ColdFusion application and security problem

[GaryNY]

Hi !
I have an application working with Oracle DB. I defined the datasource in Application.cfm file and use it everywhere as an application variable. Seems that this could create a security problem: if somebody will find out the datasource name, he could write a CF form to read/write these data in Oracle, right ? It does not matter that only authorized users have access to the database through the application.
Anybody solved this before ? How to protect the datasource ?
Thanks a lot in advance,
Gary.

[Newsgroup_User]

> datasource name, he could write a CF form to read/write these data in Oracle,
> right ?

Only if the person has access to the file system on your CF server. If
they DO, then that's a bigger security problem than someone finding out the
name of your DSN.

--
Adam

[Steve Sommers]

If you are using a dedicated server, then the risk is minimal. If you are using a shared server, then your concern is very valid as your only security is keeping the DSN secret which can be difficult because I have seen at least two ways to basically pull a directory of DSN's and I don't know if sandbox techniques can prevent this (someone else might know better).

[dpretlor]

On a shared environment, I believe sandboxing will fix this.

[GaryNY]

Thank you !
Could you tell me more about it (or send me to the source) ??
Gary.