User Guide

Table Of Contents
Structuring an application 279
The Application.cfm page can define the application. It can contain the cfapplication tag that
specifies the application name, and code on this page is processed for all pages in the application.
This page can define application-level settings, functions, and features.
The OnRequestEnd.cfm page is used in fewer applications than the Application.cfm page. It lets
you provide common clean-up code that gets processed after all application pages, or specify
dynamic footer pages.
Tip: The OnRequestEnd.cfm page does not execute if the page invokes a cflocation tag.
For more information on the Application.cfm and OnRequestEnd.cfm pages, see “Using an
Application.cfm page” on page 295. For information on placing these pages in the application
directory structure, see Structuring an application” on page 279.
Note: You can create a ColdFusion application without using an Application.cfc, Application.cfm, or
OnRequestEnd.cfm page. However, it is much easier to use the Application.cfm page than to have
each page in the application use a
cfapplication tag and define common application elements.
Application security and user identification
All applications must ensure that malicious users cannot make improper use of their resources.
Additionally, many applications require user identification, typically to control the portions of a
site that the user can access, to control the operations that the user can perform, or to provide
user-specific content. ColdFusion provides the following forms of application security to address
these issues:
Resource (file and directory-based) security Limits the ColdFusion resources, such as tags,
functions, and data sources that application pages in particular directories can access. You must
consider the resource security needs of your application when you design the application directory
structure.
User (programmatic) security Provides an authentication (login) mechanism and a role-based
authorization mechanism to ensure that users can only access and use selected features of the
application. User security also incorporates a user ID, which you can use to customize page
content. To implement user security, you include security code, such as the
cflogin and
cfloginuser tags, in your application.
For more on implementing security, see Chapter 16, “Securing Applications,” on page 373.
Structuring an application
When you design a ColdFusion application, you must structure its contents into directories and
files, also known as mapping the directory structure. This activity is an important step in
designing a ColdFusion application. Before you start building the application, you must establish
a root directory for the application. You can store application pages in subdirectories of the root
directory.
The following sections describe how ColdFusion uses application-specific pages and how you can
organize your application pages in a directory structure.