You can set the maximum number of cached templates in the CF Administrator. If you want to specifically cache a static html rendering with cfcache tag and you are worried about a directory filling up, I'd A) set an expiration on your item cache and B) write a task that monitors the cache directory and calls the flush action if the directory gets bigger than you want.
I don't know if upgrading to CF9 or Railo is an option for you, but they both use EhCache and I know that in CF9 at least you can define your own personal cache and set an object limit on it. If upgrading isn't an option, you could always install EhCache yourself and then put/get objects the cache yourself via http. Cheers, Judah On Fri, Jul 16, 2010 at 9:53 AM, Spencer K <[email protected]> wrote: > > Sorry, I should have been clearer -- we need to cache page contents to disk. > > If cfcache is fundamentally limited and open to such attacks, can anyone > suggest > an efficient and robust page-caching tag that we can use with CF8? > > Thanks > > > > > > ________________________________ > From: Brian Kotek <[email protected]> > To: cf-talk <[email protected]> > Sent: Fri, July 16, 2010 9:34:28 AM > Subject: Re: cfcache security issue? > > > Use action="clientcache"? > > On Fri, Jul 16, 2010 at 12:11 PM, Spencer K <[email protected]> wrote: > >> >> Hi cfers, >> >> We are considering implementing cfcache on our busy site (CF8), but as I >> understand it, CFMX creates a page on disk for every unique set of URL >> variables. >> >> So what stops a malicious attacker performing an attack where they just >> flood a >> cached page with unique URLs? >> >> mycached.cfm?id=1 >> >> mycached.cfm?id=2 >> ... >> mycached.cfm?id=888888888888 >> ... >> ? >> >> As I understand it, the machine would cache templates to disk >> indefinitely. If >> the cached page is anything significant, it could quickly fill up the disk, >> crashing the server, causing memory problems as disk space decreases, and >> causing other significant disruptions. Or, the directory fills up with >> tens of >> thousands of files, causing all sorts of other performance issues. >> >> Is there any protection against this scenario? Any best practices with >> cfcache >> to prevent it? Is there an easy way to bound/limit the resources cfcache >> can >> use? >> >> Thanks >> >> >> >> >> > > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Order the Adobe Coldfusion Anthology now! http://www.amazon.com/Adobe-Coldfusion-Anthology-Michael-Dinowitz/dp/1430272155/?tag=houseoffusion Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:335411 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm
