Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What do I need to do to tighten down a ColdFusion server for internet facing apps? The only thing that specifically came to mind was to restrict the CFIDE and JRunScripts directories to a local subnet.

Are there settings in the administrator I can tweak to make the applications more secure?

share|improve this question

4 Answers 4

up vote 4 down vote accepted
  1. Make sure you turn off debugging for production environments
  2. Have a site-wide error handler to mask any unhandled errors; otherwise the ugly grey box error message from CF will display, which could contain information about your server setup
share|improve this answer

UPDATE May 30, 2010:

Adobe just released the ColdFusion 9 Lockdown Guide (PDF) which includes all sorts of information for properly locking down and securing a ColdFusion server and application.

Original Post:

If only your own applications will be running on the server, start with locking down your web server of choice. Milner's suggestions to put a site-wide error handler to catch any expections is a good one to prevent data exposure. You can run debugging in a production environment as long as the output is restricted to specific IP addresses that you specify. As for the CFIDE folder, the only part that really needs to be locked down is the "administrator" sub-folder. There are a lot of things in the CFIDE folder which your application may need if you're using any of the ColdFusion form controls.

Outside of the ColdFusion Server itself, there are a lot of things you need to consider in your code such as:

  1. Use CFQUERYPARAM on your queries.
  2. Do not trust user input from the CGI, COOKIE, URL or FORM scopes. Always sanitize the input and do not take any chances with it.
  3. For data that users have entered that will be displayed layer, ensure it's wrapped with the HTMLEditFormat() or JSStringFormat() functions as the case calls for to present cross-site scripting attacks.
share|improve this answer
1  
Don't forget CGI scope contains client-provided information! –  Peter Boughton May 7 '09 at 21:37
1  
Also for 3, sometimes JsStringFormat may be more appropriate - depending on where the data will be used. –  Peter Boughton May 7 '09 at 21:38
    
Excellent additions Peter, I'll update the post. –  Justin Scott May 7 '09 at 21:52

It may be obvious, but if the server is Internet facing (directly accessible with a public IP), you definitely need some kind of firewall in place- at least a software firewall in your OS or a hardware device to protect the server.

share|improve this answer

Try out www.hackmycf.com , it's a security analysis tool made by Foundeo and works pretty good!

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.