Question

Is there any way to load a specific user session by providing the correct value of CFTOKEN and/or CFID?

Something like php’s session_id($id) function.

Or some way to change data of an specific session.

I need a webservice that will add or change some information on a specific user session. I know the CFID and CFTOKEN values because I share a subdomain cookie. However applications are on different servers

Answer 1

Not that it’s the best way of doing things, as it uses undocumented code that can change without notice between versions. But you can use certain methods to access sessions.

<cfscript>
    appName = 'zadsApp';
    jSessTracker = CreateObject('java', 'coldfusion.runtime.SessionTracker');
    appSessions = jSessTracker.getSessionCollection(JavaCast('string', appName));
    targetSession = appSessions[appName & '_' & sessionCFID & '_' & sessionCFTOKEN];
    // Dumping, reading, writing WILL update the last accessed time.
    // There are ways around this if needed...
    WriteDump(targetSession);
    targetSession.something = 'A new value';
</cfscript>

Now you mention that this is on a different server, can I just double check that you want a seperate server to change a session on another server? Without putting any kind of code like the above on that server (the one with the session)? Although it’d be a heck of a lot easier if the code was on the same server, you might be able to perform code like this remotely using JMX… but I’m sure there must be an easier way to do all of this.