title: Using Coldfusion sessions without cookies
body: <p>Good Day,</p>
  
  <p>We are trying to implement an API in Coldfusion 8 whereby cookies are not used - instead, we pass the cfid, cftoken and jsessionid by GET or POST for each request.</p>
  
  <p>We are using mach-ii and its SessionFacade. I don't know if you require any further information about this; please mention if you do.</p>
  
  <p>In Coldfusion Administrator, Client Variables are set to "Registry", Memory Variables are ticked for each of "Use J2EE Session Variables, Enable Application Variables, Enable Session Variables".</p>
  
  <p>My Application.cfc pseudo-constructor looks like</p>
  
  <pre><code>&lt;cfset this.name = "#cgi.server_name#" /&gt;
  &lt;cfset this.loginStorage = "session" /&gt;
  &lt;cfset this.sessionManagement = true /&gt;
  &lt;cfset this.setClientCookies = false /&gt;
  &lt;cfset this.setDomainCookies = false /&gt;
  &lt;cfset this.sessionTimeOut = CreateTimeSpan(0,1,0,0) /&gt;
  &lt;cfset this.applicationTimeOut = CreateTimeSpan(0,1,0,0) /&gt;
  </code></pre>
  
  <p>and there is nothing in onSessionStart or onSessionEnd.</p>
  
  <p>To validate the session, I am using a plugin and in its preProcess method I have:</p>
  
  <pre><code>if (not getSessionFacade().has("authUserLoggedIn")){
      arguments.eventContext.clearEventQueue();
      arguments.eventContext.announceEvent("nologin", newEventArgs);
  }
  </code></pre>
  
  <p>I think the first thing I'm not understanding is, are there any circumstances where it is necessary to send the cfid and cftoken when using J2EE sessions? Or does the jsessionid completely and totally replace their function?</p>
  
  <p>Secondly, I want this one Application (and not the whole server) to not send cookies. In my Application.cfc, I have cookies set to disabled, yet it still tries to send a cookie containing the jsessionid. </p>
  
  <p>This has what I consider to be strange side effects:</p>
  
  <p>On Firefox with cookies disabled, then the cfid, cftoken and jsessionid entered into the URL correctly maintain the session state.</p>
  
  <p>But we also used it with an iPhone App that does accept cookies. Before we fixed it by saving the cookie to local storage, when you closed the App and re-opened it, the cookie was lost. Regardless of the fact that the still valid cfid, cftoken and jsessionid were being sent in the URL, it still gave us a "Not logged in" error.</p>
  
  <p>So I have three questions: </p>
  
  <p>Firstly, when using J2EE sessions, are there any circumstances where I need to store and re-send the cfid and cftoken?</p>
  
  <p>Secondly, is there an Application level setting I can use to force the jsessionid to be stored manually, and not use a cookie?</p>
  
  <p>Thirdly, at which stage is a jsessionid picked up and the session variables populated from memory? Is this something I can debug or interrogate, so I can put something in to say</p>
  
  <pre><code>if jsessionid refers to a current, valid session {
      ...
  }
  </code></pre>