Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
Loading...
A brief history in time of our major releases
In this section you will find the release notes for each version we release under this major version. If you are looking for the release notes of previous major versions use the version switcher at the top left of this documentation book. Here is a breakdown of our major version releases.
Version 3 is a major rewrite of this module. It drops Adobe 2016 support and enhances the way the firewall is configured. It also add major capabilities for security headers, csrf settings and much more.
It also introduces the ability for the firewall to do 401 response blocks as actions for security rules. The CBSecurity visualizer is also a major addition that allows a developer or manager to visualize the performance of the firewall and visualize all the configurations necessary for operation.
Finally, we have introduced basic authentication for your applications with an optional user credential in-memory storage.
Version 2 is a major release of our security module. We completely refactored the engine to make it more modern and to adhere to our new coding standards. We then proceeded to enhance it to tap into our HMVC approach and allow rules to be contributed from modules themselves. We also added annotation driven security to complete the ability to secure not only incoming requests by rules but also by easy annotations.
We have made great strides in this release to make it a one-stop-shop for security concerns within ColdBox applications.
Our first release as a module decoupled from the ColdBox 2 days!
Enterprise-grade security for ColdBox applications with authentication, authorization, JWT, CSRF protection, and comprehensive security headers.
CBSecurity is a comprehensive security framework for ColdBox applications, providing enterprise-grade authentication, authorization, and protection mechanisms. It combines multiple security modules into a cohesive, easy-to-use security platform that helps developers build secure applications with minimal effort.
CBSecurity provides a multi-layered security approach with the following key capabilities:
Security Firewall - Rule-based request protection using security rules engine and handler annotations
Authentication Manager (cbauth) - Pluggable authentication system compatible with any authentication provider
Basic Authentication - Built-in HTTP Basic Auth support with credential storage and browser challenge handling
JWT Services (jwtcfml) - Complete JSON Web Token implementation with generation, decoding, and validation
Access & Refresh Tokens - Native support for JWT-based authentication flows
Token Storage - Flexible token storage with multiple backend options
CSRF Protection (cbcsrf) - Cross-Site Request Forgery protection for form submissions
Security Headers - Industry-standard HTTP response headers (CSP, HSTS, X-Frame-Options, XSS Protection)
Password Generator - Cryptographically secure random password generation
Security Visualizer - Graphical interface for monitoring firewall activity and managing security configurations
Rule Engine - Flexible security rules supporting XML, JSON, database, and model-based configurations
Module Integration - Allows modules to contribute their own security rules and validation logic
CBSecurity is built on a modular architecture that integrates several specialized security modules:
The framework leverages cbstorages for flexible storage backends and seamlessly integrates with the ColdBox ecosystem to provide comprehensive security coverage across your entire application.
Multiple Storage Options - Define rules in XML, JSON, databases, or ColdBox models
Regular Expression Support - Use regex patterns or simple string matching for rule definitions
Modular Rules - Modules can contribute their own security rules with custom validation logic
Dynamic Rule Loading - Load and unload security rules at runtime from contributing modules
Annotation-Driven Security - Secure handlers and actions using ColdBox annotations
Cascading Security - Hierarchical security rules from global to handler to action level
Functional API - Injectable security service for authorization checks in any application layer
Custom Validators - Each module can define its own security validator implementation
Multiple Authentication Providers - Works with cbauth, ColdFusion native authentication, or custom providers
Provider Agnostic - Implements standard interfaces allowing any authentication system integration
Basic Authentication - Built-in HTTP Basic Auth with credential storage
Granular Control - Distinguish between authentication failures and authorization denials
Customizable Actions - Configure different responses for invalid authentication vs. authorization
Event-Driven - Hook into security events for custom logging, monitoring, or response handling
CBSecurity is open-source software licensed under the .
Documentation -
Source Code -
Issue Tracker -
Community Forum -
The ColdBox community is active and ready to help:
Community Forum - Ask questions and share knowledge with other developers
GitHub Issues - Report bugs and request features
Professional Support - Enterprise support available through Ortus Solutions
CBSecurity is professionally developed and supported by , a leader in CFML consulting and development.
