ColdFusion 9.0 Resources

Building secure ColdFusion components

Contents [Hide]

Using access security
Using role-based security
Using programmatic security

To restrict access to component methods, ColdFusion components use access, role-based, or programmatic security.

Using access security

CFC access security lets you limit the code that can access the components. You specify the access to a CFC method by specifying the cffunctionaccess attribute, as follows:

Type	Description
private	Available only to the component that declares the method and any components that extend the component in which it is defined. This usage is like the Java protected keyword, not the Java private keyword.
package	Available only to the component that declares the method, components that extend the component, or any other components in the package. A package consists of all components defined in a single directory. For more information on packages, see Using component packages.
public	Available to any locally executing ColdFusion page or component method.
remote	Available to a locally or remotely executing ColdFusion page or component method, or to a local or remote client through a URL, form submission, Flash Remoting, or as a web service.

Using role-based security

If you specify a roles attribute in a cffunction tag, only users who are logged in with one of the specified roles can execute the method. When a user tries to invoke a method without authorization, an exception is returned.

The following example creates a component method that deletes files:

<cfcomponent> 
    <cffunction  
         name="deleteFile" access="remote" roles="admin,manager" output="no"> 
        <cfargument name="filepath" required="yes"> 
        <cffile action="DELETE" file=#arguments.filepath#> 
    </cffunction> 
</cfcomponent>

In the example, the cffunction tag includes the roles attribute to specify the user roles allowed to access it. In this example, only users in the role admin and manager can access the function. Notice that multiple roles are delimited by a comma.

For information on ColdFusion security, including the cflogin tag and role-based security in ColdFusion, see Securing Applications.

Using programmatic security

You can implement your own security within a method to protect resources. For example you can use the ColdFusion function IsUserInAnyRole to determine if a user is in particular role, as the following example shows:

<cffunction name="foo"> 
    <cfif IsUserInRole("admin")> 
        … do stuff allowed for admin 
    <cfelseif IsUserInRole("user")> 
        … do stuff allowed for user 
    <cfelse> 
        <cfoutput>unauthorized access</cfoutput> 
        <cfabort> 
    </cfif> 
</cffunction>