What makes verifyClient in cffunction secure?

Question

What does verifyClient in <cffunction> actually do that makes it secure? secure from what?

Doc said:

A Boolean value that specifies whether to require remote function calls to include an encrypted security token. For use with ColdFusion AJAX applications only.

encrypted security token? who generates that? Client-side by JS? Injected to JS on page request by CF? What if another person uses the same security token?

Answer 1

By looking at the generated source, the _cf_clientid is a string of hexadecimal generated by ColdFusion and injected to the client's JavaScript.

Seems like that ID will be compared with the CFID and CFTOKEN if session management is enabled.

I opened another browser and go to the same URL (GET), and the server replies a HTTP 500 internal server error.