Ortus Solutions offers comprehensive professional services for CBSecurity and the ColdBox Platform:
🛠️ Custom Development - Tailored security solutions for your specific requirements
👨🏫 Professional Support & Mentoring - Expert guidance from the creators of ColdBox
📚 Training - Official ColdBox and security training programs
🔍 Architecture & Code Reviews - Expert evaluation of your security implementation
Because of His grace, this project exists. If you don't like this, then don't read it; it's not for you.
"Therefore being justified by faith, we have peace with God through our Lord Jesus Christ: By whom also we have access by faith into this grace wherein we stand, and rejoice in hope of the glory of God." Romans 5:5
⚡ Performance Optimization - Server tuning and application optimization
🔐 Security Hardening - Comprehensive security audits and hardening services
CBSecurity 3 is a major release and it will require some updates in order for you to fully upgrade your previous versions.
These engines are no longer supported
In the previous releases the validator for JWT was JwtService@cbsecurity. This has now changed to JwtAuthValidator@cbsecurity. So make sure you update your configurations.
The CBAuthValidator has been renamed to just AuthValidator. This validator is now not cbauth focused but IAuthService focused. It also supports role and permission based authorization.
The entire settings structure has been redesigned to support many features in a a more concise and block approach. All top-level settings have been removed and added to specific sections. Please review the section in detail to see where the new settings belongs to.
Added transientCache=false to auth User to avoid any issues when doing security operations
Added population control for auth User for extra security
User auth was not serializing the id of the user in the mementifier config
New github support files
getActionsReport() was not defaulting the type's structure, so exceptions would arise when there was no data in the visualizer
cbcsrf Upgraded to version 3, which we missed in the previous release.
What's new with CBSecurity 3.4.3
CBSecurity 3.4.3 is a maintenance release that addresses ColdBox 7 compatibility requirements.
The primary change in this release addresses a breaking change in ColdBox 7:
Fixed: Renamed renderView() to view() to be ColdBox 7 compliant
This change ensures CBSecurity works properly with ColdBox 7's updated view rendering methods
Maintains backward compatibility with earlier ColdBox versions
ColdBox Framework: 6+ (ColdBox 7 compliant)
CFML Engines: Adobe ColdFusion 2018+, Lucee 5+
CommandBox: 5.0+
This release maintains full backward compatibility with existing CBSecurity 3.x installations while ensuring forward compatibility with ColdBox 7.
No migration steps are required for this release. Simply update your CBSecurity module dependency:
What's new with CBSecurity 3.4.2
CBSecurity 3.4.2 is a maintenance release that addresses database compatibility issues and improves documentation standards.
Fixed: Updated security logs columns to work with Oracle databases using clob data type
This enhancement ensures CBSecurity's logging functionality works seamlessly with Oracle database environments
Improves enterprise database compatibility for security audit trails
Fixed: cbsecurity_logs table name is now properly referenced instead of being hard-coded
This change ensures the module setting for the logs table name is properly respected
Provides better flexibility for custom table naming conventions
Fixed: Updated markdown rules to eliminate duplicate headers
Improved documentation consistency and readability
Enhanced GitBook compatibility and navigation structure
ColdBox Framework: 6+
CFML Engines: Adobe ColdFusion 2018+, Lucee 5+
CommandBox: 5.0+
Database: Any supported database (Oracle compatibility enhanced)
This release maintains full backward compatibility with existing CBSecurity 3.x installations while improving database compatibility across different database engines.
No migration steps are required for this release. Simply update your CBSecurity module dependency:
If you're using Oracle and experiencing issues with security logs, this update will resolve column type compatibility issues. No manual database changes are required.
January 2023
Dropped Adobe ColdFusion 2016
New JwtAuthValidator instead of mixing concerns with the JwtService. You will have to update your configuration to use this validator instead of the JwtService
All settings have changed. They are not single-level anymore. They are now grouped by functionality. Please see the area for the new approach.
New ability for the firewall to log all action events to a database table.
