346
Chapter 16: Securing Applications
ColdFusion security features
ColdFusion provides scalable, granular security for building and deploying your ColdFusion
applications. ColdFusion provides the following types of security resources:
•
Development
ColdFusion MX Administrator is protected by a password. Additionally, you
can specify a password for access to data sources from Macromedia Dreamweaver MX. For
more information on configuring Administrator security passwords, see the ColdFusion MX
Administrator online Help.
•
Resource/Sandbox
The ColdFusion MX Administrator can limit access to ColdFusion
resources, including selected tags and functions, data sources, files, and host addresses. In
Standard edition, you configure a single set of resource limitations that apply to all your
ColdFusion applications.
In Enterprise edition, you can have multiple sandboxes, based on the location of your
ColdFusion pages, each with its own set of resource limitations. You can confine applications
to secure areas, thereby flexibly restricting the access that the application has to resources.
•
User
ColdFusion applications can require users to log in to use application pages. You can
assign users to roles (sometimes called groups); ColdFusion pages can determine the logged-in
user’s roles or ID and selectively determine what to do based on this information.
Note:
You can also use the
cfencode
utility, located in the
cf_root
/bin directory, to obscure
ColdFusion pages that you distribute. Although this technique cannot prevent determined hackers
from determining the contents of your pages, it does prevent inspection of the pages.
About resource and sandbox security
ColdFusion provides two levels of resource-based security:
•
ColdFusion MX Standard refers to its resource-based security as resource security. It lets you
specify a single set of limitations on access to ColdFusion resources that apply to all
ColdFusion applications.
•
ColdFusion MX Enterprise refers to its resource-based security as sandbox security. Sandbox
security is a superset of resource security. Sandbox security lets you create multiple
sandboxes
,
each
corresponding to a different directory. For each sandbox, you specify a set of resource
limitations that apply to all ColdFusion pages in the sandbox directory and its subdirectories.
If you create a sandbox that is a subdirectory of a sandbox, the subdirectory’s rules override the
parent directory’s rules.
The ColdFusion MX Administrator Resource Security page (in Standard) and Sandbox Security
page (in Enterprise) let you enable resource-based security. In ColdFusion Standard, the page lets
you configure the resource settings that apply to all your ColdFusion applications. In ColdFusion
Enterprise, the page lets you create sandboxes and configure the resource limitations for each
sandbox individually.
Summary of Contents for ColdFusion MX
Page 1: ...Developing ColdFusion MX Applications...
Page 22: ...22 Contents...
Page 38: ......
Page 52: ...52 Chapter 2 Elements of CFML...
Page 162: ......
Page 218: ...218 Chapter 10 Writing and Calling User Defined Functions...
Page 250: ...250 Chapter 11 Building and Using ColdFusion Components...
Page 264: ...264 Chapter 12 Building Custom CFXAPI Tags...
Page 266: ......
Page 314: ...314 Chapter 14 Handling Errors...
Page 344: ...344 Chapter 15 Using Persistent Data and Locking...
Page 349: ...About user security 349...
Page 357: ...Security scenarios 357...
Page 370: ...370 Chapter 16 Securing Applications...
Page 388: ...388 Chapter 17 Developing Globalized Applications...
Page 408: ...408 Chapter 18 Debugging and Troubleshooting Applications...
Page 410: ......
Page 426: ...426 Chapter 19 Introduction to Databases and SQL...
Page 476: ...476 Chapter 22 Using Query of Queries...
Page 534: ...534 Chapter 24 Building a Search Interface...
Page 556: ...556 Chapter 25 Using Verity Search Expressions...
Page 558: ......
Page 582: ...582 Chapter 26 Retrieving and Formatting Data...
Page 668: ......
Page 734: ...734 Chapter 32 Using Web Services...
Page 760: ...760 Chapter 33 Integrating J2EE and Java Elements in CFML Applications...
Page 786: ...786 Chapter 34 Integrating COM and CORBA Objects in CFML Applications...
Page 788: ......