It took me a bit of searching to learn that this below is no longer the correct way to inject a sessionstorage:
Wow, looks like that page got overlooked in our docs and never updated. Also, it seems you’re one of the first people to notice it (and let us know).
I learned through mostly trial and error that I had to first call the get() method on the provider to get to the object specified in the property.
Now this is a very recent change. Luis recently came out with a new version of the cbstorages library where he refactored all the getVar() and setVar() calls to just get() and set(). I assume it was an unintended consequence that this would interfere with any use cases where a provider was used, as providers are an “empty” placeholder CFC with a get() method that retrieves the provided instance. Providers also have an onMissingMethod() method that proxies calls directly to the provided object, but obviously that never fires if you have a method called “get()” on the provided object.
It’s also worth noting, providers aren’t required in every case. Only when injecting a model from a module into an interceptor in the base app due to the fact that core interceptors are created PRIOR to modules being loaded so it’s a chicken/egg issue. The provider defers the creation of the actual injected instance until later when you actually use it. So if you use SessionStorage elsewhere in your app like a handler or a view, no provider is needed there.
I am surprised I found no examples of this when I searched this group or other resources,
That’s because Luis just released cbstorages 2.0.0 in September which was very recently and very few people are probably using it since all existing ColdBox apps wold be on 1.x and even a CommandBox “package update” won’t pull a major (breaking) version bump unless you do so explicitly. You may be the very first person to stand up a new app, install the latest cbstorages, and use it from an interceptor in the last 1.5 months 
It seems like this is not cached and the sessionStorage object is getting created on every fire of the isLoggedIn call?
Not quite. All that the provider does is call getInstance() to acquire the instance from WireBox as-needed. Whether or not the instance is created fresh depends on the scope of that instance. For example, if you’re getting a singleton, it is not re-created, WireBox simply grabs it from the singleton scope and returns it. The sessionstrorage CFC is a singleton, so it’s only created once.
https://github.com/coldbox-modules/cbstorages/blob/development/models/SessionStorage.cfc#L12
I also tried to put the creation of the provider in the init() but that failed as well…
I don’t know what you mean by “creation of the provider” without seeing some code, but if you were trying to use an injected provider then that won’t work as init() is called prior to injections being processed. If you want to use injected properties, create an onDIComplete() method in your interceptor and use it there. Constructor injection would also work.
Is there a better, more standardized way to make the example work in CB 5+?
No, not really, but I agree it’s annoying that
- Our example is 2 major versions behind
- Using a CFC with a get() method inside a provider is a pain.
One of the ideas we have for ColdBox (currently in development) is to rename the provider’s get() method to something like _get() so it doesn’t interfere with “real” get() methods on the provided instances.