Coldfusion security

Hello experts.
This question is for coldfusion security.
I have to prefer  <cflocation addtoken="yes"... with setclientcookies="no" in cfapplication
for more security?
If i make this change  will i have problems?
I'm asking because i'm using now the opposed:
<cflocation addtoken="no"... with setclientcookies="yes" in cfapplication
LVL 2
PanosAsked:
Who is Participating?
 
_agx_Commented:
Going by the references to allaire and macromedia that presentation is outdated, circa 2002.

If delete/insert/update pages are refreshed, or other action pages, problems occur – hacker sees error message.
-Immediately <CFLOCATION> after one of these actions to avoid this
-Use the addtoken=“yes” parameter to keep any session changes across pages

When they talk about addToken="yes",  they're talking about an old issue with session variables and cflocation that's generally not a problem anymore.  If you read the full KB entry notice it states that using addToken="yes" is actually a security risk.

...you should be aware that passing CFID and CFToken as URL parameters can be a security risk.

These days most people recommend *not* using addToken. Also, the default CFID/CFTOKEN are more easily guessable than other options. Using the UUID or J2EE session management settings is considered more secure.


0
 
RickEpnetCommented:
Well think about this for a sec. If you use addtoken="YES" ok so now you do not have to have the token in a cookie but you have stuck it out in the open in the URL.

Maybe I am missing something as to what you are doing or trying to do??
0
 
PanosAuthor Commented:
Hi RickEpnet.
It is general question.Do or not use addtoken="YES".I read in a forum that it is safer to use YES instead of having the token in a cookie.So i want to know the opinion of the experts here.
0
Cloud Class® Course: SQL Server Core 2016

This course will introduce you to SQL Server Core 2016, as well as teach you about SSMS, data tools, installation, server configuration, using Management Studio, and writing and executing queries.

 
RickEpnetCommented:
Can you point me to the forum so I can see the context.

So in this case you would run cookieless site right?
0
 
PanosAuthor Commented:
Hi again.
Here the link of a ppt file:
www.cfconf.org/denvercf/talks/cf_code_security.ppt
0
 
PanosAuthor Commented:
Thank you very much for your help.
Here is another problem i have :http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/Cold_Fusion_Markup_Language/Q_26636239.html
Can you help me?


regards
Panos
0
 
_agx_Commented:
Sorry, I was just heading to sleep.  I'd have to think about that one.  When my brain's not so tired ;-)
0
 
_agx_Commented:
Btw: Don't know if you're in the US, but Thur/Fri are a holiday for most people.  That's probably why responses are slow.
0
 
PanosAuthor Commented:
OK
I hope you will find some time to look at this question.
There are too many things in the net but not a complete solution that could cover everything.
i'm not in US but in EU and when i wake up you go to sleep.HAHA....
0
 
_agx_Commented:
There are too many things in the net but not a complete solution that could cover everything.

That's because there isn't 1 complete solution. Unfortunately, there are different types of threats, and new ones uncovered frequently. Each requires different ways to defend against them.  Security is too important. That's why I didn't rush in and say "sure. you can fix everything just by doing (something)".  Anyone that says that is either misinformed or .. just plain lying ;-)  

i'm not in US but in EU and when i wake up you go to sleep.HAHA....

Haha, I figured.  
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.