Securing ColdFusion Components

By default, ColdFusion Components are as secure as any other ColdFusion files they can be accessed only by ColdFusion, only locally (not by remote servers), and also to all application users (assuming the application is written to allow that). However, it is possible to control access to CFC methods in two ways: by where the request is coming from, and by who the request is coming from.

NOTE

CFCs are protected at the method level (each <cffunction> individually), not at the CFC level.

Controlling Access

The <cffunction> access attribute defines the access level for a method. Valid access levels are listed in Table 31.4:

Table 31.4. Method access Levels

LEVEL	DESCRIPTION
package	Available to other methods within the CFC, as well as any code in the same directory.
private	Available only within the CFC itself.
public	Available to the entire ColdFusion server.
remote	Available locally and externally (other hosts and servers).

If unauthorized access is attempted, an error will be thrown.

The default access level is public. To allow CFCs to be accessed remotely (as Web Services or via Flash Remoting), access="remote" must be specified.

Using access it is possible to restrict or grant access to specific methods based on where the request is coming from.

User Security

In addition to securing methods based on the point of origin of a request, it is also possible to grant or deny access based on who the current user is logged in as. The <cffunction> roles attribute takes a comma-delimited list (either hard-coded or a variable) that contains the roles that a request must already have been authenticated as so as to gain access.

The security and ROLES are based on the security framework exposed via <CFLOGIN> and related tags. If unauthorized access is attempted an error will be thrown.

See Chapter 27, "Application Security," for details on the security framework and <cflogin>.

Using roles it is possible to restrict or grant access to specific methods based on who the requester has been authenticated as.