User Guide Cancel

cfapplication

Last updated on May 30, 2024 | Also applies to ColdFusion

CFML Reference User Guide
ColdFusion functions
ColdFusion Tags
1. ColdFusion tag summary
2. ColdFusion tags by category
  1. Application framework tags
    1. cfapplication
    2. cfassociate
    3. cferror
    4. cfimport
    5. cfinterface
    6. cflock
    7. cfscript
    8. cfthread
  2. Communications tags
  3. Database manipulation tags
  4. Data output tags
    1. cfchart
    2. cfchartdata
    3. cfchartseries
    4. cfcol
    5. cfcontent
    6. cfdocument
    7. cfdocumentitem
    8. cfdocumentsection
    9. cfflush
    10. cfheader
    11. cflog
    12. cfoutput
    13. cfpresentation
    14. cfpresentationslide
    15. cfpresenter
    16. cfprocessingdirective
    17. cfprint
    18. cfreport
    19. cfreportparam
    20. cfsilent
    21. cftable
  5. Debugging tags
    1. cfdump
    2. cftimer
    3. cftrace
  6. Exception handling tags
    1. cfcatch
    2. cferror
    3. cffinally
    4. cfrethrow
    5. cfthrow
    6. cftry
  7. Extensibility tags
    1. cfchart
    2. cfchartdata
    3. cfchartseries
    4. cfcollection
    5. cfcomponent
    6. cfexecute
    7. cfftp
    8. function
    9. cfindex
    10. cfinterface
    11. cfinvoke
    12. cfinvokeargument
    13. cfobject
    14. cfproperty
    15. cfreport
    16. cfreportparam
    17. cfreturn
    18. cfsearch
    19. cfsharepoint
    20. cfspreadsheet
    21. cfwddx
    22. cfxml
  8. File management tags
    1. cfdirectory
    2. cffile
    3. cffileupload
    4. cfftp
    5. cfzip
    6. cfzipparam
  9. Flow-control tags
    1. cfabort
    2. cfbreak
    3. cfcase
    4. cfcontinue
    5. cfdefaultcase
    6. cfelse
    7. cfelseif
    8. cfexecute
    9. cfexit
    10. cfif
    11. cfinclude
    12. cflocation
    13. cfloop
    14. cfrethrow
    15. cfswitch
    16. cfthrow
    17. cftry
  10. Forms tags
    1. cfapplet
    2. cfcalendar
    3. cffileupload
    4. cfform
    5. cfformgroup
    6. cfformitem
    7. cfgrid
    8. cfgridcolumn
    9. cfgridrow
    10. cfgridupdate
    11. cfinput
    12. cfpdf
    13. cfpdfform
    14. cfpdfformparam
    15. cfpdfparam
    16. cfpdfsubform
    17. cfselect
    18. cfslider
    19. cftextarea
    20. cftree
    21. cftreeitem
  11. Internet Protocol tags
    1. cfajaximport
    2. cfajaxproxy
    3. cfftp
    4. cffeed
    5. cfimap
    6. cfhttp
    7. cfhttpparam
    8. cfldap
    9. cfmail
    10. cfmailparam
    11. cfmailpart
    12. cfpop
    13. cfsprydataset
  12. Page processing tags
    1. cfcache
    2. cfcontent
    3. cfflush
    4. cfheader
    5. cfhtmlhead
    6. cfinclude
    7. cfprocessingdirective
    8. cfsetting
    9. cfsilent
  13. Security tags
  14. Variable manipulation tags
    1. cfcookie
    2. cfdump
    3. cfparam
    4. cfregistry
    5. cfsavecontent
    6. cfschedule
    7. cfset
    8. cfsetting
  15. Other tags
    1. cfimage
    2. cflog
    3. cfregistry
3. Tags a-b
4. Tags c
  1. cfcache
  2. cfcalendar
  3. cfcase
  4. cfcatch
  5. cfchart
  6. cfchartdata
  7. cfchartseries
  8. cfclient
  9. cfclientsettings
  10. cfcol
  11. cfcollection
  12. cfcomponent
  13. cfcontent
  14. cfcontinue
  15. cfcookie
  16. Tags d-e
5. Tags f
6. Tags g-h
  1. cfgraph
  2. cfgraphdata
  3. cfgrid
  4. cfgridcolumn
  5. cfgridrow
  6. cfgridupdate
  7. cfheader
  8. cfhtmlhead
  9. cfhtmltopdf
  10. cfhtmltopdfitem
  11. cfhttp
  12. cfhttpparam
7. Tags i
  1. cfif
  2. cfimage
  3. cfimap
  4. cfimapfilter
  5. cfimpersonate
  6. cfimport
  7. cfinclude
  8. cfindex
  9. cfinput
  10. cfinsert
  11. cfinterface
  12. cfinvoke
  13. cfinvokeargument
8. Tags j-l
9. Tags m-o
10. Tags p-q
  1. cfparam
  2. cfpdf
  3. cfpdfform
  4. cfpdfformparam
  5. cfpdfparam
  6. cfpdfsubform
  7. cfpod
  8. cfpop
  9. cfpresentation
  10. cfpresentationslide
  11. cfpresenter
  12. cfprint
  13. cfprocessingdirective
  14. cfprocparam
  15. cfprocresult
  16. cfprogressbar
  17. cfproperty
  18. cfquery
  19. cfqueryparam
11. Tags r-s
  1. cfregistry
  2. cfreport
  3. cfreportparam
  4. cfrethrow
  5. cfreturn
  6. cfsavecontent
  7. cfschedule
  8. cfscript
  9. cfsearch
  10. cfselect
  11. cfservlet
  12. cfservletparam
  13. cfset
  14. cfsetting
  15. cfsharepoint
  16. cfsilent
  17. cfslider
  18. cfspreadsheet
  19. cfsprydataset
  20. cfstoredproc
  21. cfswitch
12. Tags t
  1. cftable
  2. cftextarea
  3. cftextinput
  4. cfthread
  5. cfthrow
  6. cftimer
  7. cftooltip
  8. cftrace
  9. cftransaction
  10. cftree
  11. cftreeitem
  12. cftry
13. Tags u-z
  1. cfupdate
  2. cfwddx
  3. cfwebsocket
  4. cfwindow
  5. cfxml
  6. cfzip
  7. cfzipparam
CFML Reference
1. Reserved words and variables
2. Ajax JavaScript functions
3. ColdFusion ActionScript functions
4. ColdFusion mobile functions
5. Application.cfc reference
6. Script functions implemented as CFCs
7. ColdFusion Flash Form style reference
8. ColdFusion event gateway reference
9. ColdFusion C++ CFX Reference
10. ColdFusion Java CFX reference
11. WDDX JavaScript Objects
Cloud services

