Same format as the Application.cfc interview-prep page: real questions, paired with a plain-English analogy. The running analogy here is a hotel — the building, its front desk, and the guests staying in it.
Application vs Session vs Request
Hotel analogy: Application is the hotel building itself, shared by every guest who ever stays there. Session is one guest's room key, valid only for their stay. Request is a single conversation with the front desk, over the moment it's actually happening.
| Scope | Hotel equivalent | Lifetime |
|---|---|---|
| Application | The hotel building — exists for every guest, indefinitely | Until the application times out or restarts |
| Session | One guest's room key — works only for them, only during their stay | Until the visitor's session times out or ends |
| Request | One conversation at the front desk, right now | Only for the current HTTP request |
What's the practical difference between Session and Application scope?
Session is private to one visitor and lasts for their visit. Application is shared by every visitor and lasts until the app restarts or times out. Storing one visitor's data in Application would leak it to everyone else.
When would you use Request scope instead of Session?
When the data is only needed for the current page load and doesn't need to survive afterward — e.g., passing a computed value from onRequestStart to the page itself. Using Session for that would waste server memory for no benefit.
Why does writing to Application scope need locking, but Request scope usually doesn't?
Application scope is shared by every visitor's every request at the same time, so concurrent writes can race and corrupt data. Request scope is only ever touched by the single request that owns it, so there's nothing to race against.
Variables vs Local (var) Scope
Hotel analogy: Variables scope is like a note left on the front desk counter, anyone working that shift can see and change it. Local (var-declared) scope is like a sticky note stuck to one specific staff member's own clipboard, nobody else's business.
What happens if you forget var inside a function?
The variable falls back to the Variables scope instead of staying local to that function call, which can leak it to (or collide with) code outside the function.
Is Variables scope shared across different visitors?
No, generally not for a plain .cfm page, each request gets its own Variables scope. Inside a CFC instance, Variables scope IS shared across that instance's methods and persists as long as the instance exists.
This vs Variables Scope Inside a CFC
Hotel analogy: Variables scope inside a CFC is the staff-only back office, employees (methods) can see it, guests can't. This scope is the guest-facing front desk, visible from outside the component through the object reference.
Can code outside a CFC read its Variables scope directly?
No, Variables scope inside a CFC is private to that component. Only data explicitly placed on this (or exposed through a getter method) is reachable from outside.
If you want a property to be both readable from outside and hidden from direct modification, what's the pattern?
Store the real value in Variables scope (private), and expose a getter method (and, if needed, a validating setter) rather than putting the raw value on this directly.
Rapid-Fire Interview Questions
Name the four scopes that hold external, user-supplied input.
Form, URL, Cookie, and CGI.
In ColdFusion's scope-lookup order, which is checked first: URL or Form?
URL is checked before Form — this is the exact mechanism behind the classic unscoped-variable XSS gotcha.
What's the "smallest scope that fits" principle?
Prefer Request over Session, and Session over Application, whenever the smaller scope's lifetime and visibility are enough to solve the problem — it minimizes concurrency risk and memory use.
What's the difference between Session and Client scope?
Session typically ends when the browser closes or times out from inactivity during one visit. Client scope is designed to persist across separate visits, potentially days or weeks apart, stored server-side or via a cookie.
Which scope is shared across multiple applications on the same ColdFusion server?
Server scope — it's the broadest scope, one level above Application.
Summary
This page paired the most commonly-asked scope questions (Application vs Session vs Request, Variables vs Local, This vs Variables in a CFC) with a running hotel analogy and direct interview-style answers.
What's Next?
The next lesson covers Session Management in depth — timeouts, what onSessionStart/onSessionEnd actually do behind the scenes, and practical patterns like storing a shopping cart in Session.