Question

I’ve been creating this pretty large web application for sometime and have been updating it. Overtime, I’ve learned a lot more things to make the system more functional. Now, I’m going back and trying to get rid of code that isn’t re-useable or is just plain odd/ quirky.

My first step is looking at my security hierarchy. My system runs on a security level backbone. X level can view X stuff…etc.

What is the best way to code that? Right now, I have a query that retrieves their security level and sets it as a session variable. These people can also belong to many other “departments” with different security levels. (The department is also stored as a session variable.) The webpages in my system check in my header to see if they can access the page or not. However, there is some places where I have dynamic forms and data that only certain security levels can view. In these areas I pretty much have cfif statements saying if security equals a certain level…show them this or show them that. So, on the same page someone might see something different.

Is there a better way to handle this? I feel like my code isn’t as good as it could be. (Well, it will never be as good as it could be.) I’m basically looking for suggestions on how to handle a security hierarchy in a better way.

(Note: I already have the system coded just looking for advise on coding style or verification if what I’m doing sounds right!”)

I’m also working on getting my queries more function like…and all in one place so they are not floating around randomly on some pages.

Answer 1

ColdFusion has role-based security built in. You have <cfloginuser> with its roles attribute and the IsUserInRole() function for authorization checks.

Also, you have a roles attribute on CFC functions. These take a comma-separated list of roles the user must be part of to be allowed to execute the function.

Your job would be to manage role membership (though a database table) and establish a user context when a session begins.

If you abstract your business logic away into components and put some thought into creating sensible roles, you can impose a very simple-to-use security model on your application.