Hi Everyone,

I have an application that uses coldfusion's session management (instead of the J2EE) session management.

We have one client, who has recently switched their company's traffic to us to come viaa proxy server in their network.

So, to our Coldfusion server, it appears that all traffic is coming from this one IP Address, for all of the accounts of this one company..

Of the session variables, Part 1 is kept in a cflock, and Part 2 is kept in editable session variables. I may be misundestanding, but we have done it this way as we modify some values as needed throughout the application's usage.

We are now running into an issue of this client having their session variables mixed up (?). We have one case where we set a timestamp.. and when it comes time to look it up, it's empty. From the looks of it this is happening because of another user on the same token.

My initial thoughts are to look into modifying our existing session management to somehow generate a unique cftoken/cfid, or to start using jsession_ID, if this solves the problem at all.

I have done some basic research on this issue and couldn't find anything similar, so I thought I'd ask here.

Thanks!