{"id":40587094,"url":"https://github.com/ortus-docs/cbsecurity-docs","last_synced_at":"2026-01-21T03:07:29.598Z","repository":{"id":31721185,"uuid":"125237264","full_name":"ortus-docs/cbsecurity-docs","owner":"ortus-docs","description":"The official docs for the CB Security module","archived":false,"fork":false,"pushed_at":"2025-10-18T10:17:47.000Z","size":2189,"stargazers_count":3,"open_issues_count":1,"forks_count":16,"subscribers_count":2,"default_branch":"v3.x","last_synced_at":"2025-10-19T06:30:17.762Z","etag":null,"topics":["hacktoberfest"],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ortus-docs.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"security-validators/auth-validator.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2018-03-14T15:52:17.000Z","updated_at":"2025-10-18T10:17:51.000Z","dependencies_parsed_at":"2025-03-24T11:32:32.109Z","dependency_job_id":"3c316abe-97d5-4198-af5e-10d33c0b2e55","html_url":"https://github.com/ortus-docs/cbsecurity-docs","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ortus-docs/cbsecurity-docs","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ortus-docs%2Fcbsecurity-docs","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ortus-docs%2Fcbsecurity-docs/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ortus-docs%2Fcbsecurity-docs/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ortus-docs%2Fcbsecurity-docs/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ortus-docs","download_url":"https://codeload.github.com/ortus-docs/cbsecurity-docs/tar.gz/refs/heads/v3.x","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ortus-docs%2Fcbsecurity-docs/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28624343,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-21T02:47:06.670Z","status":"ssl_error","status_checked_at":"2026-01-21T02:45:44.886Z","response_time":86,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacktoberfest"],"created_at":"2026-01-21T03:07:29.537Z","updated_at":"2026-01-21T03:07:29.591Z","avatar_url":"https://github.com/ortus-docs.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"---\ndescription: \u003e-\n  Enterprise-grade security for ColdBox applications with authentication,\n  authorization, JWT, CSRF protection, and comprehensive security headers.\nicon: house-lock\n---\n\n# Introduction\n\n\u003cfigure\u003e\u003cimg src=\".gitbook/assets/CBSecurity-S-darkbg.png\" alt=\"CBSecurity Logo\"\u003e\u003cfigcaption\u003e\u003cp\u003eEnterprise Security for ColdBox Applications\u003c/p\u003e\u003c/figcaption\u003e\u003c/figure\u003e\n\n**CBSecurity** is a comprehensive security framework for ColdBox applications, providing enterprise-grade authentication, authorization, and protection mechanisms. It combines multiple security modules into a cohesive, easy-to-use security platform that helps developers build secure applications with minimal effort.\n\n\u003cfigure\u003e\u003cimg src=\".gitbook/assets/cbsecurity-3-visualizer (1) (1).png\" alt=\"CBSecurity Visualizer Interface\"\u003e\u003cfigcaption\u003e\u003cp\u003eSecurity Visualizer - Monitor and configure your security settings\u003c/p\u003e\u003c/figcaption\u003e\u003c/figure\u003e\n\n## 🎯 Core Security Capabilities\n\nCBSecurity provides a multi-layered security approach with the following key capabilities:\n\n### 🔐 Authentication \u0026 Authorization\n\n* **Security Firewall** - Rule-based request protection using security rules engine and handler annotations\n* **Authentication Manager** (`cbauth`) - Pluggable authentication system compatible with any authentication provider\n* **Basic Authentication** - Built-in HTTP Basic Auth support with credential storage and browser challenge handling\n* **Authorization Service** - Functional security API for authorization checks across all application layers\n\n### 🎫 Token Management\n\n* **JWT Services** (`jwtcfml`) - Complete JSON Web Token implementation with generation, decoding, and validation\n* **Access \u0026 Refresh Tokens** - Native support for JWT-based authentication flows\n* **Token Storage** - Flexible token storage with multiple backend options\n\n### 🛡️ Security Protections\n\n* **CSRF Protection** (`cbcsrf`) - Cross-Site Request Forgery protection for form submissions\n* **Security Headers** - Industry-standard HTTP response headers (CSP, HSTS, X-Frame-Options, XSS Protection)\n* **Password Generator** - Cryptographically secure random password generation\n\n### 📊 Management \u0026 Monitoring\n\n* **Security Visualizer** - Graphical interface for monitoring firewall activity and managing security configurations\n* **Rule Engine** - Flexible security rules supporting XML, JSON, database, and model-based configurations\n* **Module Integration** - Allows modules to contribute their own security rules and validation logic\n\n## 🧩 Module Composition\n\nCBSecurity is built on a modular architecture that integrates several specialized security modules:\n\n![CBSecurity Architecture - Module integration with cbstorages for flexible storage](.gitbook/assets/cbSecurity-Modules.png)\n\nThe framework leverages `cbstorages` for flexible storage backends and seamlessly integrates with the ColdBox ecosystem to provide comprehensive security coverage across your entire application.