Ask Ben: Creating Single Location Logins

<cfcomponent
	output="false"
	hint="I provide application level event handlers and settings.">

	<!--- Define the application settings. --->
	<cfset THIS.Name = "SingleLocationSessionDemo" />
	<cfset THIS.ApplicationTimeout = CreateTimeSpan( 0, 0, 5, 0 ) />
	<cfset THIS.SessionManagement = true />
	<cfset THIS.SessionTimeout = CreateTimeSpan( 0, 0, 5, 0 ) />


	<cffunction
		name="OnApplicationStart"
		access="public"
		returntype="boolean"
		output="false"
		hint="I run when the application is being (re)initialized.">

		<!---
			Clear the application scope (in case we are
			re-initializing rather than booting up for the
			first time).
		--->
		<cfset StructClear( APPLICATION ) />

		<!---
			Create a structure to hold onto the unique session
			keys (based on user ID). For this demo, I am caching
			in-memory, but in a large app, this would probably
			be a database table.
		--->
		<cfset APPLICATION.SessionKeys = {} />

		<!--- Return continue-loading flag. --->
		<cfreturn true />
	</cffunction>


	<cffunction
		name="OnSessionStart"
		access="public"
		returntype="void"
		output="false"
		hint="I run when the session is being (re)initialized.">

		<!--- Define the local scope. --->
		<cfset var LOCAL = {} />

		<!--- Cache the ID/Token so that we don't lose them. --->
		<cfset LOCAL.CFID = SESSION.CFID />
		<cfset LOCAL.CFTOKEN = SESSION.CFTOKEN />

		<!---
			Clear the session scope (in case we are
			re-initializing rather than booting up for the
			first time).
		--->
		<cfset StructClear( SESSION ) />

		<!---
			Re-set the ID/Token values to maintain session
			hooks properly.
		--->
		<cfset SESSION.CFID = LOCAL.CFID />
		<cfset SESSION.CFTOKEN = LOCAL.CFTOKEN />


		<!--- Param the default values of the user. --->
		<cfset SESSION.User = {
			ID = 0,
			SessionID = "",
			LoggedIn = false
			} />

		<!--- Return out. --->
		<cfreturn />
	</cffunction>


	<cffunction
		name="OnRequestStart"
		access="public"
		returntype="boolean"
		output="false"
		hint="I run when the request is being initialized.">

		<!--- Define arguments. --->
		<cfargument
			name="Page"
			type="string"
			required="true"
			hint="I am the template being requested."
			/>

		<!--- Define the local scope. --->
		<cfset var LOCAL = {} />

		<!---
			Check to see if the application is being reset
			manually with a URL flag.
		--->
		<cfif StructKeyExists( URL, "reset" )>

			<!--- Manually reset app and session. --->
			<cfset OnApplicationStart() />
			<cfset OnSessionStart() />

		</cfif>


		<!---
			Check to see if this user is logged in at all. We
			only care about checking the single-location session
			if they are logged-in.
		--->
		<cfif SESSION.User.LoggedIn>

			<!---
				Now that we know this user is logged-in, we need
				to check to see if their login is still valid.
				Because we are reading / writing to this share
				data in multiple places, this feels like it might
				be an appropriate place for a lock. To limit the
				bottle-necking affects of the lock, I am making
				it session-id-based.
			--->
			<cflock
				name="login-check-#SESSION.User.ID#"
				type="exclusive"
				timeout="5">

				<!---
					Check to see if the current session is the
					ACTIVE session location for this user. In
					order for that to be true, the session-cached
					ID must be the same as that cached in our
					APPLICATION.
				--->
				<cfif (
					(NOT StructKeyExists( APPLICATION.SessionKeys, SESSION.User.ID )) OR
					(APPLICATION.SessionKeys[ SESSION.User.ID ] NEQ SESSION.User.SessionID)
					)>

					<!---
						Either the user's session ID has not been
						cached in the APPLICATION yet, OR this
						same user has signed on in a different
						location, rendering the current session
						as NO LONGER VALID.

