Am I using J2EE or ColdFusion session variables?

Question

Is there anyway in your code to specify using J2EE session management instead of ColdFusion session management or is it controlled completely through the ColdFusion administrator?

Also, what problems might arise if you turn off J2EE session management through the ColdFusion administrator?

Answer 1

No, you can't programmatically change the way in which ColdFusion provides access to session variables.

If you deselect "Use J2EE session variables" CF will drop back to using CFID/CFTOKEN as a way to identify your browser session. I think you'll find that using the J2EE method of referencing your session is considered more secure and therefore is preferred.

Answer 2

While you can enable or disable session management via the cfapplication / Application.cfc files, setting the type of session appears to require access to the admin AND a server restart: http://kb2.adobe.com/cps/182/tn_18232.html

Even the admin API doesn't appear to help here.

As for problems: just try it on a dev/test server first and see - I've never tried it.