User Guide

376 Chapter 16: Securing Applications
Note: For more information on configuring resource and sandbox security, see Configuring and
Administering ColdFusion MX and the ColdFusion MX Administrator online Help.
Sandbox security
In ColdFusion Enterprise, sandbox security lets you apply different sets of rules to different
directory structures. You can use it to partition a shared hosting environment so that a number of
applications with different purposes, and possibly different owners, run securely on a single server.
When multiple applications share a host, you set up a separate directory structure for each
application, and apply rules that let each application access only its own data sources and files.
Sandbox security also lets you structure and partition an application to reflect the access rights
that are appropriate to different functional components. For example, if your application has both
employee inquiry functions and HR functions that include creating, accessing, and modifying
sensitive data, you could structure the application as follows:
• HR pages go in one directory with access rules that enable most activities.
• Employee pages go in another directory whose rules limit the files they can modify and the tags
they can use.
• Pages required for both HR and employee functions go in a third directory with appropriate
access rules.
About user security
User security lets your application use security rules to determine what it shows. It has two
elements:
Authentication Ensures that a valid user is logged-in, based on an ID and password provided by
the user. ColdFusion (or, in some cases if you use web server authentication, the web server)
maintains the user ID information while the user is logged-in.
Authorization Ensures that the logged-in user is allowed to use a page or perform an operation.
Authorization is typically based on one or more roles (sometimes called groups) to which the user
belongs. For example, in an employee database, all users could be members of either the employee
role or the contractor role. They could also be members of roles that identify their department,
position in the corporate hierarchy, or job description. For example, someone could be a member
of some or all of the following roles:
• Employees
• Human Resources
• Benefits
• Managers
Files/directories Sets read, write, execute, and delete access to specified directories,
directory trees, or files.
Server/ports Controls access from ColdFusion to IP addresses and port numbers. You
can specify host names or numeric addresses, and you can specify
individual ports and port ranges..
Resource Description