Thanks for posting this. I'm doing a CF-Sec preso later today and this will come in handy. Some of the AJAX stuff they added (I mean security wise) is pretty cool. Have you looked into it yet? For example, there is now a secureJSOn attribute for cffunction, and a VerifyClient function. This isn't mentioned in the reference, just the dev guide. I'll be doing a blog entry on it later this week.

Oops, it _is_ covered in the ref. I had a slight mix up with my various versions of the cf8 docs. ;) Either way though it was only added recently i believe.

"One line I did find to be curious was this one"

Makes one wonder just how "independent" that security audit was, if they think RDS is a secure "tried and tested" protocol.

I'm not sure what to say other than their security findings are as independent as they come...

RDS is a highly secure protocol that has been around for a very very long time and has only been improved upon with each version. Don't dis the RDS! :)

The comment is related to the fact that spawning an open debugging port can cause security issues... with RDS, you can secure your server so that only the web server ports are open and still do your debugging. ;)

Jason

@Jason, I read through most of the whitepaper, and parts of it sounded like ads right out of Adobe's press room.

Don't get me wrong, I love ColdFusion as much as the next guy. But I think "independent" is a little bit of a stretch in this case. It doesn't matter who's software we're talking about, this kind of thing happens all the time.

What happened here is that Adobe paid a security firm to audit ColdFusion. When that happens, the security firm wants to make Adobe happy. I mean, how are they going to keep getting hired by Adobe if they trash Adobe's software? I am not saying that CF has overlooked security problems, I'm just illustrating how these these things can stray from being independent. It doesn't always happen, but security firms are human too. :)