No `cflogin` / `cflogout` / `cfloginuser`, `getAuthUser()` or `isUserInRole()` in BoxLang or bx-compat-cfml

BoxLang
1

Title: No cflogin / cflogout / cfloginuser, getAuthUser() or isUserInRole() in BoxLang or bx-compat-cfml

Versions

  • BoxLang 1.18.0+66 (MiniServer), bx-compat-cfml 1.40.0+56

What happens
Adobe ColdFusion and Lucee have a built-in sign-in framework: the cflogin, cflogout and cfloginuser tags (login, logout and loginUser in script), plus getAuthUser(), isUserInRole(), isUserLoggedIn() and getUserRoles(). BoxLang doesn’t have them, and neither does bx-compat-cfml. I couldn’t find a module for them on ForgeBox either.

Code written for ACF or Lucee stops at the first one:

<cflogout>

Component [logout] could not be found.

Many older CFML applications, and anything that grew out of BlogCFC, still use them. In Galaxie Blog they were leftovers: our real sign-in is our own session flag, so I removed them (about 15 lines) and now run the same on all three engines. But other applications will hit this on their first request to a secured page, and the error doesn’t say that the feature is missing on purpose.

Request
Could bx-compat-cfml provide these, even a simple session-based version? If they’re intentionally left out, a clearer error (“cflogin is not supported in BoxLang; see …”) or a line in the compatibility docs would save people time.

Thanks again for the quick HQL fix (BLMODULES-306).

2

We don’t have any current plans to implement these. They are legacy and we really haven’t had any demand for them. I’m not against them being added to the compat module if someone wants to sponsor them or send a pull request.

Also BTW, DIscourse marked your previous messages as spam, so they were held up in the filter until I approved them. The reason given by Discourse was

This new user tried to create multiple posts with links to the same domain. All posts from this user that include links should be reviewed. See the newuser_spam_host_threshold site setting.

I’ll raise your trust level so the system isn’t as strict with your posts.

3

Thanks Brad, that makes sense. Galaxie Blog only used cflogin as a thin layer on top of its own session sign-in, so I took it out and it signs in fine without it now. It’s not a blocker anymore.

And thanks for approving the posts and raising my trust level. I was starting to wonder what I’d done wrong!

1 Like