Advanced ColdFusion Session Management

Author: Steven Neiland

Warning: This blog entry was written two or more years ago. Therefore, it may contain broken links, out-dated or misleading content, or information that is just plain wrong. Please read on with caution.

Do you know how many sessions are currently in existence on your ColdFusion server instance? Do you know how many sessions exist for a particular application?

Well two years ago I had to answer this question in order to demonstrate why a 2 day session timeout was a really bad idea to another developer. Fortunately ColdFusion makes getting this information really easy. Not only that, you can expand on this technique to actually manipulate session instances other than your own. So lets get started..

Step 1: Get The Session Tracker Object

The first step is to create a java object instance of coldfusion.runtime.sessionTracker. Doing a dump of this object exposes all the available methods we can use to manipulate sessions.

<cfset sessionTracker = createObject("java","coldfusion.runtime.SessionTracker")>
<cfdump var="#sessionTracker#">

The methods of interest to us are:

  • getSessionCollection()
  • getSessionCount()
  • getSession()

Step 2: Count All Sessions

To get a count of all the sessions is now a simple matter of calling the getSessionCount() method.

<cfset sessionCount = sessionTracker.getSessionCount()>
There are currently <cfoutput>#sessionCount#</cfoutput> sessions in existence on your server instance.

Note: You will note how the text reads "on your server instance". This is because you are getting a count of all sessions across all applications on the server instance, not just the application you are currently in. To get a count of the sessions in a particular application you have to do a little more work.

Step 3: Get The Session Collection For An Application

In order to count the number of sessions in a particular application we must first get the session collection using getSessionCollection(). This method takes in the string name of the application so provided we know its name we can get the session collection of any application on that server instance.

<!--- Get the session collection for any named application --->
<cfset sessionCollection = sessionTracker.getSessionCollection("someAppName")>

<!--- Get the session collection for this application --->
<cfset sessionCollection = sessionTracker.getSessionCollection(application.applicationName)>

Dumping out this object returns a ColdFusion structure holding all the individual session structures for the application.

Step 4: Count The Number Of Session Instances For An Application

Getting the number of sessions for this particular application is now a simple matter of doing a structCount.

<cfset sessionCountForApplication = structCount(sessionCollection)>
<p>There are #sessionCountForApplication# sessions in existence for this application.</p>

Step 5: Get And Manipulate Sessions

Finally we can use the getSession() method to access and manipulate each session using the key name for each session.

<cfloop collection="#sessionCollection#" item="sessionId">            
      <cfset thisSession = sessionTracker.getSession(sessionId)>
      <!--- Create a session scoped variable named age
      with a value of 30 for anyone named steven --->

      <cfif EQ "steven">
            <cfset thisSession.age="12">

As an alternative to using the getSession() method, you can simply use normal session struct key referencing like so.

<cfloop collection="#sessionCollection#" item="sessionId">            
      <cfset thisSession = sessionCollection[sessionId]>
      <!--- Create a session scoped variable named age
      with a value of 30 for anyone named steven --->

      <cfif EQ "steven">
            <cfset thisSession.age="12">

Note On Deleting Sessions

You would think that you could use this technique to delete a session instance but ColdFusion does not seem to allow that. However you can clear the contents of a session using structClear().

<cfloop collection="#sessionCollection#" item="sessionId">
      <cfset thisSession = sessionCollection[sessionId]>
      <!--- Clear the session of anyone named mark --->
      <cfif EQ "mark">
            <!--- Clear the session structure --->
            <cfset StructClear(thisSession)>

I hope this has been useful. Note that these techniques only scratch the surface of what you can do by leveraging ColdFusion's underlying java structure.

Related Blog Postings

Reader Comments

Ron Stewart's Gravatar
Ron Stewart
Wednesday, May 16, 2012 at 10:36:41 PM Coordinated Universal Time

Thanks for posting this; I can see some interesting uses for this from the perspective of building some monitoring/activity tools into apps but also from the standpoint of "pushing" stuff into user sessions.

David Boyer's Gravatar
David Boyer
Thursday, May 17, 2012 at 8:55:57 AM Coordinated Universal Time

You might want to note that as soon as you access any sessions through those methods, you'll update the "lastAccessed" timestamp. Depending on your usage, you may inadvertently keep all those sessions alive for longer that needed or if performing a repeated task, possibly never expiring. Leading to a build up of sessions.

I believe CF8 does have a method called "getValueWIthoutChange" which possibly works around this.

Sami Hoda's Gravatar
Sami Hoda
Wednesday, May 23, 2012 at 9:43:16 PM Coordinated Universal Time

Have to agree with David. Be careful when accessing sessions this way - you change things like the lastAccessed.

Jonathan Smith's Gravatar
Jonathan Smith
Friday, August 10, 2012 at 11:44:46 AM Coordinated Universal Time

Excellent!! This is so much simpler and better than other ways of counting active sessions.

David McGuigan's Gravatar
David McGuigan
Friday, June 14, 2013 at 11:35:57 AM Coordinated Universal Time

Awesome post, thanks!

Mistazam's Gravatar
Thursday, December 12, 2013 at 5:15:37 AM Coordinated Universal Time

Awesome! thanks for the post!

  • Please keep comments on-topic.
  • Please do not post unrelated questions or large chunks of code.
  • Please do not engage in flaming/abusive behaviour.
  • Comments that contain advertisments or appear to be created for the purpose of link building, will not be published.

Archives Blog Listing