11 of 14

If you're converting an existing application - back up your application first please! - perform a global, case-insensitive find (notice I did not say replace!) for all occurrences of "Session." in all of your ColdFusion templates within your application. Inspect each occurrence to make sure that the text string "Session." is actually referring to a session variable, making notes of the exceptions. (For example, a sentence on your template might read "Click Log Out to terminate your session." With a global replace, this would end up reading "Click Log Out to terminate your Client."!) While this process can be tedious (checking all the session variables in your application before replacing them all could mean opening almost every page in the application), it will be rewarding knowing exactly what has been changed when you do finally perform the global replace.

After making note of the exceptions (if any), perform a global replace, replacing all occurrences of "Session." with "Client." Return to the pages where you noted exceptions and change them back to the proper text.

Managing Session Timeout
Client variables are set to expire after a certain number of days. This may not be appropriate for certain variables of your application. For example, perhaps your session variable for "IsLoggedIn" used to time out after 20 minutes because it was a session variable. If users closed their browsers without logging out (a common problem), you couldn't guarantee that they were logged out, but at least you'd know that eventually their session variable would expire after a reasonable time. In contrast, the default client variable setting would only remove the client variable after 10 days - they could go to your site or application and be logged in already, up to 10 days after they first logged in!

If this is inappropriate for your application, there are a several options. In one application I designed, I actually ran two additional "hidden frames" in addition to the pages of the application. One loaded a page that kept the session alive using a META refresh tag (for user convenience - so they wouldn't time out as long as they kept their application open). The other frame loaded a page that contained some JavaScript. The script executed a logout routine and logged users out when they left the site or closed their browsers ("onUnload"). This is a very reliable method if you have some control over the user environment (this particular application ran on an intranet where Internet Explorer 5 with JavaScript and cookies was a requirement for the organization).