• Authentication Ensures that a valid user is logged-in, based on an ID and password provided by the user. ColdFusion (or, in some cases if you use web server authentication, the web server) maintains the user ID information while the user is logged-in.
• Authorization Ensures that the logged-in user is allowed to use a page or perform an operation. Authorization is typically based on one or more roles(sometimes called groups) to which the user belongs. For example, in an employee database, all users could be members of either the employee role or the contractor role. They could also be members of roles that identify their department, position in the corporate hierarchy, or job description. For example, someone could be a member of some or all of the following roles: EmployeesHuman ResourcesBenefitsManagers Roles enable you to control access in your application resources without requiring the application to maintain knowledge about individual users. For example, suppose you use ColdFusion for your company's intranet. The Human Resources department maintains a page on the intranet on which all employees can access timely information about the company, such as the latest company policies, upcoming events, and job postings. You want everyone to be able to read the information, but you want only certain authorized Human Resources employees to be able to add, update, or delete information. Your application gets the user's roles from the user information data store when the user logs in, and then enables access to specific pages or features based on the roles. Typically, you store user information in a database, LDAP directory, or other secure information store.You also use the user ID for authorization. For example, to let employees view customized information about their salaries, job levels, and performance reviews. You certainly would not want one employee to view sensitive information about another employee, but you would want managers to be able to see, and possibly update, information about their direct reports. By employing both user IDs and roles, you ensure that only the appropriate people access or work with sensitive data.The following image shows a typical flow of control for user authentication and authorization. 

Authenticating users

• Web server authentication, where the web server authenticates the user and does not allow access to the website by users without valid login IDs
• Application authentication, where the ColdFusion application authenticates the user and does not allow access to the application by users without valid login IDs

Web server authentication

Application authentication

ColdFusion authentication storage and persistence

• Whether the user's browser enables cookies
• Whether the application supports the Session scope for login storage

Authentication and cookies

Using the Session scope

• Enable the Session scope in the ColdFusion Administrator and the Application.cfc initialization code or  cfapplication  tag.
• Specify loginStorage="Session" in the Application.cfc initialization code or cfapplication tag.When ColdFusion maintains login information in the Session scope, it stores the authentication details in a Session.cfauthorization  variable,  and ColdFusion uses the session cookie information to identify the user. Session-based authentication has the following advantages over less persistent login storage:
• After the user logs in, the user ID and password are not passed between the server and the browser.
• The login information and the session share a single time-out. You do not have to manually synchronize sessions and logins.
• If you use server clusters, the Session scope login ID is available across the cluster. For more information on server clustering, see Configuring and Administering ColdFusion. If you do not enable the Session scope, the authentication information is not kept in a persistent scope. Instead, the detailed login information is placed in a memory-only cookie (CFAUTHORIZATION_applicationName) with a base64-encoded string that contains the user name, password, and application name. The client sends this cookie to the web server each time it makes a page request while the user is logged-in. Use SSL for all page transactions to protect the user ID and password from unauthorized access.

Using ColdFusion security without cookies