Sorry, I should have been clearer -- we need to cache page contents to disk.
If cfcache is fundamentally limited and open to such attacks, can anyone suggest an efficient and robust page-caching tag that we can use with CF8? Thanks ________________________________ From: Brian Kotek <[email protected]> To: cf-talk <[email protected]> Sent: Fri, July 16, 2010 9:34:28 AM Subject: Re: cfcache security issue? Use action="clientcache"? On Fri, Jul 16, 2010 at 12:11 PM, Spencer K <[email protected]> wrote: > > Hi cfers, > > We are considering implementing cfcache on our busy site (CF8), but as I > understand it, CFMX creates a page on disk for every unique set of URL > variables. > > So what stops a malicious attacker performing an attack where they just > flood a > cached page with unique URLs? > > mycached.cfm?id=1 > > mycached.cfm?id=2 > ... > mycached.cfm?id=888888888888 > ... > ? > > As I understand it, the machine would cache templates to disk > indefinitely. If > the cached page is anything significant, it could quickly fill up the disk, > crashing the server, causing memory problems as disk space decreases, and > causing other significant disruptions. Or, the directory fills up with > tens of > thousands of files, causing all sorts of other performance issues. > > Is there any protection against this scenario? Any best practices with > cfcache > to prevent it? Is there an easy way to bound/limit the resources cfcache > can > use? > > Thanks > > > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Order the Adobe Coldfusion Anthology now! http://www.amazon.com/Adobe-Coldfusion-Anthology-Michael-Dinowitz/dp/1430272155/?tag=houseoffusion Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:335410 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm
