SESSION and browser close

[grease]

I have written a shopping cart application which kills all SESSION vars when
the browser is closed. However, despite it working correctly on my local
development server, once uploaded to thte live environment, it maintains the
SESSION which, in a shoppingcart application provides a security risk. I have
used the tried and tested 'session killer' but no joy... can anyone suggest a
possible cause? I have contacted the host to see if their CF servers run on
J2EE, which I have read could be a possible cause.

[vkunirs]

can you explain how you are expiring the session when the user closes the brwoser with out logout.

[ben]

Even if it did work (how does the server know that the browser was
closed?), the security risk persists. Some people don't close their
browser but surf on to other sites and then leave the browser open to go
for a coffee. How would the server know that the user is doing something
else and therefore the session should be closed?

They only solution I see in this case is to time-out the session after a
certain period of inactivity on the shopping site.

ben

grease wrote:

> I have written a shopping cart application which kills all SESSION vars when
> the browser is closed. However, despite it working correctly on my local
> development server, once uploaded to thte live environment, it maintains the
> SESSION which, in a shoppingcart application provides a security risk. I have
> used the tried and tested 'session killer' but no joy... can anyone suggest a
> possible cause? I have contacted the host to see if their CF servers run on
> J2EE, which I have read could be a possible cause.
>