Description

Defines the scope of a ColdFusion application; enables and disables storage of Client variables; specifies the Client variable storage mechanism; enables Session variables; and sets Application variable time-outs.

Syntax

<cfapplication 
datasource="data_source_name" 
name = "application name" 
applicationTimeout = #CreateTimeSpan(days, hours, minutes, seconds)# 
clientManagement = "yes|no" 
clientStorage = "data_source_name|Registry|Cookie" 
loginStorage = "cookie|session"
passarraybyreference = "true | false"
searchimplicitscopes = "true | false" 
googleMapKey = "map key" 
scriptProtect = "none|all|list" 
serverSideFormValidation = "yes|no" 
sessionManagement = "yes|no" 
sessionTimeout = #CreateTimeSpan(days, hours, minutes, seconds)# 
setClientCookies = "yes|no" 
setDomainCookies = "yes|no"
compileextforinclude = "comma_separated_list"
strictnumbervalidation = "true|false">

Note: You can specify this tag's attributes in an attributeCollection whose value is a structure. Specify the structure name in the attributeCollection and use the tag's attribute names as structure keys.

History

ColdFusion (2018 release) Update 9 and ColdFusion (2016 release) Update 15: You can use the SameSite attribute and pass the struct to authCookie. See the snippet below.

ColdFusion 11: Added attributes - compileextforinclude and strictnumbervalidation

ColdFusion 9: Added datasource , googleMapKey, and serverSideFormValidation attributeColdFusion 8: Added secureJSON and SecureJSONPrefix attributesColdFusion MX 7: Added scriptProtect attributeColdFusion MX 6.1: Added loginStorage attributeColdFusion MX:

Changed how persistent scopes are available: Server, Session, and Application scope variables are stored in memory as structures. In earlier releases, only Session and Application scope variables were stored this way. You cannot access the UDF function scope as a structure.
Changed the algorithm for setting the CFTOKEN variable value: if the registry key UUIDToken is a nonzero value, ColdFusion uses a number constructed from the UUID plus a random number. Otherwise, ColdFusion sets the CFTOKEN variable default value using a positive random integer. (In earlier releases, ColdFusion always used a number constructed from the UUID plus a random number.)

