Programming ColdFusion MX, 2nd Edition

Security Basics

Before we dive into the different security techniques, let’s look at some general dos and don’ts to consider when designing and implementing a security solution for your ColdFusion applications:

• Don’t base security solely on a user’s IP address. IP addresses are easily spoofed and can often change during a user’s session (especially in the case of AOL users because of the way AOL’s network works). Additionally, dialup users most likely won’t have the same IP address the next time they dial in and use your application because most ISPs use DHCP.

• Do use SSL wherever necessary to encrypt the session between the server and the browser. Because SSL is handled at the web-server level and not by ColdFusion, you need to consult the documentation for your particular web server to determine how to set it up.

• Do require users to choose passwords that aren’t easily guessed or found in the dictionary. If possible, require users to choose a password that contains a combination of letters, numbers, and possibly symbols. One way to handle this is by automatically assigning passwords to users. If you let users choose their own passwords, you can still ensure they contain certain characters by using ColdFusion ReFind( ) function (described in Chapter 18).

• Do include error and exception handling in your applications to prevent users from receiving server and application information when an error or exception occurs. These concepts are covered in Chapter 9.

• Don’t store passwords ...