title: Logging in and session.isLoggedIn variable not always created
body: <p>I have a user login page for id &amp; password.  This is passed to my authenticate file that does the standard lookup for the user.  A successful login creates a session variable isLoggedIn and a userStruct with profile related data and then continues on to the welcome screen.  Within the welcome screen is a cfinclude to check if the session variable isLoggedIn is defined (as is the case in all pages).  If isLoggedIn is not there the user is redirected back to login.
  This has been working just fine for the last 2 years but after an internal scan identified the following Adobe security issues
  1. CSRF vulnerability in Adobe ColdFusion 8.0,8.0.1,9.0, and 9.0.1 <a href="http://kb2.adobe.com/cps/907/cpsid_90784.html" rel="nofollow">http://kb2.adobe.com/cps/907/cpsid_90784.html</a>
  2. XSS vulnerabilities in the administrator console <a href="http://kb2.adobe.com/cps/890/cpsid_89094.html" rel="nofollow">http://kb2.adobe.com/cps/890/cpsid_89094.html</a></p>
  
  <p>I applied the security patches.</p>
  
  <p>We have also updated Firefox to v.6 - though the problem occurs in IE as well.</p>
  
  <p>Now, for some reason and there is no consistency, if you attempt to login it will return you back to the login screen.  I have traced it to the check of the session variable mentioned above.  I have checked the Db and it shows the users last login time has been updated to reflect the attempt to login.  However, for some reason the session variable is not being created.
  If you clear your browser cache and restart your browser it will allow you to login as expected but after a period of time the issue returns.
  I could login in on Saturday but then could not on Monday.  I cleared my cache and was able to login.  I had no problem Tuesday - multiply logins through out the day.  Then this morning it returned and I wasn't able to login again.</p>
  
  <p>For testing purposes I did a roll back of the security patches and the problem went away but obviously I cannot leave it that way.  I re-applied the patches and the issue returns and again with no consistent pattern.</p>
  
  <p>Does anyone have any idea(s) they can pass along?</p>