Chapter 16: Securing Applications - MACROMEDIA COLDFUSION MX 61-DEVELOPING COLDFUSION MX Develop Manual

ColdFusion MX has two major security features:
•
Sandbox security (ColdFusion MX Enterprise) or resource security (ColdFusion MX Standard),
where security restricts access to specific resources, such as tags and files.
•
User security, which depends on a user identity.
This chapter provides an overview of ColdFusion security. It briefly describes how you use the
ColdFusion MX Administrator to configure sandbox or resource security, and discusses
structuring an application to take advantage of this security. It explains in detail how to
implement user security in ColdFusion applications.
Other chapters discuss specific security issues as part of the context of their topics. For example,
the chapter on LDAP (Lightweight Directory Access Protocol) discusses secure access to LDAP
directories. Similarly, the section
on page 435 describes a method for preventing inappropriate access to SQL databases. See the
Security entries in the Index for a complete listing of such sections.
For detailed information on using Administrator-controlled security features, see Configuring and
Administering ColdFusion MX.
This chapter does not discuss general or web server security concepts and issues in any detail. For
example, it does not discuss web server security management issues, such as enabling HTTPS
protocol support. For information on enabling web server security features, see your web server
documentation. Many books and other resources are available on web and application security.
Contents
ColdFusion security features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346
About resource and sandbox security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346
About user security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348
Implementing user security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 358
Securing Applications
Chapter 20, "Enhancing security with cfqueryparam,"
CHAPTER 16
345