[cfaussie] RE: cflogin

[spike]

The main advantages are: It gives you a single sign on mechanism for flash, integrated windows authentication and ColdFusion It provides you with a standard mechanism for specifiying the roles to which a user belongs and a native function to test for role membership. It provides you with a standard mechanism to get the username of the logged-in user. The main disadvantages are: It gives you a single sign on mechanism which provides a wider target for script kiddies It puts the username and password into the authentication cookie without encrypting them. It's a session cookie, but it's a potential problem nonetheless. It does not provide any standard mechanism to tie roles to permissions, so you usually end up either hard coding permissions per role, or building your own mechanism. On balance, if you're comforatable writing your own code and you're sure that your own login process is secure you might as well avoid cflogin. If you're not 100% sure that your own login process is secure, it is probably worth taking a second look at cflogin. my 2c Spike Mark M wrote: I am probably going to start a big hoo haa saying this, but I personally dont see the point of CFLOGIN apart from the user roles within CFCs. That is the only functionality it provides. Corrections please? I'll second that one. How hard is it to go 'session.userloggedIn = true' Ouch... my pinky hurts :oD Mark ----------------------------------- [EMAIL PROTECTED] ICQ: 3094740 Safe From Bees [www.safefrombees.com] --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/ --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/