Adobe ColdFusion 8

Building secure ColdFusion components

To restrict access to component methods, ColdFusion components use access, role-based, or programmatic security.

Using access security

CFC access security lets you limit the code that can access the components. You specify the access to a CFC method by specifying the cffunction access attribute, as follows:

Type

Description

private

Available only to the component that declares the method and any components that extend the component in which it is defined. This usage is similar to the Java protected keyword, not the Java private keyword.

package

Available only to the component that declares the method, components that extend the component, or any other components in the package. A package consists of all components defined in a single directory. For more information on packages, see Using component packages.

public

Available to any locally executing ColdFusion page or component method.

remote

Available to a locally or remotely executing ColdFusion page or component method, or to a local or remote client through a URL, form submission, Flash Remoting, or as a web service.

Using role-based security

If you specify a roles attribute in a cffunction tag, only users who are logged in with one of the specified roles can execute the method. When a user tries to invoke a method that he or she is not authorized to invoke, an exception is returned.

The following example creates a component method that deletes files:

<cfcomponent>
    <cffunction 
      name="deleteFile" access="remote" roles="admin,manager" output="no">
        <cfargument name="filepath" required="yes">
        <cffile action="DELETE" file=#arguments.filepath#>
    </cffunction>
</cfcomponent>

In the example, the cffunction tag includes the roles attribute to specify the user roles allowed to access it. In this example, only users in the role admin and manager can access the function. Notice that multiple roles are delimited by a comma.

For information on ColdFusion security, including the cflogin tag and role-based security in ColdFusion, see Securing Applications.

Using programmatic security

You can implement your own security within a method to protect resources. For example you can use the ColdFusion function IsUserInAnyRole to determine if a user is in particular role, as the following example shows:

<cffunction name="foo">
    <cfif IsUserInRole("admin")>
        … do stuff allowed for admin
    <cfelseif IsUserInRole("user")>
        … do stuff allowed for user
    <cfelse>
        <cfoutput>unauthorized access</cfoutput>
        <cfabort>
    </cfif>
</cffunction>