I came across a rather frightening problem in ColdFusion MX 6.1. I don't know if this is a problem across the board, or if it is a problem with my particular configuration (IIS 5, Win 2000 Server, CF MX 6.1). Sessions have been corrupted when a CFC instance is stored in multiple sessions. Technically, this should never happen. The following describes the situation.

I have a CFC that acts as a user object. The user object holds properties for that user (logged in, cart contents, etc) and has methods dealing with each of those properties. I create the CFC instance and store it in a session variable. This seems to work well for the object persistence. The problem I was running into was when more than one user was logged in: sometimes the second user would add something to a cart and it would end up in the first user's session!

I've traced all the code and found no problems. All database interaction is done through the CFC. All CFC methods use "this" to address their properties.

Luckily it was on a beta site with no critical data. I've put <cflock> tags around all session writes, and that seems to have nipped the problem in the bud, but this should not happen. Has anyone else run into this as a possible bug?