\n\n## ⭐ Key Features\n\n### 📋 Flexible Security Rules\n\n* **Multiple Storage Options** - Define rules in XML, JSON, databases, or ColdBox models\n* **Regular Expression Support** - Use regex patterns or simple string matching for rule definitions\n* **Modular Rules** - Modules can contribute their own security rules with custom validation logic\n* **Dynamic Rule Loading** - Load and unload security rules at runtime from contributing modules\n\n### 🔒 Advanced Authorization\n\n* **Annotation-Driven Security** - Secure handlers and actions using ColdBox annotations\n* **Cascading Security** - Hierarchical security rules from global to handler to action level\n* **Functional API** - Injectable security service for authorization checks in any application layer\n* **Custom Validators** - Each module can define its own security validator implementation\n\n### 🔑 Authentication Flexibility\n\n* **Multiple Authentication Providers** - Works with `cbauth`, ColdFusion native authentication, or custom providers\n* **Provider Agnostic** - Implements standard interfaces allowing any authentication system integration\n* **Basic Authentication** - Built-in HTTP Basic Auth with credential storage\n* **JWT Token Management** - Complete support for JWT access and refresh token workflows\n\n### ⚡ Security Response Handling\n\n* **Granular Control** - Distinguish between authentication failures and authorization denials\n* **Customizable Actions** - Configure different responses for invalid authentication vs. authorization\n* **Event-Driven** - Hook into security events for custom logging, monitoring, or response handling\n\n## 📜 License\n\nCBSecurity is open-source software licensed under the [Apache License 2.0](http://www.apache.org/licenses/LICENSE-2.0).\n\n## 📚 Resources\n\n### 📖 Documentation \u0026 Support\n\n* **Documentation** - [https://coldbox-security.ortusbooks.com](https://coldbox-security.ortusbooks.com)\n* **Source Code** - [https://github.com/coldbox-modules/cbsecurity](https://github.com/coldbox-modules/cbsecurity)\n* **Issue Tracker** - [https://github.com/coldbox-modules/cbsecurity/issues](https://github.com/coldbox-modules/cbsecurity/issues)\n* **Community Forum** - [https://community.ortussolutions.com/c/box-modules/cbsecurity/](https://community.ortussolutions.com/c/box-modules/cbsecurity/26)\n\n### 💬 Getting Help\n\nThe ColdBox community is active and ready to help:\n\n* **Community Forum** - Ask questions and share knowledge with other developers\n* **GitHub Issues** - Report bugs and request features\n* **Professional Support** - Enterprise support available through Ortus Solutions\n\n## 🏢 Professional Open Source\n\n![Ortus Solutions, Corp](https://blobscdn.gitbook.com/v0/b/gitbook-28427.appspot.com/o/assets%2F-LA-UVvG0NM7NpDzssBL%2F-LA-Uaei0WzTH7Su5CR7%2F-LA-UqN1BRXynZ7RUVO7%2Fortussolutions_button.png?generation=1523647999385555\\\u0026alt=media)\n\nCBSecurity is professionally developed and supported by [Ortus Solutions, Corp](http://www.ortussolutions.com/services), a leader in CFML consulting and development.\n\n### 🚀 Enterprise Services\n\nOrtus Solutions offers comprehensive professional services for CBSecurity and the ColdBox Platform:\n\n* **🛠️ Custom Development** - Tailored security solutions for your specific requirements\n* **👨‍🏫 Professional Support \u0026 Mentoring** - Expert guidance from the creators of ColdBox\n* **📚 Training** - Official ColdBox and security training programs\n* **🔍 Architecture \u0026 Code Reviews** - Expert evaluation of your security implementation\n* **⚡ Performance Optimization** - Server tuning and application optimization\n* **🔐 Security Hardening** - Comprehensive security audits and hardening services\n\n[Learn more about our services](http://www.ortussolutions.com/services)\n\n***\n\n## 🙏 HONOR GOES TO GOD ABOVE ALL\n\nBecause of His grace, this project exists. If you don't like this, then don't read it; it's not for you.\n\n\u003e \"Therefore being justified by **faith**, we have peace with God through our Lord Jesus Christ: By whom also we have access by **faith** into this **grace** wherein we stand, and rejoice in hope of the glory of God.\" Romans 5:5\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fortus-docs%2Fcbsecurity-docs","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fortus-docs%2Fcbsecurity-docs","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fortus-docs%2Fcbsecurity-docs/lists"}