RE: [coldbox:18326] Urgent Issue Session Persistence Problem

Communities ColdBox HMVC
1

Here’s the original thread:

https://groups.google.com/forum/?fromgroups=#!topic/coldbox/UQtQ75advd4

The resolution was a web proxy caching HTTP headers so multiple people shared the same cookies. I’d troubleshoot that first. Create a test page that outputs the session ID and have both people hit it to confirm they actually have different sessions. If that’s not the issue, I’d check for var scoping or scope-widening injection issues. Examples would be bleed over of data during concurrent requests or storing a session-scoped object inside a singleton.

Thanks!

~Brad

ColdBox Platform Evangelist
Ortus Solutions, Corp

E-mail: brad@coldbox.org
ColdBox Platform: http://www.coldbox.org
Blog: http://www.codersrevolution.com

2

Brad - Really good points.

This was an absolute nightmare to troubleshoot. Luis and Aaron Greenlee both helped us dig into our code to find any issues. (Thanks again guys!)

To add some additional context of our problem…

We really relied upon our activity logging to verify/narrow this problem and the solution. We found the problem only occurred within a single block of IP addresses – definitely caused us to consider the proxy.

Though we are extremely careful about var scoping issues, when trying to diagnose this problem we did find a handful of improperly scoped variables. It would be very easy have one of these cause some nasty problems.

Good luck!
-Ben

3

Hey All,
Just an update…

I think I found the problem, I had been storing a singleton in session…
From what I have been reading… and please correct me if i’m wrong… A singleton is stored in an “application-like” scope… Thus when the next person logged in… accessed the “user” singleton and changed the properties, it would change it for everyone who had a reference to that same “user” singleton in their session…

I changed the scope on the injected “user” object to session, and have not been able to replicate the problem…

Thanks for the help! I think it was that reference to “session-scoped inside a singleton” that go me questioning what I thought I knew!

Thanks for the help folk,
Dom