User Guide Cancel

cfoauth

Last updated on May 30, 2024 | Also applies to ColdFusion

CFML Reference User Guide
ColdFusion functions
ColdFusion Tags
1. ColdFusion tag summary
2. ColdFusion tags by category
  1. Application framework tags
    1. cfapplication
    2. cfassociate
    3. cferror
    4. cfimport
    5. cfinterface
    6. cflock
    7. cfscript
    8. cfthread
  2. Communications tags
  3. Database manipulation tags
  4. Data output tags
    1. cfchart
    2. cfchartdata
    3. cfchartseries
    4. cfcol
    5. cfcontent
    6. cfdocument
    7. cfdocumentitem
    8. cfdocumentsection
    9. cfflush
    10. cfheader
    11. cflog
    12. cfoutput
    13. cfpresentation
    14. cfpresentationslide
    15. cfpresenter
    16. cfprocessingdirective
    17. cfprint
    18. cfreport
    19. cfreportparam
    20. cfsilent
    21. cftable
  5. Debugging tags
    1. cfdump
    2. cftimer
    3. cftrace
  6. Exception handling tags
    1. cfcatch
    2. cferror
    3. cffinally
    4. cfrethrow
    5. cfthrow
    6. cftry
  7. Extensibility tags
    1. cfchart
    2. cfchartdata
    3. cfchartseries
    4. cfcollection
    5. cfcomponent
    6. cfexecute
    7. cfftp
    8. function
    9. cfindex
    10. cfinterface
    11. cfinvoke
    12. cfinvokeargument
    13. cfobject
    14. cfproperty
    15. cfreport
    16. cfreportparam
    17. cfreturn
    18. cfsearch
    19. cfsharepoint
    20. cfspreadsheet
    21. cfwddx
    22. cfxml
  8. File management tags
    1. cfdirectory
    2. cffile
    3. cffileupload
    4. cfftp
    5. cfzip
    6. cfzipparam
  9. Flow-control tags
    1. cfabort
    2. cfbreak
    3. cfcase
    4. cfcontinue
    5. cfdefaultcase
    6. cfelse
    7. cfelseif
    8. cfexecute
    9. cfexit
    10. cfif
    11. cfinclude
    12. cflocation
    13. cfloop
    14. cfrethrow
    15. cfswitch
    16. cfthrow
    17. cftry
  10. Forms tags
    1. cfapplet
    2. cfcalendar
    3. cffileupload
    4. cfform
    5. cfformgroup
    6. cfformitem
    7. cfgrid
    8. cfgridcolumn
    9. cfgridrow
    10. cfgridupdate
    11. cfinput
    12. cfpdf
    13. cfpdfform
    14. cfpdfformparam
    15. cfpdfparam
    16. cfpdfsubform
    17. cfselect
    18. cfslider
    19. cftextarea
    20. cftree
    21. cftreeitem
  11. Internet Protocol tags
    1. cfajaximport
    2. cfajaxproxy
    3. cfftp
    4. cffeed
    5. cfimap
    6. cfhttp
    7. cfhttpparam
    8. cfldap
    9. cfmail
    10. cfmailparam
    11. cfmailpart
    12. cfpop
    13. cfsprydataset
  12. Page processing tags
