Defines the scope of a ColdFusion application; enables and disables storage of Client variables; specifies the Client variable storage mechanism; enables Session variables; and sets Application variable time-outs.
<cfapplication name = "application name
" applicationTimeout = #CreateTimeSpan(days
,hours
,minutes
,seconds
)# clientManagement = "yes|no" clientStorage = "data source name
|Registry|Cookie" loginStorage = "cookie|session" scriptProtect = "none|all|list
" sessionManagement = "yes|no" sessionTimeout = #CreateTimeSpan(days
,hours
,minutes
,seconds
)# setClientCookies = "yes|no" setDomainCookies = "yes|no">
cfassociate, cferror, cflock, cfmodule; "Application.CFC Reference" ; "Designing and Optimizing a ColdFusion Application" 13 and "Integrating J2EE and Java Elements in CFML Applications" in the ColdFusion Developer's Guide
ColdFusion 8: Added secureJSON and SecureJSONPrefix attributes
ColdFusion MX 7: Added scriptProtect attribute
ColdFusion MX 6.1: Added loginStorage attribute
ColdFusion MX:
Attribute |
Req/Opt |
Default |
Description |
---|---|---|---|
name |
See Description |
|
Name of application. Up to 64 characters. For Application and Session variables: Required. For Client variables: Optional |
applicationTimeout |
Optional |
Specified in Variables page of ColdFusion Administrator |
Lifespan of application variables. CreateTimeSpan function and values in days, hours, minutes, and seconds, separated by commas. |
clientManagement |
Optional |
no |
|
clientStorage |
Optional |
registry |
How client variables are stored:
|
loginStorage |
Optional |
cookie |
|
scriptProtect |
Optional |
Determined by ColdFusion Administrator Enable Global Script Protection setting |
Specifies whether to protect variables from cross-site scripting attacks
For more information, see Usage. |
secureJSON |
Optional |
Administrator value |
A Boolean value that specifies whether to add a security prefix in front of any value that a ColdFusion function returns in JSON-format in response to a remote call. The default value is the value of the Prefix serialized JSON setting in the Administrator Server Settings > Settings page (which defaults to false). You can override this variable value in the cffunction tag. For more information see "Improving security" in the ColdFusion Developer's Guide. |
secureJSONPrefix |
Optional |
Administrator value |
The security prefix to put in front of the value that a ColdFusion function returns in JSON-format in response to a remote call if the secureJSON setting is true. The default value is the value of the Prefix serialized JSON setting in the Administrator Server Settings > Settings page (which defaults to //, the JavaScript comment character). For more information see "Improving security" in the ColdFusion Developer's Guide. |
sessionManagement |
Optional |
no |
|
sessionTimeout |
Optional |
Specified in Variables page of ColdFusion Administrator |
Life span of session variables. CreateTimeSpan function and values in days, hours, minutes, and seconds, separated by commas. |
setClientCookies |
Optional |
yes |
|
setDomainCookies |
Optional |
no |
|
This tag is typically used in the Application.cfm file, to set defaults for a ColdFusion application.
This tag enables application variables, unless they are disabled in the ColdFusion Administrator. The Administrator setting also overrides the sessionManagement attribute. For more information, see Configuring and Administering ColdFusion.
If ColdFusion is running on a cluster, you must specify clientStorage = "cookie" or a data source name; you cannot specify "registry".
ColdFusion generates an error if the application name is longer than 64 characters.
The CFTOKEN variable is 8 bytes in length. Its range is 10000000 --99999999.
Protecting variables from cross-site scripting attacks
The ScriptProtect attribute lets you protect one or more variable scopes from cross-site scripting attacks, where a client attempts to get your application to send malicious code back to a user's browser. In these attacks, user input (for example, from form fields or from URL variables) sets a CF variable which is destined for user output. The submitted data includes malicious code, such as JavaScript or an applet or object reference, which then executes on the user's system.
The ColdFusion cross-site scripting protection operation is done when ColdFusion processes the application settings at the beginning of a request. Thus, it can process the URL, and Cookie, CGI, and Form variables in a user's request. By default, it replaces occurrences of the following HTML tag names with the text InvalidTag: object, embed, script, applet, and meta. It allows these names in plain text, and replaces the words if they are used as tag names.
You can specify any or all ColdFusion scopes for protection, but only the Form, URL, CGI, and Cookie scopes have variables that are often provided by unknown sources. Also, protecting a scope requires additional processing. For these reasons, the all attribute value applies protection to only the four scopes.
The script protection mechanism applies a regular expression that is defined in the cf_root/lib/neo-security.xml file in the server configuration, or the cf_root/WEB-INF/cfusion/lib/neo-security.xml file in the J2EE configuration to the variable value. You can customize the patterns that ColdFusion replaces by modifying the regular expression in the CrossSiteScriptPatterns variable.
Locking server, application, and session variables
When you set or update variables in the server, application, and session scopes, use the cflock tag with the scope attribute set to the following value:
In some cases, you should also lock code that reads variables in these scopes. For information about locking scopes, see cflock.
<!--- This example shows how to use cflock to prevent race conditions during data updates to variables in Application, Server, and Session scopes. ---> <h3>cfapplication Example</h3> <p>cfapplication defines scoping for a ColdFusion application and enables or disables application and/or session variable storage. This tag is placed in a special file called Application.cfm that automatically runs before any other CF page in a directory (or subdirectory) where the Application.cfm file appears.</p> <cfapplication name = "ETurtle" sessionTimeout = #CreateTimeSpan(0, 0, 0, 60)# sessionManagement = "Yes"> <!--- Initialize session and application variables used by E-Turtleneck. ---> <cfparam name="application.number" default="1"> <cfparam name="session.color" default= ""> <cfparam name="session.size" default=""> <cfif IsDefined("session.numPurchased") AND IsNumeric(trim(session.cartTotal))> <!--- Use the application scope for the application variable to prevent race condition. This variable keeps track of total number of turtlenecks sold. ---> <cflock scope = "Application" timeout = "30" type = "Exclusive"> <cfset application.number = application.number + session.numPurchased> </cflock> </cfif> <cfoutput> E-Turtleneck is proud to say that we have sold #application.number# turtlenecks to date. </cfoutput> <!--- End of Application.cfm --->