• Create BookmarkCreate Bookmark
  • Create Note or TagCreate Note or Tag
  • PrintPrint
Share this Page URL

Chapter 8. Security > Security Basics

8.1. Security Basics

Before we dive into the different security techniques, let's look at some general do's and don'ts to consider when designing and implementing a security solution for your ColdFusion applications:

  • Don't base security solely on a user's IP address. IP addresses are easily spoofed and can often change during a user's session (especially in the case of AOL users because of the way AOL's network works). Additionally, dialup users most likely won't have the same IP address the next time they dial in and use your application because most ISPs use DHCP.

  • Do use SSL whenever possible to encrypt the session between the server and the browser. Because SSL is handled at the web-server level and not by ColdFusion, you need to consult the documentation for your particular web server to determine how to set it up.

  • Do require users to choose passwords that aren't easily guessed or found in the dictionary. If possible, require users to choose a password that contains a combination of letters, numbers, and possibly symbols. One way to handle this is by automatically assigning passwords to users. There is a custom tag called CF_RandomPassword, described in Chapter 19, that can do this automatically for you. If you let users choose their own passwords, you can still ensure they contain certain characters by using ColdFusion's ReFind( ) function (described in Chapter 17).

  • Do include error and exception handling in your applications to prevent users from receiving server and application information when an error or exception occurs. These concepts are covered in Chapter 9.

  • Don't store passwords as clear text if you store them in a database or LDAP directory. Use the Hash( ) function or some other method to obfuscate the password before storing it.

  • Don't pass usernames and passwords from template to template in URLs or as hidden form fields because this increases the potential for compromise. Use session variables to store and pass usernames and passwords from template to template, because they are stored in the ColdFusion server's memory and expire when a user's session expires.



Not a subscriber?

Start A Free Trial

  • Creative Edge
  • Create BookmarkCreate Bookmark
  • Create Note or TagCreate Note or Tag
  • PrintPrint