title: Coldfusion - How to prevent the execution of ajax "GET" query on the server
body: <p>I'm developing an application in Coldfusion and AngularJS. I'm use AngularJS 1 and CF11. </p>
  
  <p>A user has to be logged into the application. The user id is saved in the CF session.</p>
  
  <p>In myAngularJS service I implemented Factories like that:</p>
  
  <pre><code>app.factory('ContactService', function($http){
  
      var factory={};
  
      factory.getContact=function(id){
          return $http.post('http://myapp/contacts.cfc?method=getContacts&amp;subsString=' + id);
      };
  
      return factory;     
  })
  </code></pre>
  
  <p>Here my component <em>contacts.cfc</em></p>
  
  <pre><code>&lt;cfcomponent displayname="Contacts" hint="Webservice for contacts app"&gt;
  
     &lt;cffunction name="getContacts" access="remote" returnformat="JSON" output="no"&gt;
          &lt;cfargument name="subsString" required="no" type="String" /&gt;
  
          &lt;cfset ret = arrayNew(1) /&gt;
          &lt;cftry&gt;   
  
              &lt;cfinclude template="cfc/person/qry/qry_Search.cfm" /&gt;
              &lt;cfloop from="1" to="#qryFastSearch.recordcount#" index="i"&gt;   
  
                  &lt;cfset searchVO = structNew() /&gt;
                  &lt;cfset searchVO['ID']= #qryFastSearch.ID[i]# /&gt;         
                  &lt;cfset searchVO['PERSON']= #qryFastSearch.personName[i]# /&gt;
                  &lt;cfset searchVO['COMPANY']= #qryFastSearch.COMPANY[i]# /&gt;
  
                  &lt;cfset ret[i] = searchVO /&gt;
              &lt;/cfloop&gt;
  
              &lt;cfcatch type="any"&gt;
                  &lt;cfset returnVO = structNew() /&gt;
                  &lt;cfset returnVO.ERROR = true /&gt;
                  &lt;cfset returnVO.MESSAGE = cfcatch.Message /&gt;
                  &lt;cfset ret[1] = returnVO /&gt;
              &lt;/cfcatch&gt;
          &lt;/cftry&gt; 
  
          &lt;cfreturn SerializeJSON(ret)&gt;       
      &lt;/cffunction&gt;
  
  &lt;/cfcomponent&gt;
  </code></pre>
  
  <p>When the system execute the controller, the factory is executed and the results appear. We can see in the console of the browser the url executed.</p>
  
  <p>For example: <a href="http://myapp/contacts.cfc?method=getContacts&amp;subsString=test" rel="nofollow noreferrer">http://myapp/contacts.cfc?method=getContacts&amp;subsString=test</a></p>
  
  <p>I would like to avoid a person to execute a query (thanks to this kind of url) if she is not connected into the application.</p>
  
  <p>Is it equally possible to hide the url in the browser ?</p>
  
  <p>What is the best way in order to do that ?</p>
  
  <p>Many thanks in advance for your help.</p>