By Peter Bell

Snippets: SSL and the front controller

This is just a simple but useful snippet for managing the https status of various page requests being handled by a front controller based on some kind of action variable.

I'm not really a syntax guru, and I have heard there can be "gotchas" using cflocation, but this seems to work fine for me. Keep an eye out for the usual SSL gotchas: any resources with absolute non-https links (style sheets, images, javascript files, flash movies, etc) and forms going from secure action to non-secure action. Both will pop up warning boxes that your users won't like to see . . .

Only things to note in the code:

  • SSLActionList is comma delimited list of actions (login, viewproducts, etc.) that require an SSL connection
  • Input.get(‘action') is just how I access the input scope (URL + form scopes with form values taking precedence over URL ones) via an intelligent generic getter in my base bean and an input object that I use to handle validation of all user input.

<cfif ListFindNoCase(Local.SSLActionList, Input.get('action'))>
   <!--- Should be secure --->
   <cfif cgi.HTTPS EQ "off">
   <cflocation url="https://#cgi.SERVER_NAME#/#cgi.SCRIPT_NAME#?#cgi.QUERY_STRING#" addtoken="no">
   </cfif>
<cfelse>
   <!--- Should NOT be secure --->
   <cfif cgi.HTTPS EQ "on">
      <cfparam name="cgi.QUERY_STRING" default="">
      <cflocation url="http://#cgi.SERVER_NAME#/#cgi.SCRIPT_NAME#?#cgi.QUERY_STRING#" addtoken="no">
   </cfif>
</cfif>

Comments
BlogCFC was created by Raymond Camden. This blog is running version 5.005.