Logged in as another user - how is this happening?

[programmher]

From time-to-time, some of my users can see another user's session when they use their "back" button. How is this happening and how can I remedy it? These other users have NEVER been logged in to the other machines. I suspect expired sessions are being accessed and viewed but am not sure how or why this is happening.

 

[Guest_imported]

I guess the time limit for your session varaibles to expire is pretty long or may be that the session varaibles do not expire when the user closes the browser.I have done something like this, while defining my session variables:

<CFAPPLICATION NAME=&quot;LabNavigator&quot; SESSIONMANAGEMENT=&quot;Yes&quot;>

<cflock timeout=&quot;30&quot; Name=&quot;#Session.SessionID#&quot; Type=&quot;Exclusive&quot;>
<cfcookie name=&quot;CFID&quot; value=&quot;#session.CFID#&quot;>
<cfcookie name=&quot;CFTOKEN&quot; value=&quot;#session.CFTOKEN#&quot;>
</cflock>

 

[tleish]

The problem stems from not using <CFLOCK>. To better understand this, here's an excellent article about the need for <CFLOCK> and how to use it.

http://vboston.com/DepressedPress/Content/ColdFusion/Guides/Locking/Index.cfm

- tleish