Building Secure Coldfusion Components - MACROMEDIA COLDFUSION MX 61-DEVELOPING COLDFUSION MX Develop Manual

Code that manipulates persistent scope CFC properties must be locked, just as all other code that
manipulates persistent scope properties must be locked. Therefore, you must lock both of the
following types of application code:
•
Code that directly manipulates properties of a persistent scope CFC instance
•
Code that calls methods of a persistent scope CFC instance that manipulate properties of the
instance
If you put multiple CFC instances in a single persistent scope, you can create a named lock for
each CFC instance. For more information on locking, see
Locking.
Note: Session scope CFCs cannot be serialized, so you cannot use them with clustered sessions; for
example, if you want to support session failover among servers.
For an example of an application that uses a component in a persistent scope, see the CFML/
HTML PetMarket application, available from the Macromedia Pet Market Blueprint Application
page, www.macromedia.com/devnet/mx/blueprint/. The Session scope user CFC has properties
with information about the user, such as name, telephone number, e-mail address, and billing and
shipping addresses. The CFC also includes methods for managing the user: a login method, a
method that populates the object's properties from a database, and so on.

Building secure ColdFusion components

To restrict access to component methods, ColdFusion components use the following security
features:
•
Access Security
•
Role-based security
Using access security
CFC access security lets you limit the code that can access the components. You specify the access
to a CFC method by specifying the
Type Description
private Available only to the component that declares the method and any components that
extend the component in which it is defined. This usage is similar to the Java
protected keyword, not the Java private keyword.
package Available only to the component that declares the method, components that extend
the component, or any other components in the package. A package consists of all
components defined in a single directory. For more information on packages, see
"Using component packages" on page
public Available to any locally executing ColdFusion page or component method.
remote Available to a locally or remotely executing ColdFusion page or component method,
or to a local or remote client through a URL, form submission, Flash Remoting MX, or
as a web service.
248 Chapter 11: Building and Using ColdFusion Components
attribute as follows:
cffunction access
247.
Chapter 15, Using Persistent Data and