Security - Revision history

Rwest at 03:33, 6 April 2010

2010-04-06T03:33:02Z

Rwest at 03:31, 6 April 2010

2010-04-06T03:31:23Z

Renee.mckechnie: /* Overview */

2009-12-19T23:12:05Z

‎Overview

Renee.mckechnie: Created page with '== Overview == ADF security framework contains measures to restrict direct access and remote component access. Security Measures include: # As a rule of thumb none of the compon…'

2009-11-22T03:10:28Z

Created page with '== Overview == ADF security framework contains measures to restrict direct access and remote component access. Security Measures include: # As a rule of thumb none of the compon…'

New page

== Overview ==
ADF security framework contains measures to restrict direct access and remote component access.

Security Measures include:
# As a rule of thumb none of the component methods within the ADF library have functions with methods with "remote" access
# Direct access to the ADF files are restricted to only valid logged in CommonSpot users. This is controlled through the ADF root Application.cfc. In the ''onRequestStart'' function, logic is run to verify that the user accessing the file directly is a logged in CommonSpot user.
# Remote access to component methods are requested through an [[Ajax Proxy| Ajax Proxy]] that essentially allows access to methods in the ADF via a [[ Proxy White List | Proxy White List]].

← Older revision		Revision as of 03:33, 6 April 2010
Line 12:		Line 12:
	Some of this data may be contained within a .xml file which can't easily be protected by ColdFusion security measures. As a result of this challenge, we recommend that you prevent web access to this directory (/mySite/_cs_apps/config/) at the web server level.		Some of this data may be contained within a .xml file which can't easily be protected by ColdFusion security measures. As a result of this challenge, we recommend that you prevent web access to this directory (/mySite/_cs_apps/config/) at the web server level.

−	[[Category: Security]]	+	[[Category: Security]][[Category: Configuration]]

@@ Line 1: / Line 1: @@
 == Overview ==
-The ADF security framework contains measures to restrict direct access and remote component access.
+In general, the ADF security framework is designed to help control calls to potentially dangerous components. The largest threat to the calls to the components within the ADF is through the web.  We are not offering any functionality that is not already available to a developer with access to your CommonSpot installation.
-Security Measures include:
+== Security Measures ==
-# As a rule of thumb, none of the component methods within the ADF library have functions with methods with "remote" access
+# As a rule of thumb, none of the component methods within the ADF library have functions with methods with "remote" access.  This prevents direct web calls to any components within the ADF
-# Direct access to the ADF files are restricted to only valid, logged in CommonSpot users.  This is controlled through the ADF root Application.cfc.  In the ''onRequestStart'' function, logic is run to verify the user accessing the file directly is a logged in CommonSpot user.
+# The Application.cfc located within the root of the ADF directory contains code within the onRequestStart method that prevents direct calls to scripts or code by anyone who is _not_ a CommonSpot contributor.
 # Remote access to component methods are requested through an [[Ajax Proxy| Ajax Proxy]] that essentially allows access to methods in the ADF via a [[ Proxy White List | Proxy White List]].
 [[Category: Security]]