    1. cfcache
    2. cfcontent
    3. cfflush
    4. cfheader
    5. cfhtmlhead
    6. cfinclude
    7. cfprocessingdirective
    8. cfsetting
    9. cfsilent
  13. Security tags
  14. Variable manipulation tags
    1. cfcookie
    2. cfdump
    3. cfparam
    4. cfregistry
    5. cfsavecontent
    6. cfschedule
    7. cfset
    8. cfsetting
  15. Other tags
    1. cfimage
    2. cflog
    3. cfregistry
3. Tags a-b
4. Tags c
  1. cfcache
  2. cfcalendar
  3. cfcase
  4. cfcatch
  5. cfchart
  6. cfchartdata
  7. cfchartseries
  8. cfclient
  9. cfclientsettings
  10. cfcol
  11. cfcollection
  12. cfcomponent
  13. cfcontent
  14. cfcontinue
  15. cfcookie
  16. Tags d-e
5. Tags f
6. Tags g-h
  1. cfgraph
  2. cfgraphdata
  3. cfgrid
  4. cfgridcolumn
  5. cfgridrow
  6. cfgridupdate
  7. cfheader
  8. cfhtmlhead
  9. cfhtmltopdf
  10. cfhtmltopdfitem
  11. cfhttp
  12. cfhttpparam
7. Tags i
  1. cfif
  2. cfimage
  3. cfimap
  4. cfimapfilter
  5. cfimpersonate
  6. cfimport
  7. cfinclude
  8. cfindex
  9. cfinput
  10. cfinsert
  11. cfinterface
  12. cfinvoke
  13. cfinvokeargument
8. Tags j-l
9. Tags m-o
10. Tags p-q
  1. cfparam
  2. cfpdf
  3. cfpdfform
  4. cfpdfformparam
  5. cfpdfparam
  6. cfpdfsubform
  7. cfpod
  8. cfpop
  9. cfpresentation
  10. cfpresentationslide
  11. cfpresenter
  12. cfprint
  13. cfprocessingdirective
  14. cfprocparam
  15. cfprocresult
  16. cfprogressbar
  17. cfproperty
  18. cfquery
  19. cfqueryparam
11. Tags r-s
  1. cfregistry
  2. cfreport
  3. cfreportparam
  4. cfrethrow
  5. cfreturn
  6. cfsavecontent
  7. cfschedule
  8. cfscript
  9. cfsearch
  10. cfselect
  11. cfservlet
  12. cfservletparam
  13. cfset
  14. cfsetting
  15. cfsharepoint
  16. cfsilent
  17. cfslider
  18. cfspreadsheet
  19. cfsprydataset
  20. cfstoredproc
  21. cfswitch
12. Tags t
  1. cftable
  2. cftextarea
  3. cftextinput
  4. cfthread
  5. cfthrow
  6. cftimer
  7. cftooltip
  8. cftrace
  9. cftransaction
  10. cftree
  11. cftreeitem
  12. cftry
13. Tags u-z
  1. cfupdate
  2. cfwddx
  3. cfwebsocket
  4. cfwindow
  5. cfxml
  6. cfzip
  7. cfzipparam
CFML Reference
1. Reserved words and variables
2. Ajax JavaScript functions
3. ColdFusion ActionScript functions
4. ColdFusion mobile functions
5. Application.cfc reference
6. Script functions implemented as CFCs
7. ColdFusion Flash Form style reference
8. ColdFusion event gateway reference
9. ColdFusion C++ CFX Reference
10. ColdFusion Java CFX reference
11. WDDX JavaScript Objects
Cloud services

