Kill Session on browser close.

Question

Here's my Application.cfc code:

< cfcomponent> < cfset this.applicationname="cfGossip"> < cfset this.applicationname="true"> < cfset this.sessionManagement = true /> < /cfcomponent>

My session is called "Session.MM_Username" I want to 'kill' it when a browser is closed. How do I do this? Can somebody try construct the code for my Application page to do this? Thanks.

Answer 1

Basically, you need to create a "session cookie" - that is, a cookie with no expiry date. It will be removed when the browser window is closed.

I don't know how to do this off hand with CF, but this will probably help: http://www.google.com/search?q=cold+fusion+session+timeout

Possibly by setting:

this.sessiontimeout = ""

Answer 2

Use J2EE servlet session management

http://help.adobe.com/en%5FUS/ColdFusion/9.0/Developing/WSc3ff6d0ea77859461172e0811cbec22c24-7c48.html#WS88096532-E1B5-40d6-92CF-41A5E402994B

see slide 30, or watch the connect recording at http://www.12robots.com/index.cfm/2009/9/17/ColdFusion-Application-Security-at-the-Boston-CFUG--Last-Night

Answer 3

Your CFID and CFTOKEN cookies need to be set at session cookies like this:

<cfapplication     
     sessionmanagement="Yes"
     name="MyApplication"
     setclientcookies="No"
     sessiontimeout=#CreateTimeSpan(0, 0, 1440, 0)#>

<cfcookie name="CFID" value="#SESSION.CFID#" />
<cfcookie name="CFTOKEN" value="#SESSION.CFTOKEN#" />