Shaun Mccran

My digital playground
 
20
M
A
Y
2010

Building Intelligent sessions into your framework

Have you ever been logged into an application and had your session timeout, then when you log back in you are returned to a different place altogether?

This article deals with a way to mark where a user was in your application and return them to that location when they log back in. It also allows a user to deep link into an application. IE when they have a bookmarked link instead of being passed to the home page, they are passed through to their original destination.

[More]

 
26
F
E
B
2010

Combining persistent server side (ColdFusion) variables with client side (JQuery) values

I stumbled upon an interested dilemma recently whilst building a search engine. The results of a search are returned, and can be viewed in a list or thumbnail view. The view toggle is a uses a JQuery function, so no persistent data is stored concerning a users current viewing option. The dilemma is how do you maintain the viewing mode across page reloads, such as for pagination, or filtering of the search results?

[More]

 
18
N
O
V
2009

Image expired error message using CFChart

A bug came up in an application that uses the CFchart tag to create flash charts.

view plain print about
1<cfchart format="flash">Values</cfchart>

On the initial load the charts display just fine, but if you refresh the page, or go back to it later to view the data the images error. They display like this:

Expired content

There seem to be two potential reasons for this. The first is that the cache for the chart in ColdFusion has expired. It seems that by default the per request cache is for 5 seconds only, so if your template takes longer than this to run then you may end out with expired content before you serve it up.

To fix this try this, excerpt from the CFchart blog: 1. Stop the CF server. 2. Open \lib\webcharts3d.xml 3. You can increase the timeout for keeping the graphs in the cache by editing the minTimeout and maxTimeout attributes:

view plain print about
1<?xml version="1.0" encoding="UTF-8"?>
2<server image="PNG" cache="Memory" minTimeout="5000" maxTimeout="30000"....

Change this to whatever values you want.(Values of minTimeout and maxTimeout are in milliseconds.)

Full article here: http://cfchart.blogspot.com/2005/06/image-expired-trouble.html

The second potential reason for this, and the more likely in this case is that the code is running on a clustered server. The error is cause where the CFchart tag generates a temporary file (swf, png, jpg) and serves that up to the user. When the user makes another request there is no guarantee that the request will hit the same server, so it will not find the temporary file, and throws the 'content expired' error message.

You could ensure that the content is served up correctly by tying the user to the server using session management, or more ideally set the temporary file to be written to a central server in a kind of CDN (Content Distributed Network) way.

I'm off to try both and see which one works!

 
09
J
U
L
2009

Basic fusebox fuseaction to handle security references

I am a big fan of fusebox, I like the way it handles inheritance, and I love the fact that it instinctively lends itself to a modular approach.

Part of the strength in using fusebox is in knowing exactly when each of the framework fuse actions run, and just what sort of functionality you can embed in them. In this case I'm using the "Pre fuse Action" to perform a basic security validation on any fuseactions in that circuit.

view plain print about
1<cffunction name="prefuseaction">
2        <cfargument name="myFusebox" />
3        <cfargument name="event" />
4
5
6    </cffunction>

Above is a blank prefuseaction, insert any code you want to perform on any of the other fuseactions in that circuit here. Note that it runs before the circuit action.

A basic session validation script could be something like:

view plain print about
1<!--- check that user is logged in --->
2        <cfif NOT isdefined('session.loggedIn')>
3            <cfset session.logoutMsg = "Your session has timed out, please login again">
4            <cflocation url="index.cfm">
5            
6            <cfif NOT isdefined('session.superadmin')>
7                <cfset session.logoutMsg = "You do not have sufficient rights to view Super admin functions">
8                <cflocation url="index.cfm">
9            </cfif>
10
11        </cfif>

In the code above I am checking for a valid session variables, and if it is not there sets an error message and redirects to the homepage.

This is a pretty basic "catch all - are you logged in?" type query, but if you have an administration circuit then it provides good basic fuseaction protection. I've extended it out one step further by creating a cfc call to this code which just returns true/false. Something like this:

view plain print about
1<cfif application.security.check()>true<cfelse>false</cfif>

I am currently extending this further with more robust security, and user roles and groups.

 
02
J
U
L
2009

Coldfusion dropping session ID in fusebox application

I recently rolled out beta version of a new application I've been writing, only to discover that there was a bizarre session problem that didn't exist in dev, but does in live.

I've worked it out, but I thought I'd explore it some more. It is a fusebox 5.5 non xml application. The error I had was that as soon as I made a call through a "new" circuit, IE one I hadn't called before ColdFusion would generate a new session ID, and thus invalidate my current active session.

Looking through my application CFC I had this line of code present.

view plain print about
1<cfset this.SetClientCookies = false />

Setting this to true fixed the issue. This is because ColdFusion relies on the CFID and CFTOKEN to maintain the session state. You can either pass these two variables through the URL on every page request, which is a bit messy, or you can use a cookie. It is the variable above that lets the application use cookies on the user's session.

The problem with setClientCookies is that it is persistent, IE it is built for that session, and left on the user's pc, even after the session has expired, or they have left the application. Also some users will accept per-session cookies, but not persistent session cookies.

They are a lot more secure as per-session cookies, as they cannot be duplicated and hacked to spoof a previous user's session, and if you pass the token through the URL it is easy changed.

You could put something like this in your onRequestend function in application.cfc

view plain print about
1<cfif IsDefined("Cookie.CFID") AND
2IsDefined("Cookie.CFTOKEN")>

3<cfset cfid_local = Cookie.CFID>
4<cfset cftoken_local = Cookie.CFTOKEN>
5<cfcookie name="CFID" value="#cfid_local#">
6<cfcookie name="CFTOKEN" value="#cftoken_local#">
7</cfif>

This will make them per-session. I originally thought that it was something to do with the Fusebox framework, but I had overlooked the simple fact that it was still a new page request, so would be lost. Although this doesn't explain why I wasn't getting this error in my development environment but did in live.


This content is purely my opinon, any offence or errors are unintentional, please comment your views appropriately
Site Credits
Aggregated by ColdfusionBloggers.org Powered by Coldfusion

Technology & Science Blogs - BlogCatalog Blog Directory Blog Directory & Search engine