Two Important Bugs in the Adobe ColdFusion MX 7.0.2 Release

Double JSESSIONID Values Being Set

If you're using the Enterprise version of ColdFusion MX, you have the option of using the J2EE session variable mechanism rather than the built-in ColdFusion session variable mechanism. If you're not familiar with the difference, read this page in the LiveDocs to understand each option. I'll still be here when you get back -- don't worry.

Now that we're all back, the JSESSIONID is critical to ColdFusion being able to "look up" your stored session structure on each page request. And since I need to be able to replicate sessions in a cluster, which only J2EE session variables support, this is a must-use feature for me. However, when using the internal JRun web server (which you should only use for development), when you request your site's root (i.e., http://www.mysite.com/, ColdFusion wrongly sets two JSESSIONID values, which can cause it to "lose" your session scope on subsequent requests. Here is an example HTTP header that is set on an initial page request to a site root:

See the bug? There is a double Set-Cookie directive that sets not one, but two JSESSIONID values, effectively creating two sessions on your server for every one. This has a nasty side-effect in that more server resources are taken up per user because they technically have two sessions for every one, even though only one is actually used after the initial request. Interestingly, if I were to manually add the index.cfm page to the URL request, i.e., http://www.mysite.com/index.cfm, only one JSESSIONID value is set. So the bug occurs when requesting your site's root document without explicitly typing the desired CFM template. (And yes, if you note the Date value, you'll see just how long I've been trying to figure these bugs out!) Lastly, I should note that when I did a test in my MX 6.1 instance, the same bug exists there. So this isn't exclusive to CFMX 7.

Old DataDirect Drivers Ship with MX 7.0.2, Breaking Client Variable Updates

In my opinion, this bug (and yes, it's a bug) is the much bigger one of the two because this is one that will find its way out to a production environment if you're not aware of it, and has nothing to do with the web server being used. A long story short, Adobe ships the DataDirect 3.3 driver set in the 7.0.2 bits (released on 6/28 of this year), even though the 3.5 driver set was released as a TechNote last October. So much for the point releases being cumulative updates!

You might be wondering why this is such a big deal to me. Well, there are two reasons. First, we use Oracle 10g Release 2, which only the DataDirect 3.5 driver set supports. Second, it turns out that client variable records (in the CDATA and CGLOBAL tables) were not being updated, which meant that once you logged in to our web site (where a few client variables are set) and then clicked to a subsequent page, it would appear as if you had never logged in. The initial insert of the record was working fine (which you can see in the HTTP header sample I pasted above -- it's the CFID/CFTOKEN value), but any updates to the record would silently fail (I say "silently" because ColdFusion handles this for you under the hood, and it doesn't log anything when problems occur). I was going absolutely nuts trying to figure out why it wouldn't update, and the Spy feature of the JDBC drivers (described at the bottom of the aforementioned TechNote) simply wasn't working. After thinking and thinking and thinking, it belatedly occurred to me that the Spy features were only baked in to the 3.5 driver set. So, on a hunch, I ran the CF script below between my MX 6.1 instance (which was working perfectly fine) and the MX 7.0.2 instance to check the driver versions. (Note: The output is written to your log file, so your screen will be blank.)

The MX 6.1 results:

and the MX 7.0.2 results:

After seeing this, I swapped out the old 3.3.48 driver set with the 3.5.13 driver set and everything has been working without issue since.

If anybody on the Adobe ColdFusion team happens to read this, the installer bits need to be updated with the 3.5 driver set. If it passed your regression tests such that it was officially released as a TechNote, then all subsequent "cumulative" updaters and downloadable installers should contain the updated drivers. Further, the fact that the 3.3 drivers ship with MX 7.0.2 means that your System Requirements page is wrong because the 3.3 drivers do not work with Oracle 10g Release 2. Also, please don't call something "cumulative" if it is, in fact, not cumulative. Since I was under the impression that the Updaters were cumulative, it obviously wasn't my first thought to check the JDBC driver version for a regression. Now I need to go back and look at the web connector versions and other items to make sure that those were properly baked in to the latest release. Lastly, If you're not going to update the drivers, then you have to clearly state this in the Release Notes, as there was no mention of this whatsoever.

Anyway, I hope my two weeks of pure frustration helps somebody solve any related setup issues they might be having. Incidentally, my set is ColdFusion MX 7.0.2 on Red Hat Enterprise Linux 4.0 (SELinux turned off) using the internal JRun web server. The above bugs appear in my environment and I do not have a means of testing others. If you'd like to try and confirm these issues in other environments, go ahead and comment back here what you find.

Once last shout out to Jochem van Dieten for sticking with me on my forum thread on this subject. It was very much appreciated.