Skip to main content
A
amaury.1
Participant
February 12, 2020
Answered

Is cfNTauthenticate a safe method for log-in ?

  • February 12, 2020
  • 1 reply
  • 937 views

I have a Coldfusion application running (entirely written by other people, but that I'm kind of managing now) that uses the cfNTauthenticate tag for users to log-in, but now I have been asked to make sure that using this is safe.

 

I have read the official documentation of cfNTauthenticate, but it doesn't explain explicitly how the user name and password are authenticated against the NT domain.

I am rather new to Coldfusion and not an expert of Windows so I might not be understanding some things in the documentation, but it really doesn't seem to mention this.

 

The main question is, are the user name and password sent in clear to the Windows NT domain, or is it encrypted ?

 

If any of you have some information about this, that would be very interesting for me.

This topic has been closed for replies.
Correct answer BKBK

Yes, using cfNTAuthenticate is safe. In fact the question, "are the user name and password sent in clear to the Windows NT domain, or is it encrypted?" is irrelevant. That is because the credentials are not sent, as you would from browser through HTTP to ColdFusion. Instead, cfNTAuthenticate integrates ColdFusion (as a user) directly with the security of the Windows Operating system.

 

However, you should take the usual precautions:

 

1) Use HTTPS for your ColdFusion site;

2) Ensure that client login credentials are sent to ColdFusion by the POST, rather than the GET, method;

3) Ensure that, in your Windows domain, ColdFusion runs as a user with the minimum rights needed to authenticate other users.

1 reply

BKBK
Community Expert
BKBKCommunity ExpertCorrect answer
Community Expert
February 16, 2020

Yes, using cfNTAuthenticate is safe. In fact the question, "are the user name and password sent in clear to the Windows NT domain, or is it encrypted?" is irrelevant. That is because the credentials are not sent, as you would from browser through HTTP to ColdFusion. Instead, cfNTAuthenticate integrates ColdFusion (as a user) directly with the security of the Windows Operating system.

 

However, you should take the usual precautions:

 

1) Use HTTPS for your ColdFusion site;

2) Ensure that client login credentials are sent to ColdFusion by the POST, rather than the GET, method;

3) Ensure that, in your Windows domain, ColdFusion runs as a user with the minimum rights needed to authenticate other users.

    A
    amaury.1Author
    Participant
    February 24, 2020

    Very well, thank you for your precisions, it was really important for me to understand for me to understand that, and you have helped good for this !

    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices