Email	Print Reprint
	add to:
	Del.icio.us Digg Google Furl	Slashdot Y! MyWeb Blink

In the first major overhaul of ColdFusion since acquiring it from Allaire in 2001, Macromedia has totally rearchitected and rewritten ColdFusion's C++ code base in Java. While the rewrite assures greater portability and adherence to Web services standards, as well as opening up a world of Java-based capabilities, new code increases the possibility of new bugs. What's more, a total rewrite might have distracted Macromedia from adding significant features.

Now ColdFusion MX is here. Good news: Not only is it stable, but significant new features abound. And while this review focuses on ColdFusion MX, keep in mind that this one application has been revised as part of a strategic reorientation of Macromedia's product line toward the Web services market.

Web Services

The key to publishing and consuming Web services using ColdFusion MX is the ColdFusion Component (CFC), a new feature in ColdFusion MX. A CFC is a self-documenting, self-contained bundle of methods (functions) that can be invoked both locally on the ColdFusion server and remotely. Physically, a ColdFusion component is embodied in a file with the extension .CFC.

The extremely straightforward interface ColdFusion MX offers for creating and accessing components is impressive. And ColdFusion offers a great deal of flexibility when it comes to invoking component methods, which can be done in one of five ways: using ColdFusion Markup Language (CFML); using CFScript (a server-side scripting language with a subset of ColdFusion functionality); from a Web services client with SOAP; from a Flash application via Flash Remoting; or using a URL that calls a CFC file and passes the method name as a URL parameter.

At a Glance
	ColdFusion MX
Company	Macromedia
URL	www.macromedia.com
Price	$799 new, $549 upgrade (Professional Edition), $4,999 new, $2,499 upgrade (Enterprise Edition)
Pros	Straightforward, robust interface to Web services. Easy connectivity to Flash MX clients. Tight integration with Dreamweaver MX.
Cons	Free alternatives available.

The ColdFusion Web Services Engine, based on the Apache Axis SOAP engine, supports both SOAP and WSDL. ColdFusion automatically generates a WSDL file with information such as your Web service's name, location, and supported operations. You don't have to do anything directly with SOAP to publish or consume Web services.

There are three limitations when attempting to access Web services implemented in technologies other than ColdFusion MX. First, ColdFusion does not support UDDI, so if you want to register your Web service with a public UDDI registry, you'll have to do so manually. The same applies to finding Web services that you might want to use. Realistically, this isn't much of a limitation, because publishing or consuming Web services usually requires custom configuration.

Second, although there are four possible ways to define a SOAP message in WSDL, ColdFusion MX supports only two of the four options: RPC/encoded and document/literal. These two options cover most available services. However, if the WSDL file uses either of the two unsupported options, you won't be able to access the Web service. This issue gives WSDL programmers a lot of headaches. With any luck, it will be straightened out and simplified in the future.

Finally, ColdFusion MX doesn't allow clients (including Flash programs using Flash Remoting) to access non-ColdFusion Web services directly. Instead, the client calls the ColdFusion component, which in turn calls the Web service. This isn't really a problem as long as all the client and server need to do is to exchange data. But if the Web service has a UI, that interface is likely to be sent to the ColdFusion server rather than to the client, where it does no good. The moral of the story: Don't use non-ColdFusion Web services with UIs.

Despite these limitations, ColdFusion MX provides a straightforward yet flexible and robust interface to Web services, putting tremendous power at developers' fingertips. In addition to allowing you to publish and consume Web services, ColdFusion MX lets you create objects in CFML that represent COM and CORBA objects. This is an exciting feature for companies that are invested in COM and CORBA technology. However, note that these objects are created and accessed on the server. Thus, the same UI limitation applies here as with Web services.

Security

ColdFusion MX has an entirely new integrated security framework, replacing the previous security scheme that used Netegrity SiteMinder. The most important new feature is role-based authentication, which will make management of large systems much easier by allowing you to assign rights to groups instead of individuals.

