User Guide

Implementing user security 391
With code similar to the following:
<cfquery name="loginQuery" dataSource="#Application.DB#" >
SELECT *
FROM Users
WHERE UserName = <cfqueryparam value="#uUserName#" CFSEQLType=
"CF_SQL_VARCHAR"AND password = <cfqueryparam value="#uPassword#"
CFSEQLType="CF_SQL_VARCHAR>"
</cfquery>
<cfif loginQuery.recordcount gt 0>
<cfset retargs.authenticated="YES">
<cfset retargs.roles=loginQuery.roles>
<cfelse>
<cfset retargs.authenticated="NO">
</cfif>
<cfreturn retargs>
Note: For greater security, consider using a hashed password. Do not store the password directly in
the database; instead, use the
hash function to create a secure password fingerprint, and store it in the
database. When the user provides a password, use the
Hash function on the submitted string and
compare it with the value in the database.
Web server–based authentication user security example
The example in this section shows how you might implement user security using web-server–
based basic authentication and two roles, user and administrator.
This example has two ColdFusion pages:
• The Application.cfc page logs the user into the ColdFusion security system and assigns the user
to specific roles based on the user’s ID.
This page also includes the one-button form and logic for logging out a user, which appears at
the top of each page.
• The securitytest.cfm page is a sample application page. It displays the logged-in user’s roles.
This simple example does not provide a user log-out interface. You can test the security behavior
by adding your own pages to the same directory as the Application.cfc page.
Example: Application.cfc
The Application.cfc page consists of the following:
<cfcomponent>
<cfset This.name = "Orders">
<cffunction name="OnRequestStart">
<cfargument name = "request" required="true"/>
<cflogin>
<cfif IsDefined("cflogin")>
<cfif cflogin.name eq "admin">
<cfset roles = "user,admin">
<cfelse>
<cfset roles = "user">
</cfif>
<cfloginuser name = "#cflogin.name#" password = "#cflogin.password#"