CLIENT variable issues

[csteinhilber]

We're running into some severe problems with CLIENT variables in the latest MX release.

The problem being... other user's values for those vars are associated with the current user.

In other words; when User A submits a form, I store a client var named "email" with the value they submitted in the form's email field. When User A revisits a similar form, if the client variable "email" exists, I pre-populate the field on the form with the value.

But every so often, User B-Z emails our webmaster that they're actually seeing the email field on their current form pre-populated with User A's value.

We've verified that all users involved have cookies enabled (and if they didn't, our code would not pre-populate the fields anyway). And the CFID's appear to be different.

It really looks like ColdFusion is just flaking, and pulling the wrong values from the client store (which is currently set to an Oracle database).

Is anyone else having similar problems? Anyone find a fix or workaround?

TIA!

-Carl

 

[noyes99]

bad caching may be?

 

[csteinhilber]

No caching at all on our forms.


-Carl

 

[Wes98765]

The problem has to be with the creation of the cookie check for any changes in cf MX cfcookie tag that may not be used anymore. You can also try running a code check in the cf administrator. The server does not have the cookie information, that information is stored on the clients pc. So there is no way for the server to display incorrect data.

Hope this helps

Wes

 

[csteinhilber]

I'm not following you, Wes.

We're not doing any sort of cookie check in our code. ColdFusion is supposed to do all that internally... matching it's CFID and CFTOKEN cookies against rows in the client var data store and pulling the appropriate data. There really isn't much that you can do in code to affect it (unless you query the store table directly)... you're either setting CLIENT variables, or reading CLIENT variables... there's no CFCOOKIE tag involved... so I'm not sure what a code check would do for us.

But I'm with you... there should be "no way for the server to display incorrect data"... and yet, it's happening.

Interestingly, though... all the end users that are experiencing these issues are "international" users. Our servers are in North America, and we're getting reports from folks in Germany, Norway and Sweden. They all go to the same domain, though (ie - there's no

http://www.oursite.dk...

just

http://www.oursite.com)...

so that really shouldn't be an issue.




-Carl

 

[cybermud]

Carl:

Did you ever find a resolution to this? I am having the same problem in 4.5 SP2...user A tells the tite to remember login information, which is stored in the cdata table, then user B & C go to the site and sees user A's information there and can log in as user A. This has only happened with two users as far as I know...I am probably going to just turn off the ability to remember login information, as I can find no reason why this would hapen.

Erik

 

[csteinhilber]

Erik,

Nope, never found a resolution. It started happening more and more, despite everyone I talked to saying "that can't happen".

So we had to disable the feature.
Not what you wanted to hear, I'm sure (it sure isn't what we wanted to hear)... but it's definitely a problem deep in the core of MX that I, as a CFML developer, have no control over, so there wasn't any other choice.

-Carl


-Carl

 

[siituser]

I've seen this happen as well in our app. We are running MX as well. I've been deleting the extra client vars whenever possible. Our app has a main page that deletes all but a few cliet vars we use for security. I've also found that deleting the temp. internet cookies helps at times. Also check to see if people are running multiple windows of the app. I've had to start making people run one in IE, Opera, etc.

I'm also having problems where a variable will not get set. Once you go back and try it again, it works. Frustrating but I'm going to try playing with some cfcatch statements to handle those errors.

 

[cybermud]

Carl:

I ended up disabling the 'remember my login info' feature as well...thanks for the reply.

Erik

 

[webmigit]

First the standard shameless plug: faq232-2568 .. deals with the well-known similar issues in sessions, could be adapted.

Second are you sure its not storing client vars in a db on the server.. or in the registry.

Here's my theory though.. whether or not its a setting, it is storing something there and playing off that key.

We all know that's the only way this is possible.. You don't visit someone else's computer by visiting the same website.

Anyway, having never seen this bug, that's all I can tell you to look for.

ALFII.com

http://www.alfii.com

---------------------
If this post answered or helped to answer your question, please reply with such so that forum members with a similar question will know to use this advice.