How do I hide CFIDE when using CF ajax?

[DCwebGuy]

We've started to use some CF ajax features on our public site, like autosuggest. But in order for this to work I had to create a virtual directory to the CFIDE path off our public site. Obivously for security reasons, etc., I don't want CFIDE to be accessible from here (previously it was only accessible from our intranet behind the firewall).

So how do I use CF8 ajax features but not have the CFIDE path exposed? Thanks in advance.

[BKBK]

I would only bother about securing the Administrator, that is, the directory CFIDE/Administrator/. The other directories, like CFIDE/Classes/, CFIDE/adminapi/, CFIDE/Scripts/,etc., are needed by Coldfusion to enable it to implement Java and Javascript when processing requests. Securing them will obstruct Coldfusion.

You should have realized, of course, that AJAX, like any of Coldfusion's other Javascript modules, runs on the client. There is therefore no point preventing the client's access to, for example, CFIDE/Scripts/.

[DCwebGuy]

The issue for us (I work for the Fed Govt) is that we cannot have our CFIDE exposed to the public under any circumstance. It used to be located under our intranet behind the firewall, but apparently the CF Ajax stuff requires the path to be off the root it is being called from.

Short of implementing the YUI framework directly (which CF8 is supposed to save me from doing), is there a way to tell CFINPUT Autosuggest to get the source from a physical location (i.e., E:/whatever) vs a virtual location? Can the "source" be customized?

I could literally copy and paste the required ajax scripts out of the CFIDE directory under our intranet and paste only those file under our public root so a user would not be able to theoretically hack into the CF Admin.

Thoughts?

[JR__Bob__Dobbs-qSBHQ2 · Accepted solution]

Options:

1. You could change the "Default ScriptSrc Directory" value in the administrator settings page. Copy the contents of /CFIDE/Scripts to your new location.

2. Remove the contents of /CFIDE except for the Scripts directory from your public site. After backing up CFIDE of course.

3. Use the scriptSrc attribute of cfajaximport and cfform to point to a new directory contains the necessary scripts and removing /CFIDE from your public site.

[DCwebGuy]

Thanks Bob. I went with #2 for now. All these options are good though.

[BKBK]

Changing location and changing access are of course two different things.