348
Chapter 16: Securing Applications
About user security
User security lets your application use security rules to determine what it displays. It has two
elements:
•
Authentication
Ensures that a valid user is logged-in, based on an ID and password provided
by the user. ColdFusion (or, in some cases if you use web server authentication, the web server)
maintains the user ID information while the user is logged-in.
•
Authorization
Ensures that the logged-in user is allowed to use a page or perform an
operation. Authorization is typically based on one or more
roles
(sometimes called groups) to
which the user belongs. For example, in an employee database, all users could be members of
either the employee role or the contractor role. They could also be members of roles that
identify their department, position in the corporate hierarchy, or job description. For example,
someone could be a member of some or all of the following roles:
■
Employees
■
Human Resources
■
Benefits
■
Managers
Roles enable you to control access in your application resources without requiring the application
to maintain knowledge about individual users. For example, suppose you use ColdFusion for your
company’s intranet. The Human Resources department maintains a page on the intranet on
which all employees can access timely information about the company, such as the latest company
policies, upcoming events, and job postings. You want everyone to be able to read the
information, but you want only certain authorized Human Resources employees to be able to
add, update, or delete information.
Your application gets the user’s roles from the user information data store when the user logs in,
and then enables access to specific pages or features based on the roles. Typically, you store user
information in a database, LDAP directory, or other secure information store.
You can also use the user ID for authorization. For example, you might want to let employees
view customized information about their salaries, job levels, and performance reviews. You
certainly would not want one employee to view sensitive information about another employee,
but you would want managers to be able to see, and possibly update, information about their
direct reports. By employing both user IDs and roles, you can ensure that only the appropriate
people can access or work with sensitive data.
The following figure shows a typical flow of control for user authentication and authorization.
Following sections expand on this diagram to describe how you implement user security in
ColdFusion.
Summary of Contents for ColdFusion MX
Page 1: ...Developing ColdFusion MX Applications...
Page 22: ...22 Contents...
Page 38: ......
Page 52: ...52 Chapter 2 Elements of CFML...
Page 162: ......
Page 218: ...218 Chapter 10 Writing and Calling User Defined Functions...
Page 250: ...250 Chapter 11 Building and Using ColdFusion Components...
Page 264: ...264 Chapter 12 Building Custom CFXAPI Tags...
Page 266: ......
Page 314: ...314 Chapter 14 Handling Errors...
Page 344: ...344 Chapter 15 Using Persistent Data and Locking...
Page 349: ...About user security 349...
Page 357: ...Security scenarios 357...
Page 370: ...370 Chapter 16 Securing Applications...
Page 388: ...388 Chapter 17 Developing Globalized Applications...
Page 408: ...408 Chapter 18 Debugging and Troubleshooting Applications...
Page 410: ......
Page 426: ...426 Chapter 19 Introduction to Databases and SQL...
Page 476: ...476 Chapter 22 Using Query of Queries...
Page 534: ...534 Chapter 24 Building a Search Interface...
Page 556: ...556 Chapter 25 Using Verity Search Expressions...
Page 558: ......
Page 582: ...582 Chapter 26 Retrieving and Formatting Data...
Page 668: ......
Page 734: ...734 Chapter 32 Using Web Services...
Page 760: ...760 Chapter 33 Integrating J2EE and Java Elements in CFML Applications...
Page 786: ...786 Chapter 34 Integrating COM and CORBA Objects in CFML Applications...
Page 788: ......