With CF 5+, you can create custom functions that work like the built-in functions. These two functions here allow you to identify if the URL has been altered in any way and to prevent a user from sharing the URL with another user (the check will fail if the IP address of the remove user is different). The way it works is that it appends a hash value to the end of the URL that is built off of the domain name of the website, the user's IP address, the current script being executed (as shown on the URL), and the URL parameters.
The cleanest way to implement this code is to create a template that contains all of your custom functions and include it in the Application.cfm template or whatever templates you need to have the functions available.
To "lock down" the URL, simply pass the URL parameters to the URLHash function.
Before
<a href="index.cfm?Action=Edit&id=353">Edit Employee</a>
After
<a href="index.cfm?#URLHash("Action=Edit&id=353")#">Edit Employee</a>
On the next page, you can check to see if the URL has been modified in any way by calling the URLCheckHash function. If it fails (returns "0"), redirect them to the home page.
<CFIF NOT URLCheckHash()>
<CFLOCATION URL="/index.cfm">
</CFIF>
If you need to call the encode function from inside a CF Tag, simply set a variable to the contents of the URL string and pass the variable to the function.
<CFSET URL="Action=View+Employee&id=322">
<CFLOCATION URL="index.cfm?#URLHash(URL)#">
<cfscript>
function URLHash(URLValue)
{
var HashData=cgi.Server_Name & cgi.Remote_Addr & cgi.Script_Name & URLValue;
var out=URLValue & "&hash=" & LCase(Hash(HashData));
return out;
}
function URLCheckHash()
{
var tmp=CGI.Query_String;
var listL=0;
var loop=0;
var URLVar="";
var HashData="";
if (IsDefined("URL.Hash"))
{
if (URL.Hash NEQ "")
{
tmp=CGI.Query_String;
listL=ListLen(tmp,"&");
URLVar=ListGetAt(tmp,ListL,"&");
if (Left(UCase(URLVar),5) EQ "HASH=")
{
tmp=ListDeleteAt(tmp,ListL,"&");
}
HashData=cgi.Server_Name & cgi.Remote_Addr & cgi.Script_Name & tmp;
if (URL.Hash EQ Hash(HashData))
{
return "1";
} else {
return "0";
}
} else {
return "0";
}
} else {
return "0";
}
}
</cfscript>