CFAjax
 
[ Home ]    [ Examples ]    [ Project / Download ]    [ FAQ / How To]    [ Docs/Articles]    [ About Me ]

CFAjax performing Client Authentication using CF Session

Example
Select a State :


Session does not created!
Enter Your Name :

Whats happening?

In this example CFAjax function is checking for session information before it executes the CF function. In order to test this functionality first click on the “Load State Info” button, you will get an alert messaging saying “Authentication failed”. Now go ahead and enter your name in the text box and create a session, this will basically post the page to itself and establish the CF session. Now if you click on the “Load Sate Info” button, you will be quite amazed to see the same content that you must have see in previous examples :-)

How does this example works?

The first part of the code is to create the session, which is very straight forward CF code. get the user input once user clicks the button create the CF session, not going to go in detail as this is very basic for CF developer. 
<cfif cgi.REQUEST_METHOD  EQ "POST">
	<cfif isDefined("form.btnAction") AND form.btnAction EQ "Delete Session">
		<cfif isDefined("session.name")>
			<cfset session.name = "">
		</cfif>
	<cfelse>
		<cfif form.name NEQ "">
			<cfset session.name = form.name>
		</cfif>
	</cfif>
</cfif>
When Load State Info button is clicked getCounty() JavaScript function is called to make the CFAjax call. The getCounty function looks like this: 
	function getCounty()
	{
		var state = DWRUtil.getValue("state");
		DWREngine._execute(_cfscriptLocation, null, 'stateinfoSessionAuthentication', state, getCountyResult);
	}
getCounty function first gets the value of state selected , and then calls DWREngine._execute method which in turn calls stateinfoSessionAuthentication coldfusion function with the parameter as state code. The DWREngine parameters are explained below: 
	_cfscriptLocation -> location of the coldfusion file that has the function implementation
	null, -> Default value
	'stateinfoSessionAuthentication', -> Coldfusion function to be called
	state -> State code for which we need the county listing
	getCountyResult, -> Javascript function that will be called after countylookup CF function has been executed
Coldfusion function stateinfoSessionAuthentication takes one argument state and return the information related to that state. But the important information to look at is the hint section “ hint="sessioncheckfunction=checkSessionExists" Here the hint is telling the CFAjax engine that a session check has to be preformed and the user defined function that will perform the session validation is “checkSessionExists” Listed below is the CF code: 
<cffunction name="stateinfoSessionAuthentication" hint="sessioncheckfunction='checkSessionExists'">
	<cfargument name="state" required="yes" type="string">
	<cfreturn getStaticStateInfoString(state=arguments.state)>
</cffunction>
This is the user defined CF function that is checking for the session variable and return true and false based upon the condition. This function can has any amount of code and logic but the function should return true if the user has the permission to execute the function and false if access should be denied. 
<cffunction name="checkSessionExists" returntype="boolean">
	<cfif isDefined("session.name") AND session.name NEQ "">
		<cfreturn true>
	<cfelse>
		<cfreturn false>
	</cfif>
</cffunction>

IMPORTANT
The important thing about session check is that, CF developer will have to create a separate function that performs session check and pass it to the hint attribute sessioncheckfunction='whateverCFfunction'. The rational for this decision is that each application has its own criteria of session validate i.e. the variable they are checking for some app want UserId should exist, other want username to exist in session. So its better to leave the decision on the hand of App developer in terms of what they want to check in session scope rather then making CFAjax check for specific variables.

If client request is denied due to not non existence of session, the client will see alert box saying Session Authentication failed. This is the default message that shows up. But you can always override the message and present the customer with your own custom made message or don’t show anything at all. To override the default authentication fail message you can define a javascript function in your code like this. 

function myErrorHandler(message)
{
	alert(‘not session, no fun’);
}

DWREngine.setSessionAuthenticationFailureHandler(myErrorHandler);
Now anytime session authentication fails, a JavaScript alert will show up with the message ‘not session, no fun’

When the coldfusion method returns data, getCountyResult JavaScript function gets executed with displays the text in the info span: 

	function getCountyResult(result)
	{
		document.getElementById("info").innerHTML = result;
	}