Blog

Brad Wood

July 22, 2013

Spread the word


Share your thoughts

This week's tip is a simple reminder to check your ColdBox config and ensure that you've changed your reinit and debugMode password for all externally-available sites to be something other than the default.

Out-of-the-box, ColdBox can be reinitialized with the following:
site.com/index.cfm/fwreinit=1

While there's nothing inherently dangerous about that, reinitting can be a costly operation that flushes caches and re-loads configuration. That's probably a load you don't want to deal with unless necessary.

You can also easily turn on debugMode like so:
site.com/index.cfm?debugMode=1

Debug mode is more dangerous as it gives people access to cache settings, control over your modules, and tons of information about the request including the contents of the request collection. While this information is useful while developing, it needs to be carefully guarded on your production servers.

Make sure you don't use the default reinit and debugMode passwords as they can allow complete strangers to get sensitive information out of your site or possibly lead to a security breach. In your /config folder should be your programmatic configuration file, ColdBox.cfc. Open it and look for the following lines:

reinitPassword = "",
debugPassword = "",

If they look like above, that means you are using the default settings and reinitting your application or viewing debug info can be used with the URLs above. Change those lines to have a password set that can't be easily guessed.

reinitPassword = "myReinitPassword",
debugPassword = "myDebugPassword",

You can still reinit your application and turn on debug mode, but you'll now need to do it like this:

site.com/index.cfm/fwreinit=myReinitPassword
site.com/index.cfm?debugMode=1&debugPass=myDebugPassword

More info here: http://wiki.coldbox.org/wiki/ConfigurationCFC.cfm

P.S. Don't want to have to type in the password every time on your development environment? We don't blame you. Use a convenient environment override. Here's a sample configuration CFC that shows how to have production protected with a password and your development environment use no password:

/config/ColdBox.cfc

component{

    function configure(){

        coldbox = {
            appName = "My App",
    
            reinitPassword = "myReinitPassword",
            debugPassword = "myDebugPassword"
        };
    
        environments = {
            development = "^dev.*"
        };

    }

    function development(){
        coldbox.reinitpassword = "";
        coldbox.debugpassword = "";
    }

}

Add Your Comment

(2)

Mar 14, 2017 17:02:00 UTC

by joe smith

I'm running version 3.5, and in order to make the reinit and debug password strong, i want to include special characters...but doesnt seem to work with special characters. is that by design? Thanks

Mar 14, 2017 17:45:16 UTC

by Brad Wood

Joe, I'm not aware of any such restriction. Can you report to our mailing list the code you used to set the password? Please note, if you have a quote or hash in your password, you'll need to escape it using the standard CFML rules.

Recent Entries

Into the Box 2024 Last Early Bird Days!

Into the Box 2024 Last Early Bird Days!

Time is ticking, with less than 60 days remaining until the excitement of Into the Box 2024 unfolds! Don't let this golden opportunity slip away; our exclusive Early Bird Pricing is here for a limited time only, available until March 31st. Why wait? Secure your seat now and take advantage of this steal!

Maria Jose Herrera
Maria Jose Herrera
March 20, 2024
Ortus February Newsletter 2024

Ortus February Newsletter 2024

Welcome to Ortus Solutions’ monthly roundup, where we're thrilled to showcase cutting-edge advancements, product updates, and exciting events! Join us as we delve into the latest innovations shaping the future of technology.

Maria Jose Herrera
Maria Jose Herrera
March 06, 2024
Unveiling the Future of CFML Development - 3rd Round of Sessions

Unveiling the Future of CFML Development - 3rd Round of Sessions

Welcome back to our journey into the future of CFML development! As excitement continues to build for Into the Box 2024, we're thrilled to bring you the latest updates on what promises to be a transformative event. Continuing our blog post series, let's delve deeper into the third wave of session releases and discover the key surprises awaiting attendees. Learn More

Maria Jose Herrera
Maria Jose Herrera
March 01, 2024