CF11 : cflogin doesn't "stuck" after session/login timeout

Question

Hi,
Since migrating from CFMX7 to CF11 we are experiencing some weird failure with cflogin (using session or cookie storage).
Basically when we log-in on the application after a session/client timeout the first login doesn't last for longer than the login submit request.
The second login however is OK
I made a very simple application.cfc/index.cfm with short timeouts to check this:
<cfcomponent
output="false"
hint="I define the application settings and event handlers.">
        <!--- Define the application settings. --->
        <cfset this.name = hash( getCurrentTemplatePath() ) />
        <cfset this.applicationTimeout = createTimeSpan( 0, 0, 10, 0 ) />
        <cfset this.sessionTimeout = createTimeSpan( 0, 0, 0, 10 ) />
        <!--- Set up the application. --->
        <cfset THIS.SessionManagement = true />
        <cfset THIS.ClientManagement = true />
        <cfset THIS.SetClientCookies = true />
        <cfset THIS.loginStorage = "Session" />
        <cfset THIS.clientStorage = "sidys" />
        <!--- Define the request settings. --->
        <cfsetting showdebugoutput="false" />
        <cffunction
                name="OnRequestStart"
                access="public"
                returntype="boolean"
                output="true"
                hint="Fires at first part of page processing.">
                <!--- Define arguments. --->
                <cfargument
                name="TargetPage"
                type="string"
                required="true"
                />
                <cfset SetLocale("fr_FR") />
                <cfif IsDefined("Form.logout") or IsDefined("URL.logout")>
                        <cflogout />
                </cfif>
                <cflogin idletimeout="20">
                        <cfdump var="#Session#">
                        <cfinclude template="form.inc" />
<cfif not isDefined("cflogin") or (cflogin.name IS "" OR cflogin.password IS "")>
        <cfoutput>
                <form method="post">
                <b>login :</b>
                <input type="text" name="j_username" size="24" class="champ" />
                <b>passwordnbsp;:</b>
                <input type="password" name="j_password" size="15" class="champ" />
                <input type="submit" value="Login" class="button" name="submit" />
                </form>
        </cfoutput>
        <cfabort>
<cfelse>
        <cflock timeout="10" scope="Session" type="exclusive">
                <cfloginuser name="#cflogin.name#" Password="#cflogin.password#" roles="role">
                <cfset Session.id=cflogin.name />
        </cflock>
</cfif>
                </cflogin>
                <cfdump var="#Session#">
                <cfif GetAuthUser() NEQ "">
                        <cfoutput>
                                <form method="Post">
                                <input type="submit" Name="Logout" value="Logout">
                                </form>
                        </cfoutput>
                </cfif>
                 <cfreturn true />
        </cffunction>
</cfcomponent>

Answer 1

I created a directory and copied your code to it. The exception was that I set THIS.ClientManagement to false and commented out the lines <cfset THIS.clientStorage = "sidys" /> and <cfinclude template="form.inc" />.
The code worked as expected. The files I used in the test are shown below.
index.cfm
We are in index.cfm<br>
<cfdump var="#session#">
Application.cfc
<cfcomponent>
<!--- Define the application settings. --->
<cfset this.name = hash(getCurrentTemplatePath()) />
<cfset this.applicationTimeout = createTimeSpan( 1, 0, 0, 0 ) />
<cfset this.sessionTimeout = createTimeSpan( 0, 0, 0, 10 ) />
<!--- Set up the application. --->
<cfset THIS.SessionManagement = true />
<cfset THIS.ClientManagement = false />
<cfset THIS.SetClientCookies = true />
<cfset THIS.loginStorage = "Session" />
<!--- <cfset THIS.clientStorage = "sidys" /> --->
<!--- Define the request settings. --->
<cfsetting showdebugoutput="false" />
<cffunction
                name="OnRequestStart"
                access="public"
                returntype="boolean"
                output="true"
                hint="Fires at first part of page processing.">
                <!--- Define arguments. --->
                <cfargument
                name="TargetPage"
                type="string"
                required="true"
                />
                <cfset SetLocale("fr_FR") />
                <cfif IsDefined("Form.logout") or IsDefined("URL.logout")>
                        <cflogout />
                </cfif>
                   <cflogin idletimeout="10">
                  <!--- <cfinclude template="form.inc" /> --->
                   <cfif isDefined("cflogin.name") AND cflogin.name IS NOT "" AND cflogin.password IS NOT "">
                         <!--- login form submitted, with username and password filled in --->
                         <cfloginuser name="#cflogin.name#" Password="#cflogin.password#" roles="role">
                         <cfset Session.id=cflogin.name />
                  <cfelseif getAuthUser() IS "">
                          <!--- User not yet logged in --->
                          <cfinclude template="loginForm.cfm">
                          <cfabort>
                 </cfif>
                </cflogin>
        <cfif getAuthUser() NEQ "">
            <cfinclude template="logoutForm.cfm">
            <!--- <cfabort> --->
        </cfif>
    <cfreturn true />
    </cffunction>
</cfcomponent>
loginform.cfm
<div>
<form method="post">
<b>login :</b>
<input type="text" name="j_username" size="24" class="champ" />
<b>password :</b>
<input type="password" name="j_password" size="15" class="champ" />
<input type="submit" value="Login" class="button" name="submit" />
</form>
</div>
logoutform.cfm
<div>
<form method="Post">
<input type="submit" Name="Logout" value="Logout">
</form>
</div>
You will observe that, like you, I set the session and cflogin timeout to a low test value, 10 seconds. When I first opened the URL to index.cfm in the browser, the login form was duly displayed. I entered a name and password and submitted the form.
I got the index.cfm page again. That time it had the logout button and a dump of the session scope. The dump contained an id (my username), confirming that login was still active. When I re-requested index.cfm, repeatedly in the browser, within around 4 or 5 seconds, its contents remained unchanged.  I then waited for about 15 to 20 seconds, for the login and session to time out.
I then repeated the procedure of logging in and re-requesting index.cfm every 4 or 5 seconds. I got the same result: its contents remained unchanged. That is the expected behaviour of cflogin and session.