http://coldfusion.com logo
Join Slack
Powered by
I know I’m late to the party on this, but I’m tryi...
# adobe
j
I know I’m late to the party on this, but I’m trying to create a restful API in ColdFusion. I got the API working, but was wondering if there are any tutorials you all recommend other than the Adobe documentation on how to secure them with a key or token.
r
j
Thanks, 🙏🏻
d
that website has sex ads
j
Strange I didn’t see any when I loaded it.
Strange. Maybe you have something infecting your computer. Maybe do a check for spy or adware
d
Sure, but I've never seen anything like this on any website other than this website
👍 1
d
I saw that same thing on the site just now. It asked to allow ads, I said no, then saw that anyway. No thank you.
r
yikes. I have ublock orgin so it must have not loaded for me.
j
When I looked at the page It didn’t load anything NSFW on the iPhone.
d
coworker the security guy, just said our blocker is Umbrella and from time to time it won't catch everything.
i'll remove the images now
r
I am also using vivaldi w/ adblocking enabled - so that is a 2nd line of defense... sorry for those impacted by NSFW ads that I didn't know were there. The article looked legit so I didn't even consider they would have such ads
j
Circling back to the original post, does anyone else have any good resources on securing a restful API in ColdFusion?
r
the main thing is to make sure no endpoints allow access w/o a valid login session that you are storing as some kind of token that can be stored and read by the browser. You could read any tutorial about securing a REST API in any language and apply the theory to CF.
j
I am just trying to learn how to do it in CF since I’m new to creating APIs that can be used by other people in the rather large company I work at.
d
within the company but from different applications?
j
Yes
There are use cases to pull data we have and this is the best option to provide that data to others in a controlled capacity
r
IDK if it is a good fit - but did you look at the CF API Manager that comes w/ CF enterprise? https://helpx.adobe.com/coldfusion/api-manager/getting-started-coldfusion-api-manager.html
j
I did but the documentation is very confusing and it almost seems that creating a secure method myself would be easier
I have a coworker who uses Django and he keeps telling me how easy it is in Django, so I just figured that there has to be something similar with ColdFusion.
c
@justincook that's not an apples to apples comparison though. Django is a framework running on Python. The REST engine in ColdFusion isn't as fully-featured. A better comparison might be Django to ColdBox (using the API template and cbSecurity module) or to Taffy (a framework specifically written for API development).
j
Oh ok
Thank you for pointing that out
c
Creating REST APIs in ColdFusion can be fairly easy - if you don't use the built-in REST tools.
j
Yeah I was able to easily create the REST API.
r
if you are able to use a framework - cfwheels has API stuff built into it, but that might be more effort than it's worth.
j
Ok thanks
r
once you have the authentication and security worked out, the rest should be pretty easy.
j
Yeah that’s what I think too
g
The ColdBox Framework has support for everything you would need for an API or anything else. 🙂
🙂 1
j
I need to look into Coldbox
g
There is a ton of documentation out there
❤️ 1
r
true - but coldbox can have a steep learning curve if you are not used to it's style 🙂
g
Do you also already use CommandBox? If so, its easy to spin up a new site
I disagree. ColdBox can be as simple or as complex as you want it to be.
j
Yeah that’ll be a learning opportunity later. No we don’t have either yet
g
It depends on what you are looking to do, etc (same with anything)
👍🏻 1
regardless of ColdBox, I highly recommend CommandBox. As a CF dev, its been one of the best tools I've ever used (other than, you know, CFML)
j
Ok thanks
g
Adobe also uses it in their certification training courses
r
I personally agree that coldbox can be simple and easy to use - I just know other devs that came from the non-OOP style of coldfusion that could not work in the framework and was just mentioning that for some it is not "simple" 🙂
g
I would suspect those devs would have issues with most MVC/OOP frameworks then
r
i would agree
g
Modern frameworks as we like to say 😉
m
i'd recommend taffy https://taffy.io/ for writing rest apis, works with lucee or adobe
r
is taffy still under development? it's been a few years since I checked and it seemed orphaned
g
He wrote a book about it too. I still recommend ColdBox as its a framework that can handle any kind of application you need. API, large, small, logging, caching, and more.
I don't know if Taffy it is still maintained though.
the last release was Feb 2022. https://github.com/atuttle/Taffy
r
that is more recent than when I last looked at it - so good to see it was getting some love.
g
When in doubt, check Git 🙂
r
of course 🙂
p
@justincook Since this is an internal app, you may have the 'easy' option of not actually implementing API security and instead rely on identifying users via another method like Integrated Authentication. I do something similar in an app I developed for internal use.
j
OK that’s an interesting idea
p
for another app I've developed that was outward-facing, I use the method of a login endpoint returning a token, which on all subsequent calls is checked against the list of valid tokens in the db, all which expire after a certain timeframe. I've searched for better documentation on implementing a more standard method of authorization, like OAUTH, but never found anything useful
j
Thanks for all the help. I have a solution now and I’m cooking with grease now. Haha
r
glad we could give you something to make progress
❤️ 1
e
There are only 2 mainstream and maintained ways in my opinion of writing REST: Adobe’s embedded template and ColdBox. I would go with ColdBox, there is a REST template you can use to start you off with. https://github.com/coldbox-templates/rest
☝️ 1
☝🏾 1
Open in Slack
PreviousNext
Powered by