skills.rest
ColdBox
ColdBoxOFFICIAL
Explore all skills by this author →
Website𝕏@coldboxGitHub

coldbox-security-authorization

Enforce ColdBox authorization rules for events, URLs, and handler actions.

1|Updated Apr 10, 2026
Search Tags:#authorization#permissions#firewall#roles#coldbox#cbsecurity#handler-security
One-click install
npx skills add https://github.com/ColdBox/skills --skill coldbox-security-authorization
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: coldbox-security-authorization
Source: https://github.com/ColdBox/skills/tree/main/security/authorization
Command: npx skills add https://github.com/ColdBox/skills --skill coldbox-security-authorization

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps developers define and enforce authorization rules in ColdBox applications so that only properly authorized users can access events, URLs, handler actions, and sensitive views.

Core Features & Use Cases

  • Defines cbsecurity rules for event-based and URL-based protection using secure lists, whitelists, and regex matching.
  • Demonstrates role and permission checks in handlers with cbsecurity.has, cbsecurity.all, cbsecurity.can, and cbsecurity.block to handle unauthorized access.
  • Shows handler-level annotations with @secured for protecting entire handlers or specific actions, and resource-owner checks for edit/delete flows.
  • Covers firewall configuration, default actions (redirect or block), status codes for APIs, and view-level UI gating for conditional rendering.
  • Use Case: Protect admin routes, secure API endpoints, and implement resource-based authorization to ensure users can only edit their own records.

Quick Start

Secure the users.edit handler by requiring the admin role and configuring unauthorized requests to redirect to /login.

Frequently Asked Questions about coldbox-security-authorization

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure ColdBox handlers with role-based access control?▼

Secure ColdBox handlers by applying @secured annotations to entire handlers or specific actions, requiring defined roles before granting access to events and handler actions.

How do I configure firewall rules for ColdBox events and URLs?▼

Configure ColdBox firewall rules using secure lists, whitelists, and regex matching to protect events and URLs, setting default actions to redirect unauthorized requests or block them with API status codes.

How do I check user permissions in a ColdBox handler?▼

Check user permissions in ColdBox handlers using cbsecurity.has and cbsecurity.all for role validation, and cbsecurity.can for specific permission checks to gate access.

How do I implement resource-owner authorization for edit and delete flows?▼

Implement resource-owner authorization by validating ownership during edit and delete flows, ensuring authenticated users can only modify records they own within ColdBox handler actions.

Can I conditionally render ColdBox views based on user permissions?▼

Conditionally render ColdBox views by applying view-level UI gating checks, using cbsecurity validation methods to display or hide interface elements based on the current user's permissions.

Does cbsecurity support API endpoint protection with custom HTTP status codes?▼

cbsecurity supports API endpoint protection by configuring the firewall to block unauthorized requests, returning specific HTTP status codes instead of redirecting when access is denied.

Related Skills

Explore More Software Engineering Skills→
ColdBoxColdBox

coldbox-security-implementation

Configure CBSecurity authentication, authorization, and firewall rules for ColdBox apps.

Official
Advanced
hopeoverturehopeoverture
6

supabase-auth-ssr-setup

Configure Supabase authentication for Next.js App Router with SSR middleware and route guards.

Community
Advanced
ColdBoxColdBox

coldbox-security-rbac

Implement role-based access control for ColdBox applications with database schemas.

Official
Intermediate
ColdBoxColdBox

cbsecurity

Secure ColdBox and BoxLang apps with annotation-based access control and JWT authentication.

Official
Advanced