How do I hide CFIDE when using CF ajax?

Changing location and changing access are of course two different things.

Thanks Bob. I went with #2 for now. All these options are good though.

The issue for us (I work for the Fed Govt) is that we cannot have our CFIDE exposed to the public under any circumstance. It used to be located under our intranet behind the firewall, but apparently the CF Ajax stuff requires the path to be off the root it is being called from.

Short of implementing the YUI framework directly (which CF8 is supposed to save me from doing), is there a way to tell CFINPUT Autosuggest to get the source from a physical location (i.e., E:/whatever) vs a virtual location? Can the "source" be customized?

I could literally copy and paste the required ajax scripts out of the CFIDE directory under our intranet and paste only those file under our public root so a user would not be able to theoretically hack into the CF Admin.

Thoughts?

I would only bother about securing the Administrator, that is, the directory CFIDE/Administrator/. The other directories, like CFIDE/Classes/, CFIDE/adminapi/, CFIDE/Scripts/,etc., are needed by Coldfusion to enable it to implement Java and Javascript when processing requests. Securing them will obstruct Coldfusion.

You should have realized, of course, that AJAX, like any of Coldfusion's other Javascript modules, runs on the client. There is therefore no point preventing the client's access to, for example, CFIDE/Scripts/.