
About user security
351
About application authentication
With application authentication, you do not rely on the web server to enforce application
security. The application performs all user authentication and authorization. The application
displays a login page, checks the user’s identity and login against its own authorization store, such
as an LDAP directory or database, and logs the user into ColdFusion using the
cfloginuser
tag.
The application can then use the
IsUserInRole
and
GetAuthUser
functions to check the user’s
roles or identity for authorization before running a ColdFusion page or specific code on a page.
For an example of application authentication use, see
“An application authentication security
scenario” on page 356
.
ColdFusion authentication storage and persistence
How ColdFusion application authentication information is maintained by the browser and
ColdFusion, and therefore how long it is available, depends on the following:
•
Whether the user’s browser enables cookies
•
Whether the application supports the Session scope for login storage
Authentication and cookies
Because HTTP is connectionless, a login can last beyond a single web page viewing only if the
browser provides a unique identifier that can be used to confirm that the current user is
authenticated. Normally, this is done by using memory-only cookies that are automatically
destroyed when the user closes all open browser windows. The specific cookies and how they are
used depend on whether the application supports the Session scope for login storage.
Note:
For information on user logins without cookies, see
“Using ColdFusion security without
cookies” on page 352
.
Using the Session scope
If you do the following, ColdFusion maintains login information in the Session scope instead of
the Cookie scope:
•
Enable the Session scope in the ColdFusion MX Administrator and the
cfapplication
tag
•
Specify
loginStorage=”Session”
in the
cfapplication
tag
When ColdFusion maintains login information in the Session scope, it stores the authentication
details in a Session.cfauthorization variable, and ColdFusion uses the session cookie information
to identify the user. Session-based authentication has the following advantages over less persistent
login storage:
•
After the user logs in, the user ID and password are not passed between the server and the
browser.
•
The login information and the session share a single time-out. There is no need to manually
synchronize sessions and logins.
•
If you use server clusters, the Session scope login ID can be available across the cluster. For
more information on server clustering, see
Configuring and Administering ColdFusion MX
.
Содержание ColdFusion MX
Страница 1: ...Developing ColdFusion MX Applications...
Страница 22: ...22 Contents...
Страница 38: ......
Страница 52: ...52 Chapter 2 Elements of CFML...
Страница 162: ......
Страница 218: ...218 Chapter 10 Writing and Calling User Defined Functions...
Страница 250: ...250 Chapter 11 Building and Using ColdFusion Components...
Страница 264: ...264 Chapter 12 Building Custom CFXAPI Tags...
Страница 266: ......
Страница 314: ...314 Chapter 14 Handling Errors...
Страница 344: ...344 Chapter 15 Using Persistent Data and Locking...
Страница 349: ...About user security 349...
Страница 357: ...Security scenarios 357...
Страница 370: ...370 Chapter 16 Securing Applications...
Страница 388: ...388 Chapter 17 Developing Globalized Applications...
Страница 408: ...408 Chapter 18 Debugging and Troubleshooting Applications...
Страница 410: ......
Страница 426: ...426 Chapter 19 Introduction to Databases and SQL...
Страница 476: ...476 Chapter 22 Using Query of Queries...
Страница 534: ...534 Chapter 24 Building a Search Interface...
Страница 556: ...556 Chapter 25 Using Verity Search Expressions...
Страница 558: ......
Страница 582: ...582 Chapter 26 Retrieving and Formatting Data...
Страница 668: ......
Страница 734: ...734 Chapter 32 Using Web Services...
Страница 760: ...760 Chapter 33 Integrating J2EE and Java Elements in CFML Applications...
Страница 786: ...786 Chapter 34 Integrating COM and CORBA Objects in CFML Applications...
Страница 788: ......
Страница 806: ...806 Chapter 35 Sending and Receiving E Mail...