This week's tip is a simple reminder to check your ColdBox config and ensure that you've changed your reinit and debugMode password for all externally-available sites to be something other than the default.

Out-of-the-box, ColdBox can be reinitialized with the following:
site.com/index.cfm/fwreinit=1

While there's nothing inherently dangerous about that, reinitting can be a costly operation that flushes caches and re-loads configuration. That's probably a load you don't want to deal with unless necessary.

You can also easily turn on debugMode like so:
site.com/index.cfm?debugMode=1

Debug mode is more dangerous as it gives people access to cache settings, control over your modules, and tons of information about the request including the contents of the request collection. While this information is useful while developing, it needs to be carefully guarded on your production servers.

Make sure you don't use the default reinit and debugMode passwords as they can allow complete strangers to get sensitive information out of your site or possibly lead to a security breach. In your /config folder should be your programmatic configuration file, ColdBox.cfc. Open it and look for the following lines:

reinitPassword = "",
debugPassword = "",

If they look like above, that means you are using the default settings and reinitting your application or viewing debug info can be used with the URLs above. Change those lines to have a password set that can't be easily guessed.

reinitPassword = "myReinitPassword",
debugPassword = "myDebugPassword",

You can still reinit your application and turn on debug mode, but you'll now need to do it like this:

site.com/index.cfm/fwreinit=myReinitPassword
site.com/index.cfm?debugMode=1&debugPass=myDebugPassword

More info here: http://wiki.coldbox.org/wiki/ConfigurationCFC.cfm

P.S. Don't want to have to type in the password every time on your development environment? We don't blame you. Use a convenient environment override. Here's a sample configuration CFC that shows how to have production protected with a password and your development environment use no password:

/config/ColdBox.cfc

component{

    function configure(){

        coldbox = {
            appName = "My App",
    
            reinitPassword = "myReinitPassword",
            debugPassword = "myDebugPassword"
        };
    
        environments = {
            development = "^dev.*"
        };

    }

    function development(){
        coldbox.reinitpassword = "";
        coldbox.debugpassword = "";
    }

}