Application.cfc site variables

Question

I switched over to using application.cfc not too long ago. One thing I have struggled with is how to set variables that I use on individual pages of my site like I used to do in application.cfm. I have some passowrds for sftp services etc that I used to set in application.cfm. I have not been able to figure out how to make them work with application.cfc so I can call them where I need to.
I have tried setting them in onrequeststart, onapplicationstart etc. but nothing seems to work. The variables are never defined.
Does anyone have a working example of how to set variables that can be used on your site globally?
Is there a better way to store account passwords and variables like that that I am missing?

Answer 1

For security reasons, I would try to avoid embedding the password anywhere in your ColdFusion code.  You might put it in a "config" file outside of the webroot, then use ColdFusion to read it into an appropriately scoped variable.  Assuming you don't <cfdump> or WriteDump() your variable scopes anywhere in your production code, and that you don't have "Enable Request Debugging Output" enabled on your production server, you could store the password in either the Application scope or a local page's variables scope.  If there is only one page that will do FTP communication, then loading the password into a variable on that page would be fine.  If you modularize the FTP stuff so it can be reused elsewhere in your application, then put the password in a variable in the application scope.
Since you'll need to pass an the password to the FTP connection, you can't hash it for added security, which is the best way to handle passwords.  But you can encrypt/de-encrypt it using various functions within ColdFusion.  I'd consider at least storing it in an encrypted form in the "config" file.  While being no where near perfect security, it is better than storing the password in plain text in a file.
-Carl V.