chris Norloff -- Original Message -- From: Jamie Jackson <[EMAIL PROTECTED]> R

J2EE Sessions / session.urlToken

2004-10-12 Thread Jamie Jackson
I've got a couple questions about session.urlToken under J2EE sessions: When J2EE sessions are enabled, why does session.urlToken bother with CFID/CFTOKEN anymore. The fact that both are there confuses me. I wonder which takes precedence? Do I lose the extra security that the uniqueness of jsessio