User Guide

Table Of Contents

390 Chapter 16: Securing Applications

• The logout method logs a user out. If you specified Browser Dialog Box as the login page type,

it also calls the closeBrowser method to close the browser window. This behavior is necessary

because the browser continues to send the old login credentials after the user logs out, and the

cflogin tag will automatically use them and log the user in again.

• The closeBrowser method closes the browser window or tells the user to close the browser

window to complete the logout, depending on the browser type.

mm_wizard_login.cfm This file contains a ColdFusion MX login form. The wizard generates

this file for all options, but does not use it if you specify Browser Dialog login.

index.cfm or mm_wizard_index.cfm The wizard generates an index.cfm page if the directory

does not have one; otherwise, creates an mm_wizard_index.cfm page. These pages let you test the

generated login code before you implement your application, or without using any of your

standard application pages. To test your login, open the index.cfm page in your browser.

Modifying the login code for your application

The Login Wizard creates a basic framework for authenticating a user. You must customize this

framework to meet your application’s needs. Typical security-related changes include the

following:

• Providing user-specific role information in the cflogin tag

• Authenticating users against a database

Providing user-specific role information

The Login Wizard sets all users in a single role. In mm_wizard_authenticate.cfc, the performlogin

method is hard-coded to set the role to “user.” The authentication routines handle roles

differently. (For the details, see the mm_wizard_authenticate.cfc code.) If your application uses

roles for authorization, you must change the authentication method to get and return valid role

information, and change the performlogin method to use the information in the

roles attribute

of its

cfloginuser tag.

Authenticating users against a database

If you use a database to maintain user IDs and passwords, you can create your login framework by

specifying simple authentication, and modify the code to use the database. The following

instructions describe a simple way to change the code to use a database. They do not include all

the cleanup work (particularly, removing the hard-coded user name and password), that you

should do for a well-formatted application.

Replace the following code:

</cfif>