Blog

Brad Wood

July 22, 2013

Spread the word


Share your thoughts

This week's tip is a simple reminder to check your ColdBox config and ensure that you've changed your reinit and debugMode password for all externally-available sites to be something other than the default.

Out-of-the-box, ColdBox can be reinitialized with the following:
site.com/index.cfm/fwreinit=1

While there's nothing inherently dangerous about that, reinitting can be a costly operation that flushes caches and re-loads configuration. That's probably a load you don't want to deal with unless necessary.

You can also easily turn on debugMode like so:
site.com/index.cfm?debugMode=1

Debug mode is more dangerous as it gives people access to cache settings, control over your modules, and tons of information about the request including the contents of the request collection. While this information is useful while developing, it needs to be carefully guarded on your production servers.

Make sure you don't use the default reinit and debugMode passwords as they can allow complete strangers to get sensitive information out of your site or possibly lead to a security breach. In your /config folder should be your programmatic configuration file, ColdBox.cfc. Open it and look for the following lines:

reinitPassword = "",
debugPassword = "",

If they look like above, that means you are using the default settings and reinitting your application or viewing debug info can be used with the URLs above. Change those lines to have a password set that can't be easily guessed.

reinitPassword = "myReinitPassword",
debugPassword = "myDebugPassword",

You can still reinit your application and turn on debug mode, but you'll now need to do it like this:

site.com/index.cfm/fwreinit=myReinitPassword
site.com/index.cfm?debugMode=1&debugPass=myDebugPassword

More info here: http://wiki.coldbox.org/wiki/ConfigurationCFC.cfm

P.S. Don't want to have to type in the password every time on your development environment? We don't blame you. Use a convenient environment override. Here's a sample configuration CFC that shows how to have production protected with a password and your development environment use no password:

/config/ColdBox.cfc

component{

    function configure(){

        coldbox = {
            appName = "My App",
    
            reinitPassword = "myReinitPassword",
            debugPassword = "myDebugPassword"
        };
    
        environments = {
            development = "^dev.*"
        };

    }

    function development(){
        coldbox.reinitpassword = "";
        coldbox.debugpassword = "";
    }

}

Add Your Comment

(2)

Mar 14, 2017 17:02:00 UTC

by joe smith

I'm running version 3.5, and in order to make the reinit and debug password strong, i want to include special characters...but doesnt seem to work with special characters. is that by design? Thanks

Mar 14, 2017 17:45:16 UTC

by Brad Wood

Joe, I'm not aware of any such restriction. Can you report to our mailing list the code you used to set the password? Please note, if you have a quote or hash in your password, you'll need to escape it using the standard CFML rules.

Recent Entries

Secure your Agency Against Cyberattacks

Secure your Agency Against Cyberattacks

Recent incidents, such as the compromise of federal agencies through Adobe ColdFusion vulnerabilities, underscore the pressing need for comprehensive cybersecurity measures. In this blog post, we delve into the urgency of fortifying your agency's defenses and present "10 Reasons Why It's Time to Secure Your Agency Against Cyberattacks.”

Maria Jose Herrera
Maria Jose Herrera
December 07, 2023
Into the Box Latam 2023 | Rueda de Prensa

Into the Box Latam 2023 | Rueda de Prensa

En este artículo, exploraremos las reseñas, notas y publicaciones en redes sociales, revistas digitales y blogs de noticias que han surgido a raíz de este emocionante evento que tuvo lugar el jueves 30 de noviembre.

Maria Jose Herrera
Maria Jose Herrera
December 07, 2023
ColdBox 7.2.0 Released

ColdBox 7.2.0 Released

ColdBox, a widely used development platform for ColdFusion (CFML), has unveiled version 7.2. Packed with compelling new features, bug fixes, and enhancements, this release is designed to empower developers by boosting productivity, refining scheduled task capabilities, and enhancing the overall reliability and efficiency of application development. This article will delve into the key highlights of ColdBox 7.2 and elucidate how these advancements can positively impact developers in their daily coding endeavors.

Luis Majano
Luis Majano
November 20, 2023