If enabled, a new visualizer can visualize all settings and firewall events via the log table.
New Basic Auth validator and basic auth user credentials storage system. This will allow you to secure apps where no database interaction is needed or required.
Disable lastAccessTimeouts for JWT CacheTokenStorage BOX-128
Fix spelling of property datasource on queryExecute that was causing a read issue.
A little more info about this book
The source code for this book is hosted on GitHub: . You can freely contribute to it and submit pull requests. The contents of this book are copyrighted by and cannot be altered or reproduced without the author's consent. All content is provided "As-Is" and can be freely distributed.
The majority of code examples in this book are done in cfscript.
The majority of code generation and running of examples are done via CommandBox: The ColdFusion (CFML) CLI, Package Manager, REPL -
About our authors
Luis Majano is a Computer Engineer who has been developing and designing software systems since 2000. He was born in in the late 70s, during a period of economical instability and civil war. He lived in El Salvador until 1995 and then moved to Miami, Florida where he completed his Bachelor of Science in Computer Engineering at .
He is the CEO of , a consulting firm specializing in web development, ColdFusion (CFML), Java development, and all open-source professional services under the ColdBox and ContentBox stack. He is the creator of ColdBox, ContentBox, WireBox, CommandBox, LogBox, and anything “BOX” and contributes to many open-source ColdFusion/Java projects. You can read his blog at
Flash, Flex, ColdFusion, and Adobe are registered trademarks and copyrights of Adobe Systems, Inc.
The information in this book is distributed “as is” without warranty. The author and Ortus Solutions, Corp shall not have any liability to any person or entity concerning loss or damage caused or alleged to be caused directly or indirectly by the content of this training book, software, and resources described in it.
We highly encourage contributions to this book and our open-source software. The source code for this book can be found in our GitHub repository, where you can submit pull requests.
10% of the proceeds of this book will go to charity to support orphaned kids in El Salvador - https://www.harvesting.org/. So please donate and purchase the printed version of this book; every book sold can help a child for almost two months.
Shalom Children’s Home is one of the ministries dear to our hearts in El Salvador. During the 12-year civil war that ended in 1990, many children were left orphaned or abandoned by parents who fled El Salvador. The Benners saw the need to help these children and received 13 children in 1982. Little by little, more children came on their own, churches and the government brought children to them for care, and the Shalom Children’s Home was founded.
Shalom now cares for over 80 children in El Salvador, from newborns to 18 years old. They receive shelter, clothing, food, medical care, education, and life skills training in a Christian environment. A child sponsorship program supports the home.
We have personally supported Shalom since; it is a place of blessing for many children in El Salvador who either have no families or have been abandoned. This is a good earth to seed and plant.
blockNew event cbSecurity_onFirewallBlock announced whenever the firewall blocks a request into the system with a 403.
DBTokenStorage now rotates using the async scheduler and not direct usage anymore.
Ability to set the cbcsrf module settings into the cbsecurity settings as csrf.
We now default the user service class and the auth token rotation events according to the user authentication service (cbauth, etc.); no need to duplicate work.
New rule-based IP security. You can add a allowedIPs key into any rule and add which IP Addresses are allowed into the match. By default, it matches all IPs.
New rule-based HTTP method security. You can add a httpMethods key into any rule and add which HTTP methods are allowed into the match. By default, it matches all HTTP Verbs.
New securityHeaders configuration to allow a developer to protect their apps from common exploits: XSS, HSTS, Content Type Options, host header validation, IP validation, clickjacking, non-SSL redirection, and much more.
The security firewall now stores the authenticated user according to the prcUserVariable on authenticated calls via preProcess() no matter the validator used
Dynamic Custom Claims: You can pass a function/closure as the value for a custom claim, and it will be evaluated at runtime, passing in the current claims before being encoded
Allow passing in custom refresh token claims to attempt() and fromUser() and refreshToken() : refreshCustomClaims
Added TokenInvalidException and TokenExpiredException to the refreshToken endpoint
Fixed: Added proper parenthesis on TOP statements for Microsoft SQL Server in the DBLogger
This fix resolves SQL syntax errors that were occurring when using CBSecurity's database logging features with MSSQL Server
Thanks to @irvirv for identifying and helping resolve this issue
ColdBox Framework: 6+
CFML Engines: Adobe ColdFusion 2018+, Lucee 5+
CommandBox: 5.0+
Database: Any supported database (MSSQL Server compatibility enhanced)
This release maintains full backward compatibility with existing CBSecurity 3.x installations while fixing a specific SQL syntax issue affecting Microsoft SQL Server users.