Of course, only time will tell what the vulnerabilities of the new system are. One concern is the lack of transparency in the login process when using the new cflogin tag. On the positive side, the cflogin structure gives a consistent way to get the login ID and password, independent of the authentication mechanism. On the negative side, cflogin doesn't provide a means of determining how the user was authenticated. If a clever and malicious user finds a "back door" to your application, cflogin doesn't give you any way of detecting it. Rather than using cflogin for applications that demand security, you may choose to create your own custom login procedures, assuring that all users come in through the "front door," the single custom login procedure.

This is not meant to imply that ColdFusion MX is any less secure than previous versions. But if you're opening your ColdFusion applications to additional sources of attack (e.g., Flash clients), paranoia may be called for.

Lots More

Another important new feature in ColdFusion MX is XML support. Of twenty-one new functions, parameters, and values in ColdFusion MX, ten relate to XML. You can integrate with XML just like any other data source using built-in document parsing and XSL transformations. Within ColdFusion, an XML document is represented by an object similar to a structure containing arrays. So similar, in fact, that you can actually use standard ColdFusion array and structure functions to manage XML objects, such as the ArrayLen function to determine the number of elements in an XmlChildren array.

Also, ColdFusion now allows you to integrate a variety of Java resources without writing any Java. Like HTML pages, ColdFusion pages have always been able to incorporate client-side JavaScript and Java applets. Now, ColdFusion can also integrate with JSP, servlets, custom-written Java objects like Enterprise JavaBeans (EJBs), and all the standard Java classes and methods that make up the J2EE APIs.

ColdFusion MX pages can include or forward to JSP pages, and vice versa. Both types of pages can share data in persistent scopes. You can import JSP tag libraries, such as those offered through the Apache Jakarta Project Taglibs project, and incorporate JSP servlets within ColdFusion MX applications. This works because the ColdFusion MX server itself is a J2EE application.

There are numerous other significant new features in ColdFusion MX, including Unicode support; Section 508 accessibility support; full-featured graphing and charting; cftrace, a new tag that displays and logs debugging data, including runtime logic flow, variable values, and execution time; and regular expressions that are, with minor exceptions, Perl-compatible.

Flash Remoting

Some of the most interesting additions involve integration with existing Macromedia products, like Flash and Dreamweaver. In particular, Flash Remoting, a free add-on to the Flash MX authoring tool, makes it relatively straightforward to create Flash client applications that access a ColdFusion MX server.

Flash Remoting also allows Flash movies to access Web services based on .Net and J2EE by going through the ColdFusion MX server, without any additional development on the .Net or J2EE server. (Flash Remoting does not support PHP-based Web services beyond simple SOAP 1.1/WSDL 1.1 connectivity, or ASP.Net.)

With Flash Remoting comes the ability to use server-side ActionScript (SSAS). In addition to the basic ActionScript syntax used in Flash, SSAS supports two new functions: CF.query, which performs queries against ColdFusion data sources; and CF.http, which executes HTTP POST and GET operations, allowing you to download text or binary files from the server, or to send various types of information to the server. The Flash client application must be running in Flash Player 6 in order to use Flash Remoting. This is still a significant limitation, though it will lessen over time, as more people upgrade the Flash Player browser plug-in.

And there's one more piece to the puzzle, released in July: the Flash Communication Server MX, a real-time streaming audio and video server, accessible from Flash MX applications via the Real-Time Messaging Protocol (RTMP). The Communication Server can in turn access ColdFusion MX servers.

The Bottom Line

With ColdFusion MX and the rest of the MX suite, Macromedia has addressed the challenges of Web services-based programming without greatly complicating the job of creating code. In some ways, ColdFusion has even simplified it. Nevertheless, this evolution will require some training in and understanding of the MX suite.

For Flash MX programmers looking to add database-driven and Web services-driven applications to their list of skills, there are very strong arguments for focusing on ColdFusion as your preferred application server. It's now easier to get Flash and ColdFusion working together to create deployable applications.

ColdFusion is the ideal tool for Web designers and Flash developers who don't have the time or the inclination to go out and conquer new worlds of programming, but do have clients who want database-driven or Web services-driven applications. ColdFusion MX provides the easiest learning curve and the quickest return on investment.

Michael is a coauthor of Using Flash MX from Que books, and is the Flash guy for Late Night Design. Contact him at michael@hurwicz.com.

RELATED ARTICLES No Related Articles		TOP 5 ARTICLES No Top Articles.