title: securing remote CFCs in Coldfusion
body: <p>I'm having a lot of trouble finding information about securing remote functions on Coldfusion CFCs for AJAX calls.  Lets say you're retrieving sensitive information for a user after the user logs in to the site via an AJAX call.  You call something like this:</p>
  
  <p><a href="https://www.mySite.com/pathToCFC/MyCFC.cfc?method=getBankInfo&amp;userID=2343" rel="nofollow">https://www.mySite.com/pathToCFC/MyCFC.cfc?method=getBankInfo&amp;userID=2343</a></p>
  
  <p>So this is obviously super insecure as anyone could call this from a browser and change userID to get different user's bank info.  </p>
  
  <p>I've read about using the roles attribute on the remote function and using cflogin to authenticate a user, but even with this in place, wouldn't you have to pass the userID like the above call?  Wouldn't an authenticated user still be able to switch the userID to discover new user's bank info?</p>