No migration steps are required for this release. Simply update your CBSecurity module dependency:
If you're using Microsoft SQL Server and experiencing SQL syntax errors in the DBLogger, this update will resolve those issues. No manual database changes are required.
# Update to latest version
box update cbsecurity
# Or install specific version
box install [email protected]# Update to latest version
box update cbsecurity
# Or install specific version
box install [email protected]# Update to latest version
box update cbsecurity
# Or install specific version
box install [email protected]Luis is passionate about Jesus, tennis, golf, volleyball, and anything electronic. Random Author Facts:
He played volleyball in the Salvadorean National Team at the tender age of 17
The Lord of the Rings and The Hobbit are his favorite books(Geek!)
His first ever computer was a Texas Instrument TI-86 that his parents gave him in 1986. After some time digesting his very first BASIC book, he had written his own tic-tac-toe game at the age of 9. (Extra geek!)
He has a geek love for circuits, microcontrollers, and overall embedded systems.
He has, of late (during old age), become a fan of organic gardening.
Keep Jesus number one in your life and in your heart. I did and it changed my life from desolation, defeat and failure to an abundant life full of love, thankfulness, joy and overwhelming peace. As this world breathes failure and fear upon any life, Jesus brings power, love and a sound mind to everybody!
“Trust in the LORD with all your heart, and do not lean on your own understanding.” Proverbs 3:5
What's new with CBSecurity 3.5.0
CBSecurity 3.5.0 is a significant modernization release that brings enhanced platform support, improved development workflows, and comprehensive AI assistance capabilities.
CBSecurity 3.5.0 has been fully certified for BoxLang, the modern dynamic JVM language. This includes:
Complete compatibility testing with BoxLang runtime
Validated functionality across all CBSecurity features
Updated examples and documentation for BoxLang syntax
Full test harness coverage for BoxLang environments
This release adds official support and certification for ColdBox 8, ensuring CBSecurity works seamlessly with the latest ColdBox framework features and improvements.
The project has migrated to modern GitHub Actions workflows, providing:
Improved CI/CD pipeline reliability
Better cross-platform testing coverage
Automated testing across multiple CFML engines
Enhanced security scanning and dependency management
The test harness has been significantly upgraded to provide:
Better local development experience
Enhanced integration testing capabilities
Improved TestBox runner configuration
Streamlined server startup and configuration
CBSecurity 3.5.0 introduces comprehensive AI assistance through:
.github/copilot-instructions.md - Detailed guidance for AI agents covering:
Module architecture and component relationships
Security validator patterns and implementation
Interceptor flow and event handling
This enhancement enables AI tools like GitHub Copilot to provide more accurate and contextual assistance when working with CBSecurity.
Documented test-harness structure and usage patterns
Enhanced TestBox runner details for local integration testing
Improved developer workflow documentation
Better guidance for module extension and customization
The release includes improved documentation and tooling for:
Setting up local development environments
Running integration tests via test-harness/tests/runner.cfm
Using box.json scripts for common development tasks
Server configuration for different CFML engines
ColdBox Framework: 6+ (ColdBox 8 certified)
CFML Engines: BoxLang 1+ (Preferred), Lucee 5+, Adobe 2023+
CommandBox: 5.0+
This release maintains full backward compatibility with existing CBSecurity 3.x installations. No breaking changes have been introduced.
No migration steps are required for this release. Simply update your CBSecurity module dependency:
Development workflows and best practices
Test harness setup and TestBox runner details
# Update to latest version
box update cbsecurity
# Or install specific version
box install [email protected]
