
360
Chapter 16: Securing Applications
Reviewing the code
The following table describes the securitytest.cfm page CFML code and its function:
Application-based user security example
The example in this section shows how you might implement user security by authenticating
users and then allowing users to see or use only the resources that they are authorized to access.
This example has three ColdFusion pages:
•
The Application.cfm page contains the authentication logic that checks whether a user is
logged-in, requests the login page if the user is not logged-in, and authenticates the data from
the login page. If the user is authenticated, it logs the user in.
This page also includes the one-button form and logic for logging out a user, which appears at
the top of each page.
•
The loginform.cfm page displays the login form. The code on this page could also be included
in Application.cfm.
•
The securitytest.cfm page is a sample application page. It displays the logged-in user’s roles.
You can test the security behavior by adding your own pages to the same directory as the
Application.cfm page.
The example gets user information from the LoginInfo table of the CompanyInfo database that is
installed with ColdFusion. You can replace this database with any database containing UserID,
Password, and Roles fields. The sample database contains the following data:
Because spaces are meaningful in roles strings, you should not follow the comma separators in the
Roles fields with spaces.
Code
Description
<cfoutput>
<h2>Welcome #GetAuthUser()#!</h2>
</cfoutput>
User is already logged-in by
Application.cfm. Displays a welcome
message that includes the user’s login ID.
ALL Logged-in Users see this message.<br>
<br>
Displays this message in all cases. The
page does not display until a user is
logged-in.
<cfscript>
if (IsUserInRole("admin"))
WriteOutput("Users in the admin role
see this message.<br><br>");
if (IsUserInRole("user"))
WriteOutput("Everyone in the user role
sees this message.<br><br>");
</cfscript>
Tests whether the user belongs to each of
the valid roles. If the user is in a role,
displays a message with the role name.
The user sees one message per role to
which he or she belongs.
UserID
Password
Roles
BobZ
Ads10
Employee,Sales
JaniceF
Qwer12
Contractor,Documentation
RandalQ
ImMe
Employee,Human Resources,Manager
Содержание COLDFUSION MX 61-DEVELOPING COLDFUSION MX
Страница 1: ...Developing ColdFusion MX Applications...
Страница 22: ...22 Contents...
Страница 38: ......
Страница 52: ...52 Chapter 2 Elements of CFML...
Страница 162: ......
Страница 218: ...218 Chapter 10 Writing and Calling User Defined Functions...
Страница 250: ...250 Chapter 11 Building and Using ColdFusion Components...
Страница 264: ...264 Chapter 12 Building Custom CFXAPI Tags...
Страница 266: ......
Страница 314: ...314 Chapter 14 Handling Errors...
Страница 344: ...344 Chapter 15 Using Persistent Data and Locking...
Страница 349: ...About user security 349...
Страница 357: ...Security scenarios 357...
Страница 370: ...370 Chapter 16 Securing Applications...
Страница 388: ...388 Chapter 17 Developing Globalized Applications...
Страница 408: ...408 Chapter 18 Debugging and Troubleshooting Applications...
Страница 410: ......
Страница 426: ...426 Chapter 19 Introduction to Databases and SQL...
Страница 476: ...476 Chapter 22 Using Query of Queries...
Страница 534: ...534 Chapter 24 Building a Search Interface...
Страница 556: ...556 Chapter 25 Using Verity Search Expressions...
Страница 558: ......
Страница 582: ...582 Chapter 26 Retrieving and Formatting Data...
Страница 668: ......
Страница 734: ...734 Chapter 32 Using Web Services...
Страница 760: ...760 Chapter 33 Integrating J2EE and Java Elements in CFML Applications...
Страница 786: ...786 Chapter 34 Integrating COM and CORBA Objects in CFML Applications...
Страница 788: ......
Страница 806: ...806 Chapter 35 Sending and Receiving E Mail...