title: How can I secure ColdFusion CFC Web Services?
body: <p>I am in the process of creating a simple Web Service for a Client of our's who wants the ability to retrieve shopping cart information and add/update items in the cart. I have written a CFC with a remote method for each. Now, obviously when these CFC methods are set to <code>access="remote"</code>, the entire world can call them as is. However, I need to enable security to ensure that the only people that can call these methods remotely (not from within my website) are those that I've given permission to. And I don't want it to be intrusive (forcing a login, etc.). </p>
  
  <p>For example, the Web Services exist on <a href="http://www.mywebsite.com" rel="nofollow">http://www.mywebsite.com</a> and I only want to permit requests from <a href="http://www.yoursite1.com" rel="nofollow">http://www.yoursite1.com</a> and <a href="http://www.yoursite2.com" rel="nofollow">http://www.yoursite2.com</a>. Using <code>HTTP_REFER</code> is no good, since this can be spoofed. How can I do this? Is it possible to use a self-signed certificate to somehow verify that the request is allowed?</p>
  
  <p>NOTE: I'd also like to be able to use these Web Services for calls from our own website, so I'll need a solution that works for both scenarios.</p>