Attributes

Attribute	Req/Opt	Default	Description
authCookie	Optional		Struct containing ColdFusion Authentication cookie related properties
datasource	Optional		Name of the data source from which the query retrieves data.
name	See Description		Name of application. Up to 64 characters. For Application and Session variables: Required. For Client variables: Optional
applicationTimeout	Optional	Specified in Variables page of ColdFusion Administrator	Lifespan of application variables. CreateTimeSpan function and values in days, hours, minutes, and seconds, separated by commas.
clientManagement	Optional	no	yes: enables client variables. no
clientStorage	Optional	registry	How client variables are stored: datasource_name: in ODBC or native data source. Create storage repository in the Administrator. registry: in the system registry. cookie: on client computer in a cookie. Scalable. If client disables cookies in the browser, client variables do not work.
exchangeServerVersion	Optional	2007	Specifies the Microsoft Exchange Server version. The values are: 2003 2007 2010 If you do not specify the details, 2007 is taken by default.
googleMapKey	Optional		The Google Maps API key required to embed Google Maps in your web pages.
loginStorage	Optional	cookie	cookie: store login information in the Cookie scope. session: store login information in the Session scope.
passArrayByReference	Optional	False	True if array is to be passed by reference.
searchImplicitscopes	Optional	False	False if implicit scopes should not be searched by default. This attribute covers look-up in the following implicit scopes: CGI URL Form Cookie File Client
scriptProtect	Optional	Determined by ColdFusion Administrator Enable Global Script Protection setting	Specifies whether to protect variables from cross-site scripting attacks none: do not protect variables all: protect Form, URL, CGI, and Cookie variables comma-delimited list of ColdFusion scopes: protect variables in the specified scopes. For more information, see Usage. Enabling the global site protection replaces all the null bytes (%00) with an %20. This is to prevent Null Byte injection Attacks as part of the Protection. To disable this protection just for cookie scope the following workaround can be used. Enable Script Protection from CF Administrator Navigate to CF_HOME\cfusion\lib directory and open neo-security.xml and search for string FORM,URL,COOKIE,CGI & change the string to FORM, URL,CGI Restart the server.
secureJSON	Optional	Administrator value
serverSideFormValidation	Optional	yes	If no, disables validation on cfform fields when the form is submitted.
secureJSONPrefix	Optional	Administrator value	The security prefix to put in front of the value that a ColdFusion function returns in JSON-format in response to a remote call if the secureJSON setting is true. The default value is the value of the Prefix serialized JSON setting in the Administrator Server Settings > Settings page (which defaults to //, the JavaScript comment character). For more information see Improving security in the Developing ColdFusion Applications.
sessionCookie	Optional		Struct containing ColdFusion session cookie related properties.
sessionManagement	Optional	no	yes: enables session variables. no
sessionTimeout	Optional	Specified in Variables page of ColdFusion Administrator	Life span of session variables. CreateTimeSpan function and values in days, hours, minutes, and seconds, separated by commas.
setClientCookies	Optional	yes	yes: enables client cookies. no: ColdFusion does not automatically send CFID and CFTOKEN cookies to client browser; you must manually code CFID and CFTOKEN on the URL for every page that uses Session or Client variables.
setDomainCookies	Optional	no	yes: uses domain cookies for CFID and CFTOKEN cookies and for all Client variables when using cookies for client variable storage. Required for applications running on clusters. no: uses host-specific cookies for CFID, CFTOKEN, and all client variable cookies.
compileextforinclude	Optional		Specify the list of allowed file extensions (as a comma separated list) for the <cfinclude> tag. Specifying a wildcard ('*') in the list makes any file included using the <cfinclude> tag to be compiled. If any file included using the <cfinclude> tag is not found in this list, their content will be statically included. By default, files with the extensions cfm and cfml are always compiled irrespective of this setting. See cfinclude .
strictnumbervalidation	Optional	true	In ColdFusion 10 and earlier versions, the IsValid function allowed currency symbols at the start and commas inside the number. Starting from ColdFusion 11, this function evaluates on a more strict basis. Setting this value to false makes the isValid function to behave in the older way. This setting effects cfargument , cfparam and cfform tags wherever integer & numeric validation is used. Based on this setting, the validation reflects in those tags as well.

