> We are considering implementing cfcache on our busy site (CF8), but as I > understand it, CFMX creates a page on disk for every unique set of URL > variables.
That's correct. > So what stops a malicious attacker performing an attack where they just flood > a > cached page with unique URLs? I'm not aware of anything stopping anyone from doing this. But on the other hand, they'd have to assume or know that you're using CFCACHE for it to be effective, and they could just as easily flood your server with any other arbitrary requests faster than your server could respond - whether you're using CFCACHE or not. > As I understand it, the machine would cache templates to disk indefinitely. > If > the cached page is anything significant, it could quickly fill up the disk, > crashing the server, causing memory problems as disk space decreases, and > causing other significant disruptions. Or, the directory fills up with tens > of > thousands of files, causing all sorts of other performance issues. You'd need a lot of HTML files to fill a disk - your server would probably keel over from concurrent requests long before the disk was full. > Is there any protection against this scenario? Any best practices with > cfcache > to prevent it? Is there an easy way to bound/limit the resources cfcache can > use? You can periodically flush the cache. You could also identify whether a request pointed to a valid resource before creating the cache in the first place - if there's no corresponding database record for the ID they passed, don't cache the page (or redirect to a cached page that says "no record found"). Dave Watts, CTO, Fig Leaf Software http://www.figleaf.com/ http://training.figleaf.com/ Fig Leaf Software is a Veteran-Owned Small Business (VOSB) on GSA Schedule, and provides the highest caliber vendor-authorized instruction at our training centers, online, or ons ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Order the Adobe Coldfusion Anthology now! http://www.amazon.com/Adobe-Coldfusion-Anthology-Michael-Dinowitz/dp/1430272155/?tag=houseoffusion Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:335419 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/groups/cf-talk/unsubscribe.cfm
