nomadinjax/esapi4cf

Investigate session invalidation

Opened this issue · 3 comments

nomadinjax commented

session invalidation needs to be researched to ensure it is 1) working as expected, 2) if there is a way to invalidate a session under just 1 CF app, not all. Could the path on the jsessionid cookie be used for this?

nomadinjax commented

Update the SafeSession methods: getAttribute and setAttribute to look within the CF session (applicationname) similar to how the invalidate method is currently working.

nomadinjax commented

The SafeSession methods, getAttribute, getAttributeNames, etc are unrelated to this issue... opening new ticket... #62