About ColdFusion security
Security is especially important in web-based applications, such as those you develop in ColdFusion. ColdFusion developers and administrators must fully understand the security risks that could affect their development and runtime environments so they can enable and restrict access appropriately.
You can implement development security by requiring a password to use the ColdFusion Administrator and a password for Remote Development Services (RDS), which allows developers to develop CFML pages remotely. You implement runtime security in your CFML pages and in the ColdFusion Administrator. ColdFusion has the following runtime security categories:
- User security
- Programmatically determine the logged-in user and allow or disallow restricted functionality based on the roles assigned to that user. For more information about user security, see ColdFusion security features in Securing Applications in the ColdFusion Developer's Guide.
- Sandbox security
- Using the ColdFusion Administrator, define the actions and resources that the ColdFusion pages in and below a specified directory can use.
Note: If you have the Enterprise Edition of ColdFusion, you can configure multiple security sandboxes. If you have the Standard Edition of ColdFusion, you can only configure a single security sandbox.
The Security area in the Administrator lets you do the following tasks:
- Configure password protection for the ColdFusion Administrator. For more information, see ColdFusion Administrator password protection.
- Configure password protection for RDS access. For more information, see RDS password protection.
- Enable, disable, and customize ColdFusion security, on the Security > Sandbox Security page (called Resource Security page in the Standard edition). For more information, see Using sandbox security.