Adobe® ColdFusion® 10 Server Lockdown Guide

Setting Default Recommendation Description
Disable access to
internal ColdFusion
Java components
Prefix serialized
JSON with
Maximum Output
Buffer size
Unchecked Checked The internal ColdFusion Java
components may allow
administrative duties to be
performed.
Some developers may write code
that relies on these components.
This practice should be avoided as
these components are not
documented.
Unchecked: // Checked: // This setting helps prevent JSON
hijacking, and should be turned on.
ColdFusion AJAX tags and functions
automatically remove the prefix.
If developers have written CFC
functions with returnformat=”json” or
use the SerializeJSON function, the
prefix will be applied, and should be
removed in the client code before
processing.
Developers can override this setting
at the application level.
1024KB Lower A lower output buffer size may
reduce the memory footprint in some
applications.
58