Snippets: SSL and the front controller
This is just a simple but useful snippet for managing the https status of various page requests being handled by a front controller based on some kind of action variable.
I'm not really a syntax guru, and I have heard there can be "gotchas" using cflocation, but this seems to work fine for me. Keep an eye out for the usual SSL gotchas: any resources with absolute non-https links (style sheets, images, javascript files, flash movies, etc) and forms going from secure action to non-secure action. Both will pop up warning boxes that your users won't like to see . . .
Only things to note in the code:
- SSLActionList is comma delimited list of actions (login, viewproducts, etc.) that require an SSL connection
- Input.get(‘action') is just how I access the input scope (URL + form scopes with form values taking precedence over URL ones) via an intelligent generic getter in my base bean and an input object that I use to handle validation of all user input.
<cfif ListFindNoCase(Local.SSLActionList, Input.get('action'))>
<!--- Should be secure --->
<cfif cgi.HTTPS EQ "off">
<cflocation url="https://#cgi.SERVER_NAME#/#cgi.SCRIPT_NAME#?#cgi.QUERY_STRING#" addtoken="no">
</cfif>
<cfelse>
<!--- Should NOT be secure --->
<cfif cgi.HTTPS EQ "on">
<cfparam name="cgi.QUERY_STRING" default="">
<cflocation url="http://#cgi.SERVER_NAME#/#cgi.SCRIPT_NAME#?#cgi.QUERY_STRING#" addtoken="no">
</cfif>
</cfif>
<!--- Should be secure --->
<cfif cgi.HTTPS EQ "off">
<cflocation url="https://#cgi.SERVER_NAME#/#cgi.SCRIPT_NAME#?#cgi.QUERY_STRING#" addtoken="no">
</cfif>
<cfelse>
<!--- Should NOT be secure --->
<cfif cgi.HTTPS EQ "on">
<cfparam name="cgi.QUERY_STRING" default="">
<cflocation url="http://#cgi.SERVER_NAME#/#cgi.SCRIPT_NAME#?#cgi.QUERY_STRING#" addtoken="no">
</cfif>
</cfif>



There are no comments for this entry.
[Add Comment]