So this weekend, Bruce Phillips pointed out on my last Flex Homework post that he only needed to run the CFLOGIN tag once in his Flex application. My code was running it for every hit in the onRequestStart method.

So this really bugged me because it was my understanding that ColdFusion had to run the CFLOGIN tag during a request to "enable" Roles Based Security. I knew that ColdFusion would skip the stuff inside - but from what I had remembered, CF had to actually encounter the tag to use Roles Based Security for the test. But when I tested what Bruce had done in his Flex app, it worked as he had said. I was truly perplexed. Then I did a test:
   view plainprintabout
1  <cfapplication name="goobercflogin" sessionManagement="true">
2  
3  <cflogin>
4      <cfloginuser name="ray2" password="ray" roles="admin">
5  </cflogin>
6  <cfoutput>#getAuthUser()#</cfoutput>
7  
8  <cfif isUserInRole("admin")>
9  <p>
10  yes, admin role
11  </p>
12  </cfif>
I ran this - and then ran it again with the cflogin block commented out - and it worked just fine. Bruce was definitely right. But then I tried this:
   view plainprintabout
1  <cfapplication name="goobercflogin2" sessionManagement="true" loginStorage="session">
2  
3  <cflogin>
4      <cfloginuser name="ray2" password="ray" roles="admin">
5  </cflogin>
6  
7  
8  <cfoutput>#getAuthUser()#</cfoutput>
9  
10  <cfif isUserInRole("admin")>
11  <p>
12  yes, admin role
13  </p>
14  </cfif>
Notice the loginStorage? That tells ColdFusion to use the session scope for the authentication. Now in theory, this should ONLY change the storage method for the authentication information. But when you comment out CFLOGIN, you no longer get a value for getAuthUser and the roles check failed. I'll wrap with one final word: Ugh.