Join GitHub today
GitHub is home to over 28 million developers working together to host and review code, manage projects, and build software together.Sign up
Nonce manager for Coldfusion forms for more information, wiki, issue tracker, and feature requests visit http://tokenizer.riaforge.org
Fetching latest commit…
Cannot retrieve the latest commit at this time.
|Failed to load latest commit information.|
Welcome to Tokenizer 1.1! Tokenizer is a Nonce/Token management system for preventing XSRF (cross site request forgery) on coldfusion based forms. It's purpose is to create a simple standardized way to manage tokens and prevent blind posts that could be hazardous to your users or system. Check out the examples, tokenizer.riaforge.org, and designfrontier.net if you have questions or issues. The article about Tokenizer and implementing it is here: http://designfrontier.net/articles/?id=9 QUICK NOTES ON IMPLENTATION Create tokenizer object in VARIABLES scope and reference functions. DETAILED NOTES ON IMPLEMENTATION The process of implementation goes something like this: Step 1 -> Create a tokenizer instance and pass it the session scope (if the page posts to itself place this at the very top, before the form processing that will save you having to complete step 4 later) variables.tokenizer = createObject('component','admin.com.tokenizer').init(session); Name of the tokenizer variable doesn't really matter here. Step 2 -> Create a new token. This takes two arguments: 1) The name of the token (no spaces, must be a valid variable name) 2) the time in seconds before the token expires (make this reasonable considering the length of the form) IMPORTANT:: If the form self posts then this should be done after the form processing code but before the display of the form itself. variables.tokenizer.createToken('tokenName',300); Step 3 -> Write the token to the page with in the <form> <cfoutput>#variables.tokenizer.writeTokenToPage('tokenName')#</cfoutput> The rest of the implementation happens in your form processing code Step 4 -> Create an instance of the tokenizer if you are self-posting this form and you followed Step 1 (hint hint) then you can skip this step and collect $200. variables.tokenizer = createObject('component','admin.com.tokenizer').init(session); Step 5 -> in the IF statement that kicks off form processing add the following AND variables.tokenizer.checkToken('tokenName',form.xsrf_token) This does all the checking to ensure that the token is valid Step 6 -> inside the form processing IF statement and after you are done with all the form processing add this line <cfset variables.tokenizer.removeToken('tokenName')> This removes the token and prevents the form from being double posted. Changes ----------------------------------------- 1.2 Added a getTokenValue method for working with AJAX requests and tokens. Updated the example docs with the AJAX examples. 1.1 Corrected a bug in the submit.cfm that referenced the wrong token name when removing the token. Added a checkTokenLife() method that returns the number of seconds left in the life of a token. Added a checkTokenLifeRemote() method for remote access to the number of seconds left in the life of a token. Added output="no" to the component and the methods within it. 1.0.2 The only change in 1.0.2 was the addition of demos for self posting and posting to another page. 1.0.1 The only change for 1.0.1 is the addition of an id to the hidden input that is created by writeTokenToPage() 1.0.0 This is the base release. Check out the CFC and the comments in it to understand all the features, etc. Requirements ----------------------------------------- Tokenizer has been tested on CF 9.0.1 and Railo 3.2.2+. It should also work on CF 8 and OpenBD, though it has not been tested in these configurations. If you test it and it works email firstname.lastname@example.org and I'll add it to this list and credit you with testing it. Thanks! Credits ----------------------------------------- The application.cfc in the examples is heavily based on Ben Nadel's application.cfc template (http://www.bennadel.com/blog/726-ColdFusion-Application-cfc-Tutorial-And-Application-cfc-Reference.htm). The concept for tokenizer draws heavily on Jason Dean's may fantastic security articles (htttp://12robots.com) which you should be reading. The AJAX header code draws on http://existdissolve.com/2010/10/cfscript-alternative-to-cfheader/ for writing headers in cfscript. Tokenizer is created and maintained by Daniel Sellers www.designfrontier.net