Sessions/Login Problem

Question

I have an application that I am working on that allows users
to take an online assessment. I have a login script that works at
this point - BUT it is working WAY TOO WELL!
I have an application file that sets the session.login
variable to false (using a CFPARAM tag). Once they login, it sets
that variable to TRUE, and sets some other variables such as user
id and name and other stuff.
This is what is happening -
1. User logs in
2. User is able to complete survey
3. User closes the window.
4. User (or anyone else that uses that computer) can go back
to a secured page and take another survey.
What should hapen -
1. User should NOT be able to go back to the survey once
taken - I take care of this at the end of the survey by setting a
session variable and updating the user table. (This is not complete
yet - and is not the source of the problem - YET)
2. User should NOT be able to go back to a page once the
browser is closed - they should definitely have to log back in.
QUESTION - How can I clear all session variables on window
close? Is this possible? I thought that closing a window would
destroy the session data - but apparently not.
Any advice?

Answer 1

hi tony,
I was jus reading the coldfusion documentation on session
variables and hope this is of use to u...
If you use ColdFusion session management, ColdFusion
automatically ends sessions and deletes all Session scope variables
if the client is inactive for the session time-out period. The
session does not end when the user closes the browser.
If you use J2EE session management, ColdFusion MX ends the
session and deletes all Session scope variables when the user
closes the browser, or if the client is inactive for the session
time-out period. If the session times out, however, the browser
continues to send the same session ID, and ColdFusion will reuse
this ID for sessions with this browser instance, as long as the
browser remains active.
# In many cases, you can effectively end a session by
clearing the Session scope, as shown in the following line. The
following list, however, includes important limitations and
alternatives:
<cfset StructClear(Session)>
# Clearing the Session scope does not clear the session ID,
and future requests from the browser continue to use the same
session ID until the browser exits. It also does not log the user
out, even if you use Session scope storage for login information.
Always use the cflogout tag to log users out.
# If you use J2EE session management, you can invalidate the
session, as follows:
<cfset getPageContext().getSession().invalidate()>
This line creates a pointer to the servlet page context and
calls an internal method to reset the session. This clears all
session information, including the session ID Session scope
variables, and if you are using session login storage, the login
information, for future request. However, the session information
does remain available until the end of the current request. After
you invalidate a session, attempts by the browser to access the
application will generate an invalid session exception until the
session times out.
Note: You cannot destroy the session and create a session on
the same request, as creating a new session involves sending
session cookies back.