Access Modifiers (public, private, package, remote)

Access modifiers control who's allowed to call a method. ColdFusion has four: public, private, package, and remote — set through cffunction's access attribute (or the equivalent CFScript keyword before function).

Learning Objectives

After completing this lesson, you'll be able to:

Use all four access levels: public, private, package, remote.
Explain the difference between the variables scope (private data) and the this scope (public data) inside a CFC.
Choose private for internal helper methods that shouldn't be part of a component's public API.

The Four Access Levels

Level	Who can call it
public	Anyone — the default if access is omitted
private	Only other methods within the same component
package	Methods in components within the same package (directory) only
remote	Anyone, plus it's callable over HTTP/AJAX as a web service or REST endpoint

private for Internal Helper Logic

CFScript — OrderService.cfc

component {

    public numeric function calculateTotal(required array items) {
        return applyDiscount(arraySum(arrayMap(arguments.items, (i) => i.price)));
    }

    private numeric function applyDiscount(required numeric amount) {
        return arguments.amount > 1000 ? arguments.amount * 0.9 : arguments.amount;
    }

}

Tag Syntax

<cfcomponent>

    <cffunction name="calculateTotal" access="public" returnType="numeric">
        <cfargument name="items" type="array" required="true">
        <cfreturn applyDiscount(arraySum(arrayMap(arguments.items, (i) => i.price)))>
    </cffunction>

    <cffunction name="applyDiscount" access="private" returnType="numeric">
        <cfargument name="amount" type="numeric" required="true">
        <cfreturn arguments.amount GT 1000 ? arguments.amount * 0.9 : arguments.amount>
    </cffunction>

</cfcomponent>

NOTE

applyDiscount is an implementation detail — calculateTotal is the only method meant to be called from outside, so it's the only one marked public.

variables Scope (Private Data) vs this Scope (Public Data)

Data stored in the variables scope is only reachable from inside the component's own methods — the same idea as a private property in other languages. Data stored on this is reachable from outside, through the object reference, the same way an auto-generated getter exposes it.

CFScript

Simulated output — illustrative only, not a live ColdFusion/Lucee server.

Tag Syntax

Simulated output — illustrative only, not a live ColdFusion/Lucee server.

Common Beginner Mistakes

Marking every method public out of habit

Internal helper logic that other code shouldn't depend on directly is a good candidate for private — it keeps the component's real public API small and makes future refactoring safer.

Storing sensitive data on this instead of variables

Anything on this is directly readable from outside the object. Data that should stay internal — like an unhashed value used mid-calculation — belongs in variables, not this.

Best Practices

Default to private for anything that isn't part of the component's intended public API.
Reserve remote strictly for methods that genuinely need to be called over HTTP (a REST endpoint, an AJAX handler) — it's the most permissive level.

Interview Questions

What's the difference between private and package access?

private restricts a method to being called only from within the same component. package additionally allows calls from other components that live in the same directory/package.

What makes remote access different from public?

remote methods are callable over HTTP as a web service or REST endpoint, in addition to being callable normally — public methods are only reachable from within the running CFML application.

Summary

In this lesson, you covered all four access levels and the difference between a component's private variables scope and its public this scope.

What's Next?

The next lesson covers encapsulation directly — the OOP pillar that access modifiers and scopes exist to support.