Blog

Brad Wood

December 26, 2016

Spread the word


Share your thoughts

This is our final installment of the 12 Tips of (CommandBox) Christmas and we hope you've learned some new tricks.  In this last segment, we'll cover setting up custom error pages for your CommandBox-based web servers.  This applies to all CF engines that you start and can help you add a bit of polish to a CommandBox-powered site you want to make public. 

Custom Error Pages

CommandBox's server started as a development tool, but has now grown to a fully-functional and performant web server that can handle most any site.  You can customize the error page that CommandBox servers return when a missing file is requested. You can have a setting for each status code including a default error page to be used if no other setting applies.


Create an errorPages object inside the web object in your server.json where each key is the status code integer or the word default and the value is a relative (to the web root) path to be loaded for that status code.
This is what you server.json might look like:

{
  "web" : {
    "errorPages" : {
      "404" : "/path/to/404.html",
      "500" : "/path/to/500.html",
      "default" : "/path/to/default.html"
    }
  }
}

You can set error pages via the server set command like this:

server set web.aliases.404=/missing.htm

Accessing error variables

If your error page points to a CFM file, you can get access to the original path being accessed for 404s and the error that was thrown for 500s. This requires that your error handler page is CFML.  To see all the request headers that are available, use the following snippet of code:

req = getPageContext().getRequest();
names = req.getAttributeNames();
while( names.hasMoreElements() ) {
    name = names.nextElement();
    writeDump( name & ' = ' & req.getAttribute( name ) );
}

An example of getting the original missing path in a 404 would look like this:

var originalPath = getPageContext().getRequest().getAttribute( "javax.servlet.error.request_uri" );


 

Add Your Comment

Recent Entries

BoxLang 1.17 Series Part 4 : WriteDump Enhanced!

BoxLang 1.17 Series Part 4 : WriteDump Enhanced!

You call writeDump() on an ORM entity or a very rich class graph . The browser locks up. Thirty seconds later you get a page with forty thousand rows on it, you scroll for a while, you give up, and you go edit your code to dump a sub-key instead. Or worse, you crash the server.

Luis Majano
Luis Majano
September 11, 2026
BoxLang AI 3.4 Blog Series Part 4 : Locking Down Prompt Injection

BoxLang AI 3.4 Blog Series Part 4 : Locking Down Prompt Injection

LLM applications face a class of attack traditional input validation was never built for: prompt injection. An attacker embeds instructions in user input, a retrieved document, a web page your tool fetched, or an MCP result, trying to override your system prompt, exfiltrate data, or hijack a tool call. BoxLang AI 3.4.0 ships four layered, configurable defenses against exactly this, plus one more that's on unconditionally.

Luis Majano
Luis Majano
September 11, 2026