ColdFusion Developer's Guide

Beta Beta Beta Beta Beta Beta Beta Beta Beta Beta
Using ColdFusion security without cookies
You can implement a limited-lifetime form of ColdFusion security if the user’s browser does
not support cookies. In this case you do not use the cflogin tag, only the cfloginuser tag.
It is the only time you should use the cfloginuser tag outside a cflogin tag.
Without browser cookies, the effect of the cfloginuser tag is limited to a single HTTP
request. You must provide your own authentication mechanism and call cfloginuser on
each page on which you use ColdFusion login identification.
Using ColdFusion security tags and
functions
ColdFusion provides the following tags and functions for user security:
Tag or function Purpose
cflogin A container for user authentication and login code. The body of the
tag runs only if the user is not logged in. When using applicationbased
security, you put code in the body of the cflogin tag to check
the user-provided ID and password against a data source, LDAP
directory, or other repository of login identification. The body of the
tag includes a cfloginuser tag (or a ColdFusion page that contains a
cfloginuser tag) to establish the authenticated user’s identity in
ColdFusion.
cfloginuser Identifies (logs in) a user to ColdFusion. Specifies the user’s ID,
password, and roles. This tag is typically used inside a cflogin tag.
The cfloginuser tag requires three attributes, name, password, and
roles, and does not have a body. The roles attribute is a commadelimited
list of role identifiers to which the logged-in user belongs. All
spaces in the list are treated as part of the role names, so you should
not follow commas with spaces.
While the user is logged-in to ColdFusion, security functions can
access the user ID and role information.
cflogout Logs out the current user. Removes knowledge of the user ID and
roles from the server. If you do not use this tag, the user is
automatically logged out as described in “Logging out users”
on page 468.
The cflogout tag does not take any attributes, and does not have a
body.
Using ColdFusion security tags and functions 463