MACROMEDIA ColdFusion MX, Develop Manual, Page: 321 / 860

Configuring and using client variables 321
Providing Session security
ColdFusion uses the same client identifiers for the Client scope and the standard Session scope.
Because the
CFToken
and
CFID
values are used to identify a client over a period of time, they are
normally saved as cookies on the user’s browser. These cookies persist until the client’s browser
deletes them, which can be a considerable length of time. As a result, hackers could have more
access to these variables than if ColdFusion used different user identifiers for each session.
A hacker who has the user’s
CFToken
and
CFID
cookies could gain access to user data by accessing
a web page during the user’s session using the stolen
CFToken
and
CFID
cookies. While this
scenario is unlikely, it is theoretically possible.
You can remove this vulnerability by selecting the Use J2EE Session Variables option on the
ColdFusion MX Administrator Memory Variables page. The J2EE session management
mechanism creates a new session identifier for each session, and does not use either the
CFToken
or the
CFID
cookie value.
Managing client identity information in a clustered environment
To maintain your application’s client identity information in a clustered server environment, you
must specify the
cfapplication setdomaincookies
attribute in your Application.cfm page.
The
setdomaincookies
attribute specifies that the server-side copies of the
CFID
and
CFToken
variables used to identify the client to ColdFusion are stored at the domain level (for example,
.macromedia.com). If
CFID
and
CFToken
variable combinations already exist on each host in the
cluster, ColdFusion migrates the host-level variables on each cluster member to the single,
common domain-level variable. Following the setting or migration of host-level cookie variables
to domain-level variables, ColdFusion creates a new cookie variable (
CFMagic
) that tells
ColdFusion that domain-level cookies have been set.
If you use client variables in a clustered system, you must also use a database or cookies to store
the variables.
Configuring and using client variables
Use client variables for data that is associated with a particular client and application and that
must be saved between user sessions. Use client variables for long-term information such as user
display or content preferences.
Enabling client variables
To enable client variables, you must set the
cfapplication
tag
clientmanagement
attribute to
Yes on every page. Because the Application.cfm file is included in all of the application’s pages,
you enable client management in the
cfapplication
tag, at the beginning of the
Application.cfm file. For example, to enable client variables in an application named SearchApp,
you use the following line in the application’s Application.cfm page:
<cfapplication NAME="SearchApp" clientmanagement="Yes">
Choosing a client variable storage method
By default, Coldfusion stores client variables in the Registry. In most cases, however, it is more
appropriate to store the information as client cookies or in a SQL database.