User Guide

Table Of Contents
Configuring and using session variables 353
J2EE session management provides the following advantages over ColdFusion session
management:
J2EE session management uses a session-specific session identifier, jsessionid, which is
created afresh at the start of each session.
You can share session variables between ColdFusion pages and JSP pages or Java servlets that
you call from the ColdFusion pages.
The session automatically ends when the user closes all browser windows.
The Session scope is serializable (convertible into a sequence of bytes that can later be fully
restored into the original object). With ColdFusion session management, the Session scope is
not serializable. Only serializable scopes can be shared across servers.
Therefore, consider using J2EE session management in any of the following cases:
You want to maximize session security, particularly if you also use client variables
You want to share session variables between ColdFusion pages and JSP pages or servlets in a
single application.
You want to be able to manually terminate a session while maintaining the client identification
cookie for use by the Client scope.
You want to support clustered sessions; for example, to support session failover among servers.
Configuring and enabling session variables
To use session variables, you must enable them in two places:
ColdFusion MX Administrator
The Application.cfc initialization code This.sessionManagement variable or the active
cfapplication tag.
ColdFusion MX Administrator, Application.cfc, and the
cfapplication tag also provide
facilities for configuring session variable behavior, including the variable time-out.
Selecting and enabling session variables in ColdFusion MX Administrator
To use session variables, they must be enabled on the ColdFusion MX Administrator Memory
Variables page. (They are enabled by default.) You can also use the Administrator Memory
Variables page to do the following:
Select to use ColdFusion session management (the default) or J2EE session management.
Change the default session time-out. Application code can override this value. The default
value for this time-out is 20 minutes.
Specify a maximum session time-out. Application code cannot set a time-out greater than this
value. The default value for this time-out is two days.