Data Security

[WebGodiva]

I have an extranet application that I have set up.&nbsp;&nbsp;I have created an application.cfm for each directory as follows:<br><br>&lt;cfapplication <br>name=&quot;session.authenticated&quot; <br>sessionmanagement=&quot;Yes&quot; <br>setclientcookies=&quot;Yes&quot; <br>sessiontimeout=&quot;#CreateTimeSpan(0,0,30,0)#&quot; applicationtimeout=&quot;#CreateTimeSpan(1,0,0,0)#&quot;&gt;<br><br>&lt;CFSET session.authenticated=&quot;#cfid#&cftoken=#cftoken#&quot;&gt;<br><br>&lt;CFPARAM name=&quot;session.authenticated&quot; DEFAULT=&quot;FALSE&quot;&gt;<br><br>&nbsp;&nbsp;&lt;!-- If the user is not yet logged in, and not currently on the login pages,<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;or the forgotten password page, --&gt;<br>&nbsp;&nbsp;&lt;CFIF #Session.authenticated# IS &quot;FALSE&quot;&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;CFIF (CGI.SCRIPT_NAME IS NOT &quot;default.cfm&quot <br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AND (CGI.SCRIPT_NAME IS NOT &quot;error.cfm&quot&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;SCRIPT LANGUAGE=&quot;JavaScript&quot;&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;alert(&quot;The system has detected an invalid login.<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;You will be prompted for your login/password again.&quot;<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;self.location='default.cfm';<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;/SCRIPT&gt; <br>&nbsp;&nbsp;&nbsp;&nbsp;&lt;/CFIF&gt;<br>&nbsp;&nbsp;&lt;CFELSE&gt;<br>&nbsp;&nbsp;&lt;/CFIF&gt;<br><br><br>I have included the following code at the top of each document used in this site:<br><br>&lt;cfif not isdefined(&quot;session.authenticated&quot&gt;<br>&nbsp;&nbsp;&lt;cfoutput&gt;<br>&nbsp;&nbsp;&nbsp;&nbsp;You are not authenticated, or your session has timed out<br>&nbsp;&nbsp;&lt;/cfoutput&gt;<br>&nbsp;&nbsp;&lt;cfabort&gt;<br>&lt;/cfif&gt;<br><br>My problem is that you can bookmark the pages, and if you type a direct URL request with page name you can access the pages.&nbsp;&nbsp;What have I done wrong with the code, I need to prevent people from being able to access the pages if they have not logged in on the default.cfm page which passes username and password to the intranet.cfm which then loads the appropriate page based on log in.<br><br>I thought that by using the application.cfm it would prevent direct URL calls.&nbsp;&nbsp;Any help would be appreciated.

 

[dbarnhart]

The problem is simple, really.<br><br>&lt;CFSET session.authenticated=&quot;#cfid#&cftoken=#cftoken#&quot;&gt; sets session.authenticated to a non-null value.<br><br>the subsequent CFPARAM is then useless.&nbsp;&nbsp;&lt;CFPARAM&gt; simply creates a variable and assigns an initial value to it ONLY IF IT DOES NOT ALREADY EXIST.&nbsp;&nbsp;session.authenticated already exists when the CFPARAM is processed, so it does nothing.<br><br>Therefore &lt;CFIF #Session.authenticated# IS &quot;FALSE&quot;&gt; will never evaluate to true.

 

[sriram]

You may use an application variable and set a value in default.cfm and check the value of the varaible at the beginning of each page.<br>Accordingly, you can fire a message and then &lt;cfabort&gt;