Session is not a struct?

Question

The error I get is this:

Element USER is undefined in a Java object of type class [Ljava.lang.String;

The lines of code I get this error are when I do anything like this:

SESSION.user.functionName()

It's randomly and I assume is happening after the user's session is expired. My problem is first of all, isn't the SESSION scope always a structure? How/Why does ColdFusion think it's a string.

Regardless, my main problem is I am using CFWheels. All my controllers extend the main Controller.cfc of course and all my controllers (except the public one) filter through a checkLogin function. That function has this in it:

<cfif !structKeyExists(session, "user")>
    <cfif !structKeyExists(params,'layout') || params.layout EQ true>
                <cfset redirectTo(route="home",error="You must be logged in to continue.") />
    <cfelse>
        <cfset flashInsert(error="You session has expired and you must login to continue. <a href=''>Reload the Page</a> to login.") />
        <cfset redirectTo(controller="Shared",action="ajaxError") />
    </cfif>
</cfif>

In this part of the function, I explicitly check if user exists in the session and if it doesn't one way or the other I'm sending them somewhere else. How on earth does the code get past this part to then fail when the session is somehow a string?

Not to mention there are various other places before I get to the error line where I'm making sure various things in the SESSION.user object are correct.

Answer 1

What was happening was on ajax requests. Some ajax requests load reports and such that can take several seconds to query, especially before some caching takes place. If a user executes an ajax call and then logs out, technically the request could make it through all my permission checking to get to the controller (it takes just milliseconds) but in the controller while fetching data from the models the user is logged out.

Then by the time the view is ready to load, the Session is cleared. If I use anything from the session scope there, it errors out.

I think I'll fix this by adding a filter that runs after the controller action to check if the session scope is still there. If it's not I'll just abort the request. I don't have model logic in any of my views, but I sometimes reference methods in the SESSION.user scope. Probably not purist MVC.

On the cases where the logout happens before parts of the controller are complete, I'll just let those errors happen as they may and ignore them, knowing the user really isn't seeing it happen.