Please explain how Session Variables work

I've used SecurityAssist to build my Registration and Login pages. On the Login page I have added to the SecurityAssist Authenticate User Server Behavior, on the Session Values tab, a column to set UserFirstName as a Session Variable. After the user clicks login, he is taken to a Welcome page with a nice little "Welcome UserFirstName" at the top of the page. I dragged the UserFirstName from the Bindings panel. When I log in I see a name...but not necessarily the correct name. Sometimes it is correct, sometimes not.

Which leads to my question - isn't a session variable always available for the duration of that session? If it has been set as part of the login process, it should be available until I quit the Browser or close the window, or whatever else constitutes ending a session, correct?

So either it isn't being set properly in the first place or it is somehow being changed (not sure how this is possible). I have attached my login page and my Welcome page. I suspect it is something silly, but I can't seem to locate the problem.

your login page has a pretty big probelm on it.

you have 3 authenticate user behaviors, one at line 11 - 130, the second at line 132 - 149, those are both fine

but the 3rd one at lines 151 - 168 should be deleted.

the way that one is set is to look up the UserLevel session, and set the UserName session based on the user level.

what that means is that the Userfirst Name session being set wont necessarily match the user that is logged in, it match the first record for the logged in user level.

See private message:

yes, you can have index.php as your home page.

delete the index.html and only have the php page.

if the browser is not picking up the index.php page, contact the host, they can add the index.php page to the default list.

I'll do that. I have a problem though. I deleted the code as you instructed. Now when I enter my username and password and click "login" I am taken back to the same page. Essentially, nothing happens. I can't log in. When we deleted that code it caused the login to stop working.

Suggestions?

it's not that login is failing, it's that the success redirect is empty in the authenticate user behavior.

"successRedirect" => "",
"failRedirect" => "login.php?failedLogin=1",


open the server behaviors panel, double click the authenticate user behavior and set the success redirect.