Adobe 38043740 Lockdown Guide - Page 57

Server Settings > Settings, Timeout Requests, after, Use UUID for, cftoken, Disable CFC Type

Get Adobe 38043740 - ColdFusion Standard - Mac PDF manuals and user guides
UPC - 883919135168
View all Adobe 38043740 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 57 highlights

Section 5: ColdFusion Administrator Settings In this section several recommendations are made for ColdFusion server settings. It is important to understand that changes to some of these settings may affect how your website functions, and performs. Be sure to understand the implications of all settings before making any changes. 5.1 Server Settings > Settings Setting Timeout Requests after Default Recommendation Description Checked / 60 Sec. Checked / 5 Sec. Set this value as low as possible. Any templates (such as scheduled tasks) that might take longer, should use the cfsetting tag. For example: Use UUID for cftoken Unchecked Checked Disable CFC Type Unchecked check Unchecked The default cftoken values are sequential and make it fairly easy to hijack sessions by guessing a valid CFID / CFTOKEN pair. This setting is not necessarily required if J2EE session are enabled, however it doesn't hurt to turn it on anyways. Developers may rely on the argument types, enabling this setting might allow attackers to cause new exceptions in the application. This setting may be enabled if the developer(s) have built the application to account for this. 57

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
57
Section 5: ColdFusion Administrator Settings
In this section several recommendations are made for ColdFusion server settings. It is important to understand
that changes to some of these settings may affect how your website functions, and performs. Be sure to
understand the implications of all settings before making any changes.
5.1 Server Settings > Settings
Setting
Default
Recommendation
Description
Timeout Requests
after
Checked / 60 Sec.
Checked / 5 Sec.
Set this value as low as possible.
Any templates (such as scheduled
tasks) that might take longer, should
use the
cfsetting
tag. For
example:
<cfsetting
requesttimeout=
"60"
>
Use UUID for
cftoken
Unchecked
Checked
The default cftoken values are
sequential and make it fairly easy to
hijack sessions by guessing a valid
CFID
/ CFTOKEN pair. This setting
is not necessarily required if J2EE
session are enabled, however it
doesn’t hurt to turn it on anyways.
Disable CFC Type
check
Unchecked
Unchecked
Developers may rely on the
argument types, enabling this setting
might allow attackers to cause new
exceptions in the application. This
setting may be enabled if the
developer(s) have built the
application to account for this.