356
Chapter 16: Securing Applications
An application authentication security scenario
An application that does its own authentication might work as follows. The example in
“Application-based user security example” on page 360
implements this scenario.
1
Whenever ColdFusion receives a request for a ColdFusion page, it runs the contents of the
Application.cfm page before it runs the requested page. The Application.cfm page contains a
cflogin
tag. ColdFusion executes the
cflogin
tag body if the user is not logged-in. A user is
logged-in if the
cfloginuser
tag has run during the current session and the user had not been
logged out by a
cflogout
tag.
2
Code in the
cflogin
tag body checks to see if it has received a user ID and password, normally
from a login form.
3
If there is no user ID or password, the code in the
cflogin
tag body displays a login form that
asks for the user’s ID and password.
The form posts the login information back to the originally requested page, and the
cflogin
tag in Application.cfm runs again. This time, the
cflogin
tag body code checks the user name
and password against a database, LDAP directory, or other policy store, to ensure that the user
is valid and get the user’s roles.
4
If the user name and password are valid, the
cflogin
tag body code calls the
cfloginuser
tag
with the user’s ID, password, and roles, to identify the user to ColdFusion.
5
When the user is logged-in, application pages use the
IsUserInRole
function to check whether
the user belongs to a role before they run protected code that must be available only to users in
that role.
The application can use the
GetAuthUser
function to determine the user ID; for example, to
display the ID for personalization. It can also use the ID as a database key to get user-specific
data.
6
Each application page displays a link to a logout form that uses the
cflogout
tag to log out the
user. Typically, the logout link is in a page header that appears in all pages. The logout form can
also be on the Application.cfm page.
Note:
A log-out option is not always required, as the user is automatically logged out when all browser
windows are closed (except when using ColdFusion Session variables) or is inactive for the login or
session time-out period. If the user closes the browser, the login variables remain in the server
memory until the session times. You can enhance security in cases where a system might be shared
by providing a log-out facility. You must explicitly log out a user before a new user can log in while the
browser is running.
While this scenario shows one method for implementing user security, it is only an example. For
example, your application could require users to log in for only some pages, such as pages in a
folder that contains administrative functions. When you design your user security
implementation, remember the following:
•
Code in the
cflogin
tag body executes only if there is no user logged in.
•
With application authentication, you write the code that gets the identification from the user
and tests this information against a secure credential store.
•
After you have authenticated the user, you use the
cfloginuser
tag to log the user into
ColdFusion.
The following figure shows this flow of control. For simplicity, it omits the log-out option.
Summary of Contents for ColdFusion MX
Page 1: ...Developing ColdFusion MX Applications...
Page 22: ...22 Contents...
Page 38: ......
Page 52: ...52 Chapter 2 Elements of CFML...
Page 162: ......
Page 218: ...218 Chapter 10 Writing and Calling User Defined Functions...
Page 250: ...250 Chapter 11 Building and Using ColdFusion Components...
Page 264: ...264 Chapter 12 Building Custom CFXAPI Tags...
Page 266: ......
Page 314: ...314 Chapter 14 Handling Errors...
Page 344: ...344 Chapter 15 Using Persistent Data and Locking...
Page 349: ...About user security 349...
Page 357: ...Security scenarios 357...
Page 370: ...370 Chapter 16 Securing Applications...
Page 388: ...388 Chapter 17 Developing Globalized Applications...
Page 408: ...408 Chapter 18 Debugging and Troubleshooting Applications...
Page 410: ......
Page 426: ...426 Chapter 19 Introduction to Databases and SQL...
Page 476: ...476 Chapter 22 Using Query of Queries...
Page 534: ...534 Chapter 24 Building a Search Interface...
Page 556: ...556 Chapter 25 Using Verity Search Expressions...
Page 558: ......
Page 582: ...582 Chapter 26 Retrieving and Formatting Data...
Page 668: ......
Page 734: ...734 Chapter 32 Using Web Services...
Page 760: ...760 Chapter 33 Integrating J2EE and Java Elements in CFML Applications...
Page 786: ...786 Chapter 34 Integrating COM and CORBA Objects in CFML Applications...
Page 788: ......