Usage

This tag is typically used in the Application.cfm file, to set defaults for a ColdFusion application.

Note: You can also set the application defaults in the Application.cfc file. For more information, see Application variables.

This tag enables application variables, unless they are disabled in the ColdFusion Administrator. The Administrator setting also overrides the sessionManagement attribute. For more information, see Configuring and Administering ColdFusion. If ColdFusion is running on a cluster, specify clientStorage = "cookie" or a data source name; you cannot specify "registry".ColdFusion generates an error if the application name is longer than 64 characters. The CFTOKEN variable is 8 bytes in length. Its range is 10000000 -99999999.

Note: If you specify ClientStorage=cookie, any Client scope variables set following a cfflush tag are not saved in the Client browser.

Protecting variables from cross-site scripting attacks

The ScriptProtect attribute lets you protect one or more variable scopes from cross-site scripting attacks, where a client attempts to get your application to send malicious code back to a user's browser. In these attacks, user input (for example, from form fields or from URL variables) sets a CF variable which is destined for user output. The submitted data includes malicious code, such as JavaScript or an applet or object reference, which then executes on the user's system.

Note: The ColdFusion Administrator Settings page Enable Global Script Protection option determines the default script protection setting. You can use the scriptProtect attribute to override the Administrator setting. You can also use the Application.cfc initialization code to set the protection value.

The ColdFusion cross-site scripting protection operation is done when ColdFusion processes the application settings at the beginning of a request. Thus, it can process the URL, and Cookie, CGI, and Form variables in a user's request. By default, it replaces occurrences of the following HTML tag names with the text InvalidTag: object, embed , script, applet, and meta. It allows these names in plain text, and replaces the words if they are used as tag names. You can specify any or all ColdFusion scopes for protection, but only the Form, URL, CGI, and Cookie scopes have variables that are often provided by unknown sources. Also, protecting a scope requires additional processing. For these reasons, the all attribute value applies protection to only the four scopes.
The script protection mechanism applies a regular expression that is defined in the cf_root/lib/neo-security. xml file in the server configuration, or the cf_root/WEB-INF/ cfusion /lib/neo-security. xml file in the JEE configuration to the variable value. You can customize the patterns that ColdFusion replaces by modifying the regular expression in the CrossSiteScriptPatterns variable.

Locking server, application, and session variables

When you set or update variables in the server, application, and session scopes, use the cflock tag with the scope attribute set to the following value:

For server variables, specify server
For application variables, specify application
For session variables, specify session
In some cases, you must also lock code that reads variables in these scopes. For information about locking scopes, see cflock .

Example

<!--- This example shows how to use cflock to prevent race conditions during data updates to variables in Application, Server, and Session scopes. ---> 
<h3>cfapplication Example</h3> 
<p>cfapplication defines scoping for a ColdFusion application and enables or disables application and/or session variable storage. This tag is placed in a special file called Application.cfm that automatically runs before any other CF page in a directory (or subdirectory) where the Application.cfm file appears.</p> 

<cfapplication name = "ETurtle" 
sessionTimeout = #CreateTimeSpan(0, 0, 0, 60)# 
sessionManagement = "Yes"> 

<!--- Initialize session and application variables used by E-Turtleneck. ---> 
<cfparam name="application.number" default="1"> 
<cfparam name="session.color" default= ""> 
<cfparam name="session.size" default=""> 

<cfif IsDefined("session.numPurchased") AND IsNumeric(trim(session.cartTotal))> 
<!--- Use the application scope for the application variable to prevent race condition. This variable keeps track of total number of turtlenecks sold. ---> 
<cflock scope = "Application" timeout = "30" type = "Exclusive"> 
<cfset application.number = application.number + session.numPurchased> 
</cflock> 
</cfif> 

<cfoutput> 
E-Turtleneck is proud to say that we have sold #application.number# turtlenecks to date. 
</cfoutput> 
<!--- End of Application.cfm --->

Example - with SameSite attribute

<cfset cookiest = {httponly='true', timeout=createTimeSpan(1, 0, 0, 0), samesite='Strict | Lax | None'}> 
<cfset authcookiest = {samesite='Strict | Lax | None'}> 
<cfapplication name="newApp" sessionmanagement="Yes" authCookie=#authcookiest# sessioncookie=#cookiest# >

Get help faster and easier

New user?