The tag allows you to easily integrate third-party Oauth 2 authentication provider in your application. This tag currently supports Facebook and Google authentication. Also, this tag supports Oauth providers that support the Oauth 2 protocols. For instance, Microsoft and Github.

If type is not Facebook or Google then use access token endpoint and other attributes.



This tag requires Adobe ColdFusion 11 and up. Not supported on Lucee, OpenBD, etc.

cfoauth Attribute Reference


Currently supported values are Facebook and Google. Implicitly supports the authentication workflow of Facebook and Google. Values:
  • Facebook
  • Google


Unique ID generated while registering your application with the Oauth provider.


Scopes are the permissions that a developer seeks from the users. These are usually comma separated values of permissions.

Refer to the Oauth provider's documentations for more information.

For example, after Facebook authentication, if a developer wants to access an email address and then the friend lists of a user, the developer will use:


Note: The scope name varies for different Oauth providers.


The state variable is used to pass back any information to your web application after the authentication and redirection are completed. Any value passed to this attribute is returned to the web application after authentication. This is useful for CSRF (Cross-site request forgery) protection. You can use ColdFusion’s security-related CSRF functions for this attribute.

Default: Either type can be specified or endpoints combination but not both

If type is not specified, this will be used as end point URL to be invoked for user authentication.

Default: Either type can be specified or endpoints combination but not both

If type is not specified this will be used as end point URL to be invoked for app authentication.


Parameter is the App Secret as displayed in your social media app's settings.


A struct which will have login info of the user including login success/failure, failure reason, user name, user id.

Default: This will default to the URL which is executing the code. So if in oauth settings user has given app URL as : http://domainname/appname And the file executing the code is : http://domainname/appname/login.cfm The redirect URI will be : http://domainname/appname/login.cfm

To redirect once user authentication is done.


Extra options which will be passed as URL query string to authendpoint.

Links more information about cfoauth

Examples sample code using the cfoauth tag

Adobe Example

The following example shows a simple authentication:

 type = "Facebook"
 clientid = "YOUR_CLIENT_ID"
 secretkey = "YOUR_SECRET_KEY"
 result = "res"
 redirecturi = "http://localhost:8500/doc/login.cfm" >
 <cfloginuser name = "#res.other.username#" password = "#res.access_token#" roles = "user"/>
<cflocation url="http://localhost:8500/doc/index.cfm" >

Fork me on GitHub