[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Secure Login

Posted on 2006-07-14
5
Medium Priority
?
219 Views
Last Modified: 2013-12-24
I am pretty new to Cold Fusion and I want to use the application.cfm to check if the user logged in.  I've been trying to figure it out and I just can't.  Here is the code to my login page.  The user login and password is in a table called tbl_QA_staff.  The fields are strUserID and strPassword.

            <cfform name="loginform" action="QAQ_home.cfm" method="post">
              <table width="80%" cellspacing="2" cellpadding="2" align="center" bgcolor="#C0C0C0">
                <tr>
                  <td colspan="2" align="center" class="small"> Please enter your
                    Employee login and password.<br> <img src="../images/dot_clear.gif" width="1" height="10">
                  </td>
                </tr>
                <tr>
                  <th align="right" class="normal"><b>Login:</b></th>
                 
                    <td><cfinput type="text"
                        required="Yes"
                        size="15"
                        maxlength="17"
                        name="UserName"
                        value=""
                        class="smallblue">
                    </td>
                 
                </tr>
                <tr>
                  <th align="right" class="normal"><b>Password:</b></th>
                  <td><cfinput type="password"
                        required="Yes"
                        size="15"
                        maxlength="8"
                        name="password"
                        value=""
                        class="smallblue">      
                  </td>
                </tr>
                <tr>
                  <td colspan="2"><img src="../images/dot_clear.gif" width="1" height="15"></td>
                </tr>
                <tr>
                  <td colspan="2" align="right"><input type="Image" src="../images/go.gif" name="login_user" value="Log In"></td>
                </tr>
              </table>
            </cfform> </td>


At this point once they hit the button and go to QAQ_home.cfm.  I use a simple query and recordcount to check if the user exists.  Here is the code for that

      <!-- BEGIN VERIFICATION QUERY SECTION -->

      <CFQUERY name="getUser" datasource="QAQ">
      SELECT *
      FROM TBL_QA_Staff
      WHERE strUserID = '#form.username#'
      AND   strPassword = '#form.password#'      
      </CFQUERY>
      <!-- END VERIFICATION QUERY SECTION -->


      <!-- Verify User and set up sessions -->
      <CFIF getUser.RecordCount gt 0>
            <cfset dt = #dateformat(CreateODBCDate(now()),"mm/dd/yyyy")#+1>
            <cfset Session.UserName = getUser.strQA_name>
            <cfset Session.UserID = getUser.QA_ID>
            <cfset Session.UserLogin = getUser.strUserID>
            <cfset Session.UserLoc = getUser.StrQA_loc>
      <CFELSE>
      <!--- BEGIN User does not exist --->
      <cflocation url="#loginpage#">
      </CFIF>

I was told that this is not the most secure way to do things and that I should authenticate the user in the application.cfm.  My question is how do I do that?
0
Comment
Question by:trifecta2k
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
5 Comments
 
LVL 13

Accepted Solution

by:
usachrisk1983 earned 2000 total points
ID: 17111383
Inside your application.cfm file, do something like this:

<cfif not isDefined('session.UserName') and ListLast(cgi.script_name,'/') neq 'login.cfm'>
   <cflocation url="login.cfm">
   <cfabort>
</cfif>

This will cause login.cfm to load if session.username doesn't exist.  Use login.cfm to authenticate the user (you can use it as both the form page and the action page), and set session.username when you've authenticated them.  Now each page of your site will make sure the user is logged in before allowing them to view the page.
0
 
LVL 5

Author Comment

by:trifecta2k
ID: 17111569
How do I use the login.cfm as teh form and the action page?  I'm sorry I'm just new to this and I don't know how to do that.  
0
 
LVL 13

Expert Comment

by:usachrisk1983
ID: 17111619
No problem :)  Something like this should work for you:

<cfif isDefined('form.username')>

  <!--- The user has submitted the form --->
  <cfquery name="x" datasource="y">
    select something from somewhere
  </cfquery>
  <!--- Verify the user has access to login, and set your session variable>

<cfelse>

  <!--- Show the form here, either exclude the ACTION or set it back to the same page. --->

</cfif>
0
 
LVL 5

Author Comment

by:trifecta2k
ID: 17111720
Seems like everything works.  Before the <CFELSE>  I added a <CFLOCATION> to move the application along and it works just fine.   I have one last question.  This is something new that I just noticed.  How so I get rid of the session variables.  They seem to never delete.
0
 
LVL 5

Author Comment

by:trifecta2k
ID: 17111915
Nevermind, I got it. Thanks for all your help.
0

Featured Post

Moving data to the cloud? Find out if you’re ready

Before moving to the cloud, it is important to carefully define your db needs, plan for the migration & understand prod. environment. This wp explains how to define what you need from a cloud provider, plan for the migration & what putting a cloud solution into practice entails.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Have you ever sent email via ColdFusion and thought of tracking this mail to capture the exact date and time when the message was opened ?  If yes, then this article is for you ! First we need a table user_email with columns user_id , email , sub…
Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
Video by: ITPro.TV
In this episode Don builds upon the troubleshooting techniques by demonstrating how to properly monitor a vSphere deployment to detect problems before they occur. He begins the show using tools found within the vSphere suite as ends the show demonst…
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
Suggested Courses

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question