						Make sure to flag this user as being no
						longer logged-in. In our simple demo,
						this is denoted by the user ID and
						logged-in flag.
					--->
					<cfset SESSION.User.ID = 0 />
					<cfset SESSION.user.LoggedIn = false />

				</cfif>

			</cflock>

		</cfif>

		<!--- Return continue-loading flag. --->
		<cfreturn true />
	</cffunction>


	<cffunction
		name="OnRequest"
		access="public"
		returntype="void"
		output="true"
		hint="I execute the appropriate page template.">

		<!--- Define arguments. --->
		<cfargument
			name="Page"
			type="string"
			required="true"
			hint="I am the template being requested."
			/>

		<!---
			Check to see if this user is logged-in. If so, then
			include the requested template. If not, then include
			the login page (unless of course the user is already
			requesting the login-style pages (including the login
			processing page).
		--->
		<cfif (
			SESSION.User.LoggedIn OR
			REFind( "login(_process)?\.cfm$", CGI.script_name )
			)>

			<!--- Include requested page. --->
			<cfinclude template="#ARGUMENTS.Page#" />

		<cfelse>

			<!---
				The user is not logged-in. So, no matter what
				template they requested, force them to view the
				login page.
			--->
			<cfinclude template="login.cfm" />

		</cfif>

		<!--- Return out. --->
		<cfreturn />
	</cffunction>


	<cffunction
		name="OnSessionEnd"
		access="public"
		returntype="void"
		output="false"
		hint="I run when the session is being ended.">

		<!--- Define arguments. --->
		<cfargument
			name="Application"
			type="struct"
			required="true"
			hint="I am the application scope used by the session."
			/>

		<cfargument
			name="Session"
			type="struct"
			required="true"
			hint="I am the session scope used by the session."
			/>

		<!---
			Clear out the session ID tracking from the
			application. This will make sure that the session
			ends at all locations.
		--->
		<cfset StructDelete(
			APPLICATION.SessionKeys,
			ARGUMENTS.Session.User.ID
			) />

		<!--- Return out. --->
		<cfreturn />
	</cffunction>

</cfcomponent>

<!---
	Because this is just a demo, we are going to hardcode the
	user ID so that all demo users are the same user. The session
	key will be auto-generated for us.
--->
<cfset SESSION.User.ID = 4 />

<!---
	Create a unique ID to make sure there is no chance that
	another location instance of this user will have the same
	session ID.
--->
<cfset SESSION.User.SessionID = CreateUUID() />

<!--- Flag user as logged-in. --->
<cfset SESSION.User.LoggedIn = true />


<!---
	We need to update the session-cache using the user ID and
	the new session ID.

	NOTE: Because this is a part of the application where race
	conditions might actually apply, I am going to lock this
	area. To make this less of a bottle-neck in the system, I am
	going to make the name of the lock based on the session ID.
--->
<cflock
	name="login-check-#SESSION.User.ID#"
	type="exclusive"
	timeout="5">

	<!--- Cache this single-location session ID. --->
	<cfset APPLICATION.SessionKeys[ SESSION.User.ID ] = SESSION.User.SessionID />

</cflock>


<!--- Redirect to home page. --->
<cflocation
	url="./index.cfm"
	addtoken="false"
	/>

<!---
	We need to remove the session key from the APPLICATION cache
	so that this user is fully logged out in every location. Now,
	again, I don't really think locking here is necessary, but
	the more complex the inner workings of this, the more it may
	be worth while.
--->
<cflock
	name="login-check-#SESSION.User.ID#"
	type="exclusive"
	timeout="5">

	<!---
		Reset the user and erase it from the application's
		session cache.
	--->
	<cfset StructDelete(
		APPLICATION.SessionKeys,
		SESSION.User.ID
		) />

</cflock>


<!--- Reset the user. --->
<cfset SESSION.User.ID = 0 />
<cfset SESSION.User.LoggedIn = false />

<!--- Redirect to homepage. --->
<cflocation
	url="./index.cfm"
	addtoken="false"
	/>