349
DEVELOPING
COLDFUSION 9 APPLICATIONS
Developing CFML Applications
Las
t
upda
te
d 8/5/2010
Important:
If you use web server–based authentication or any form authentication that uses a Basic HTTP
Authorization header, the browser continues to send the authentication information to your application until the user
closes the browser, or in some cases, all open browser windows. As a result, after the user logs out and your application
uses the
cflogout
tag, until the browser closes, the cflogin structure in the
cflogin
tag will contain the logged-out user’s
UserID and password. If a user logs out and does not close the browser, another user can access pages with the first user’s
login.
Security scenarios
There are two detailed security scenarios. The first scenario uses the web server to perform the authentication against
its user and password database. The second scenario uses ColdFusion for all authentication and authorization.
A web server authentication security scenario
An application that uses web server authentication could work as follows. The example in “
Web server–based
authentication user security example
” on page 354 – implements this scenario.
1
When the user requests a page from a particular directory on the server for the first time after starting the browser,
the web server displays a login page and logs in the user. The web server handles all user authentication.
2
Because the user requested a ColdFusion page, the web server hands the request to ColdFusion.
3
When ColdFusion receives a request for a ColdFusion page, it instantiates the Application.cfc and runs
onRequestStart
method. If you use an Application.cfm page in place of the Application.cfc, it runs the contents
of the Application.cfm page before it runs the requested page. The
onRequestStart
method or Application.cfm
page contains a
cflogin
tag. ColdFusion executes the
cflogin
tag body if the user is not logged into ColdFusion.
The user is logged in if the
cfloginuser
tag has run successfully for this application and the user has not been
logged out.
4
Code in the
cflogin
tag body uses the user ID and password from the browser login, contained in the cflogin.name
and cflogin.password variables, as follows. (With Digest or NTLM web server authentication, the cflogin.password
variable is the empty string.)
a
It checks the user’s name against information it maintains about users and roles. In a simple case, the application
has two roles, one for users and one for administrators. The CFML assigns the Admin role to any user logged
on with the user ID
Admin
and assigns the User role to all other users.
b
It calls the
cfloginuser
tag with the user’s ID, password, and roles, to identify the user to ColdFusion.
5
Application.cfc or the Application.cfm page completes processing, and ColdFusion processes the requested
application page.
6
The application uses the
IsUserInAnyRole
function to check whether the user belongs to a role before it runs
protected code that must be available only to users in that role.
7
The application uses the
GetAuthUser
function to determine the user ID; for example, to display the ID for
personalization. It can also use the ID as a database key to get user-specific data.
Important:
If you use web server–based authentication or any form authentication that uses a Basic HTTP
Authorization header, the browser continues to send the authentication information to your application until the user
closes the browser, or in some cases, all open browser windows. As a result, after the user logs out and your application
uses the
cflogout
tag, until the browser closes, the cflogin structure in the
cflogin
tag will contain the logged-out user’s
UserID and password. If a user logs out and does not close the browser, another user can access pages with the first user’s
login.