Pete Freitag Pete Freitag

Howto Require SSL for ColdFusion Administrator

Published on October 23, 2009
By Pete Freitag
coldfusion

A good security practice is to require SSL for ColdFusion administrator access (an even better practice is to limit access to localhost). This should only take less than five minutes on either Apache or IIS.

Require HTTPS on Apache 2

<Location /CFIDE/administrator>
	SSLRequireSSL
</Location>

Just add the above to your httpd.conf file, just make sure it appears below LoadModule ssl_module. Restart Apache, and you should get a 403 Forbidden response on http and it should work over https. I tested this on Apache 2.2, I think it should work on prior versions as well, but I have not tested them.

Require HTTPS on ISS

  1. Open up IIS Manager Console
  2. Right click on the CFIDE/administrator/ directory
  3. Click Directory Security Tab
  4. Under Secure Communications click Edit
  5. Enable Require secure channel (SSL)


ssl coldfusion administrator cfide security

Howto Require SSL for ColdFusion Administrator was first published on October 23, 2009.

If you like reading about ssl, coldfusion, administrator, cfide, or security then you might also like:

Fixinator

The Fixinator Code Security Scanner for ColdFusion & CFML is an easy to use security tool that every CF developer can use. It can also easily integrate into CI for automatic scanning on every commit.


Try Fixinator

CFBreak
The weekly newsletter for the CFML Community


Comments

How do you limit access to ColdFusion Administrator to just localhost?
by Michael on 10/26/2009 at 7:54:00 AM UTC
Does anyone have information on IP spoofing protection in general and specifically for IIS 6? For example trying to reach a page that IIS limits to 127.0.0.1 or 192.168.1.X

@Michael check out http://www.adobe.com/devnet/coldfusion/articles/cf7_security_04.html for info on locking down the CF admin in IIS (including limiting it to localhost). The article is for CF7 but I have tested it with CF8.
by Marc on 10/27/2009 at 4:30:46 PM UTC
I want to quote your post in my blog. It can?
And you et an account on Twitter?
by 0lz on 12/25/2009 at 4:10:27 AM UTC
@Olz - Yes you may quote my article on your blog as long as you link back to the article in your post. My account on twitter is: http://twitter.com/pfreitag (not sure if that's what you were asking)
by Pete Freitag on 12/28/2009 at 8:50:13 AM UTC