The Same CFID-CFTOKEN Values Are Used Across ColdFusion Session Timeouts

<cfcomponent
	output="false"
	hint="I set up the application settings and event handlers.">
 
	<!--- Application settings. --->
	<cfset THIS.Name = "TimeoutCookieTest" />
	<cfset THIS.ApplicationTimeout = CreateTimeSpan( 0, 0, 5, 0 ) />
	<cfset THIS.SessionManagement = true />
	<cfset THIS.SessionTimeout = CreateTimeSpan( 0, 0, 0, 10 ) />
 
 
	<cffunction
		name="OnSessionStart"
		access="public"
		returntype="void"
		output="false"
		hint="I fire when a session needs to be initialized.">
 
		<!--- Log session stsart. --->
		<cffile
			action="append"
			file="#ExpandPath( './log.txt' )#"
			output="Started: #SESSION.CFID#-#SESSION.CFTOKEN#"
			addnewline="true"
			/>
 
		<!--- Return out. --->
		<cfreturn />
	</cffunction>
 
 
	<cffunction
		name="OnSessionEnd"
		access="public"
		returntype="void"
		output="false"
		hint="I fire when a session needs to be ended.">
 
		<!--- Define arguments. --->
		<cfargument
			name="Session"
			type="struct"
			required="true"
			hint="I am the expired session scope."
			/>
 
		<!--- Log session stsart. --->
		<cffile
			action="append"
			file="#ExpandPath( './log.txt' )#"
			output="Ended: #ARGUMENTS.Session.CFID#-#ARGUMENTS.Session.CFTOKEN#"
			addnewline="true"
			/>
 
		<!--- Return out. --->
		<cfreturn />
	</cffunction>
 
</cfcomponent>

For Cut-and-Paste