The <cfoauth> tag allows you to easily integrate third-party OAuth 2 authentication providers in your application. This tag currently supports Facebook and Google authentication. Also, this tag supports OAuth providers that support the OAuth 2 protocols. For instance, Microsoft and Github.

Syntax

<cfoauth 
type = "" 
clientid = "" 
scope = "" 
state = ""
authendpoint = ""
secretkey = "" 
accesstokenendpoint = "" 
result = "" 
redirecturi = ""
urlparams = ""
>

Attributes

Attribute	Req/Opt	Default	Description
Type="facebook" Type="google"	One of the following is required: type or accesstokenendpoint and authendpoint combination Either type can be specified or endpoints combination but not both		Currently supported values are Facebook and Google. Implicitly supports the authentication workflow of Facebook and Google.
clientid	required		Unique ID generated while registering your application with the OAuth provider.
scope	optional	For Facebook: No default. Facebook defaults to public_profile when scope is not specified. For Google: https://www.googleapis.com /auth/userinfo.profile+profile	Scopes are the permissions that a developer seeks from the users. These are usually comma separated values of permissions. For Google, they are space separated. Refer to the Oauth provider's documentations for more information. For example, after Facebook authentication, if a developer wants to access an email address and then the friend lists of a user, the developer will use: scope="email,read_friendlists". For another example, after Google authentication, if a developer wants read-only access to the contacts and calendars of a user, the developer will use: scope="https://www.googleapis.com /auth/contacts.readonly https://www.googleapis.com/auth /calendar.readonly". Note: The scope name varies for different OAuth providers.
state	optional		The state variable is used to pass back any information to your web application after the authentication and redirection are completed. Any value passed to this attribute is returned to the web application after authentication. This is useful for CSRF (Cross-site request forgery) protection. You can use ColdFusion’s security-related CSRF functions for this attribute.
authendpoint	One of the following is required: type or accesstokenendpoint and authendpoint combination Either type can be specified or endpoints combination but not both	For Facebook: https://www.facebook.com /dialog/oauth For Google: https://accounts.google.com/ o/oauth2/auth	If type is not specified, this will be used as end point URL to be invoked for user authentication.
secretkey	optional		Parameter is the App Secret as displayed in your social media app's settings.
accesstoken endpoint	One of the following is required: type or accesstokenendpoint and authendpoint combination Either type can be specified or endpoints combination but not both		If type is not specified this will be used as end point URL to be invoked for app authentication.
result	optional		A struct which will have login info of the user including login success/failure, failure reason, user name, user id.
redirecturi	optional	This will default to the URL which is executing the code. So if in OAuth settings user has given app URL as : http://domainname /appname And the file executing the code is : http://domainname /appname/login.cfm The redirect URI will be : http://domainname /appname/login.cfm	To redirect once user authentication is done.
urlparams	optional		Extra options which will be passed as URL query string to authendpoint.

History

ColdFusion 11: Added the function.

Step 1: Register with the OAuth 2 provider

Register your application in the OAuth 2 provider site with the relevant site-specific application details. (For instance, in Facebook you must create the Facebook App ID and App Secret).

In ColdFusion, specify your ID and App Secret in the cfoauth tag.

Note:

ColdFusion implicitly supports FB and Google. For other sites, use auth and access token endpoints and other attributes.

Syntax

<cfoauth
type = "Facebook|Google...."
clientid = ""
scope = ""
state = ""
authendpoint = ""
secretkey = ""
accesstokenendpoint = ""
result = ""
redirecturi = ""
urlparams = ""
>

redirecturi will default to the URL which is executing the code. For example, if in OAuth settings user has entered the app URL as: http://domainname/appname and the file executing the code as http://domainname/appname/login.cfm, the redirect URI will be: http://domainname/appname/login.cfm.

Also, register your domain details in your social media site.

Step 2: Understand the authentication process.

Once the user clicks the client site login button, the user will be prompted with a popup to grant the permissions.
If the user is not logged into the client site, they will be prompted to login.
If the user has already authorized your app and has already granted the permissions requested in scope, the user will be immediately redirected to your redirect_uri.

Note:

If the user has already authorized your application, but you are requesting additional permissions in the scope parameter, the user will be presented with a dialog which shows only the requested permissions that the user has not already granted your application.

Step 3: Implementing

The following example shows a simple authentication:

<cflogin>
<cfoauth
type = "Facebook"
clientid = "YOUR_CLIENT_ID"
secretkey = "YOUR_SECRET_KEY"
result = "res"
redirecturi = "http://localhost:8500/doc/login.cfm" >
<cfloginuser name = "#res.other.username#" password = "#res.access_token#" roles = "user"/>
</cflogin>
<cflocation url="http://localhost:8500/doc/index.cfm" >

Get help faster and easier

New user?

cfoauth

Syntax

Attributes

History

Step 1: Register with the OAuth 2 provider

Syntax

Step 2: Understand the authentication process.

Step 3: Implementing

Get help faster and easier

Ask the Community

Contact Us