Adobe 38043740 Lockdown Guide - Page 58

Disable access to, internal ColdFusion, Java components, Prefix serialized, JSON with, Maximum Output

Get Adobe 38043740 - ColdFusion Standard - Mac PDF manuals and user guides
UPC - 883919135168
View all Adobe 38043740 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 58 highlights

Setting Default Disable access to Unchecked internal ColdFusion Java components Prefix serialized JSON with Unchecked: // Maximum Output Buffer size 1024KB Recommendation Description Checked The internal ColdFusion Java components may allow administrative duties to be performed. Some developers may write code that relies on these components. This practice should be avoided as these components are not documented. Checked: // Lower This setting helps prevent JSON hijacking, and should be turned on. ColdFusion AJAX tags and functions automatically remove the prefix. If developers have written CFC functions with returnformat="json" or use the SerializeJSON function, the prefix will be applied, and should be removed in the client code before processing. Developers can override this setting at the application level. A lower output buffer size may reduce the memory footprint in some applications. 58

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
58
Setting
Default
Recommendation
Description
Disable access to
internal ColdFusion
Java components
Unchecked
Checked
The internal ColdFusion Java
components may allow
administrative duties to be
performed.
Some developers may write code
that relies on these components.
This practice should be avoided as
these components are not
documented.
Prefix serialized
JSON with
Unchecked: //
Checked: //
This setting helps prevent JSON
hijacking, and should be turned on.
ColdFusion AJAX tags and functions
automatically remove the prefix.
If developers have written CFC
functions with returnformat=”json” or
use the SerializeJSON function, the
prefix will be applied, and should be
removed in the client code before
processing.
Developers can override this setting
at the application level.
Maximum Output
Buffer size
1024KB
Lower
A lower output buffer size may
reduce the memory footprint in some
applications.