Windows User Directory Security bypassed?

[rrzzy]

:confused;Using IIS6 under Windows 2003 with CFMX 6.1 When a cfm script file is
located in a windows security restricted directory, the user is prompted for a
login (user/password) prior to access. However, any user/password combination
for that computer is accepted even when the directory is restricted to a
specific user or usergroup. A html file in the same restricted directory works
correctly, only allowing the specific user or group access and denying all
others. If the url is just a directory reference (i.e. relies on the IIS
default filename to resolve to a cfm script file), then user security works
correctly. This seems like a rather large hole in CF security. Is there a way
to implement user based security so different users have access to specific
directories?

[Adam Cameron]

But it's IIS handling the security (ie: the user login screen). What SHOULDN'T
be happening is that IIS shouldn't be handing the request off to CF if the
authentication isn't validated.

It's not CF's job to handle website security: if it receives a request from
the webserver, it'll fulfil the request.

Adam

[Unregistered]

I have the same problem with windows authentification not securing coldfusion docs. It apears to work on all other objects in a directory but not on the cfm pages. Has anyone come up with a soltuion?

[n_kips]

If you have a dir that you want only certain users to access, use Application.cfm to control access. CF 7 introduced Application.cfc

Search the documentation on user authentication with Application.cfm

Basically, the Application.cfm can be put in any dir that needs to be secured. In order to get access to that dir, users will need to have a user session. It is in the Application.cfm that you define your session e.g. how long should it exists before it expires, if there is no activity, which page to take the people to if they need to login, which page to go to if the password is wrong, logging them in if the username and password is correct.

Also note that you may need to encrypt and decrypt the password, it is not advised to use plain text to store emails and passwords on db's.

You might also consider upgrading CF.