Question

Are there any benefits to ColdFusion sessions vs J2EE sessions?

The ColdFusion session documentation mentions the benefits of J2EE sessions, but not any advantages of ColdFusion sessions. J2EE sessions have been available since ColdFusion MX (released in 2002), but there are still a lot of people using standard ColdFusion sessions. Are there any disadvantages of J2EE sessions that aren’t present with ColdFusion sessions?

J2EE session management provides the following advantages over ColdFusion session management:

• J2EE session management uses a session-specific session identifier, jsessionid, which is created afresh at the start of each session.
• You can share session variables between ColdFusion pages and JSP pages or Java servlets that you call from the ColdFusion pages.
• The Session scope is serializable (convertible into a sequence of bytes that can later be fully restored into the original object). With ColdFusion session management, the Session scope is not serializable. Only serializable scopes can be shared across servers.

Therefore, consider using J2EE session management in any of the following cases:

• You want to maximize session security, particularly if you also use client variables
• You want to share session variables between ColdFusion pages and JSP pages or servlets in a single application.
• You want to be able to manually terminate a session while maintaining the client identification cookie for use by the Client scope.
• You want to support clustered sessions; for example, to support session failover among servers.

Answer 1

One of the main disadvantages of J2EE session variables in ColdFusion is that changes such as making them “secure” cookies takes place instance wide.

This means that every site that is running on that instance must run under https, including ColdFusion administrator itself. For servers that host multiple sites that require sessions, this will generally be problematic. Additionally, if you’re running the ColdFusion Administrator from the built in web server, there’s a bit of a process to get that working under ssl.

If you need the documented advantages of J2EE cookies, and need the cookie to be secure then all sites that requires sessions must be on https.

If you don’t need any of the documented advantages of J2EE cookies, and you’re running CF9 or later, then you’re better off going with ColdFusion cookies.

Note that Railo still has the same issue but with more flexibility since the cfapplication tag has a sessiontype attribute where you can choose between j2ee or cf session cookies on a per site basis.