
346
Chapter 16: Securing Applications
ColdFusion security features
ColdFusion provides scalable, granular security for building and deploying your ColdFusion
applications. ColdFusion provides the following types of security resources:
•
Development
ColdFusion MX Administrator is protected by a password. Additionally, you
can specify a password for access to data sources from Macromedia Dreamweaver MX. For
more information on configuring Administrator security passwords, see the ColdFusion MX
Administrator online Help.
•
Resource/Sandbox
The ColdFusion MX Administrator can limit access to ColdFusion
resources, including selected tags and functions, data sources, files, and host addresses. In
Standard edition, you configure a single set of resource limitations that apply to all your
ColdFusion applications.
In Enterprise edition, you can have multiple sandboxes, based on the location of your
ColdFusion pages, each with its own set of resource limitations. You can confine applications
to secure areas, thereby flexibly restricting the access that the application has to resources.
•
User
ColdFusion applications can require users to log in to use application pages. You can
assign users to roles (sometimes called groups); ColdFusion pages can determine the logged-in
user’s roles or ID and selectively determine what to do based on this information.
Note:
You can also use the
cfencode
utility, located in the
cf_root
/bin directory, to obscure
ColdFusion pages that you distribute. Although this technique cannot prevent determined hackers
from determining the contents of your pages, it does prevent inspection of the pages.
About resource and sandbox security
ColdFusion provides two levels of resource-based security:
•
ColdFusion MX Standard refers to its resource-based security as resource security. It lets you
specify a single set of limitations on access to ColdFusion resources that apply to all
ColdFusion applications.
•
ColdFusion MX Enterprise refers to its resource-based security as sandbox security. Sandbox
security is a superset of resource security. Sandbox security lets you create multiple
sandboxes
,
each
corresponding to a different directory. For each sandbox, you specify a set of resource
limitations that apply to all ColdFusion pages in the sandbox directory and its subdirectories.
If you create a sandbox that is a subdirectory of a sandbox, the subdirectory’s rules override the
parent directory’s rules.
The ColdFusion MX Administrator Resource Security page (in Standard) and Sandbox Security
page (in Enterprise) let you enable resource-based security. In ColdFusion Standard, the page lets
you configure the resource settings that apply to all your ColdFusion applications. In ColdFusion
Enterprise, the page lets you create sandboxes and configure the resource limitations for each
sandbox individually.
Содержание ColdFusion MX
Страница 1: ...Developing ColdFusion MX Applications...
Страница 22: ...22 Contents...
Страница 38: ......
Страница 52: ...52 Chapter 2 Elements of CFML...
Страница 162: ......
Страница 218: ...218 Chapter 10 Writing and Calling User Defined Functions...
Страница 250: ...250 Chapter 11 Building and Using ColdFusion Components...
Страница 264: ...264 Chapter 12 Building Custom CFXAPI Tags...
Страница 266: ......
Страница 314: ...314 Chapter 14 Handling Errors...
Страница 344: ...344 Chapter 15 Using Persistent Data and Locking...
Страница 349: ...About user security 349...
Страница 357: ...Security scenarios 357...
Страница 370: ...370 Chapter 16 Securing Applications...
Страница 388: ...388 Chapter 17 Developing Globalized Applications...
Страница 408: ...408 Chapter 18 Debugging and Troubleshooting Applications...
Страница 410: ......
Страница 426: ...426 Chapter 19 Introduction to Databases and SQL...
Страница 476: ...476 Chapter 22 Using Query of Queries...
Страница 534: ...534 Chapter 24 Building a Search Interface...
Страница 556: ...556 Chapter 25 Using Verity Search Expressions...
Страница 558: ......
Страница 582: ...582 Chapter 26 Retrieving and Formatting Data...
Страница 668: ......
Страница 734: ...734 Chapter 32 Using Web Services...
Страница 760: ...760 Chapter 33 Integrating J2EE and Java Elements in CFML Applications...
Страница 786: ...786 Chapter 34 Integrating COM and CORBA Objects in CFML Applications...
Страница 788: ......
Страница 806: ...806 Chapter 35 Sending and Receiving E Mail...