Blog

Brad Wood

July 22, 2013

Spread the word


Share your thoughts

This week's tip is a simple reminder to check your ColdBox config and ensure that you've changed your reinit and debugMode password for all externally-available sites to be something other than the default.

Out-of-the-box, ColdBox can be reinitialized with the following:
site.com/index.cfm/fwreinit=1

While there's nothing inherently dangerous about that, reinitting can be a costly operation that flushes caches and re-loads configuration. That's probably a load you don't want to deal with unless necessary.

You can also easily turn on debugMode like so:
site.com/index.cfm?debugMode=1

Debug mode is more dangerous as it gives people access to cache settings, control over your modules, and tons of information about the request including the contents of the request collection. While this information is useful while developing, it needs to be carefully guarded on your production servers.

Make sure you don't use the default reinit and debugMode passwords as they can allow complete strangers to get sensitive information out of your site or possibly lead to a security breach. In your /config folder should be your programmatic configuration file, ColdBox.cfc. Open it and look for the following lines:

reinitPassword = "",
debugPassword = "",

If they look like above, that means you are using the default settings and reinitting your application or viewing debug info can be used with the URLs above. Change those lines to have a password set that can't be easily guessed.

reinitPassword = "myReinitPassword",
debugPassword = "myDebugPassword",

You can still reinit your application and turn on debug mode, but you'll now need to do it like this:

site.com/index.cfm/fwreinit=myReinitPassword
site.com/index.cfm?debugMode=1&debugPass=myDebugPassword

More info here: http://wiki.coldbox.org/wiki/ConfigurationCFC.cfm

P.S. Don't want to have to type in the password every time on your development environment? We don't blame you. Use a convenient environment override. Here's a sample configuration CFC that shows how to have production protected with a password and your development environment use no password:

/config/ColdBox.cfc

component{

    function configure(){

        coldbox = {
            appName = "My App",
    
            reinitPassword = "myReinitPassword",
            debugPassword = "myDebugPassword"
        };
    
        environments = {
            development = "^dev.*"
        };

    }

    function development(){
        coldbox.reinitpassword = "";
        coldbox.debugpassword = "";
    }

}

Add Your Comment

(2)

Mar 14, 2017 17:02:00 UTC

by joe smith

I'm running version 3.5, and in order to make the reinit and debug password strong, i want to include special characters...but doesnt seem to work with special characters. is that by design? Thanks

Mar 14, 2017 17:45:16 UTC

by Brad Wood

Joe, I'm not aware of any such restriction. Can you report to our mailing list the code you used to set the password? Please note, if you have a quote or hash in your password, you'll need to escape it using the standard CFML rules.

Recent Entries

Ortus Will be at Adobe CF Summit 2022!

Ortus Will be at Adobe CF Summit 2022!

4 of our Ortusians will be speaking at CF Summit this year from Oct 3 - 4 in Las Vegas, Nevada. Here are all the details you need to join us and enjoy valuable CFML content to modernize your projects! We are sponsoring the event and will have a booth for you to come by and have a chat with our team!

Maria Jose Herrera
Maria Jose Herrera
September 27, 2022
Prefetching in CBWIRE

Prefetching in CBWIRE

When I want to increase the perceived speed of my CBWIRE apps, one tool I reach for is prefetching. Prefetching is a built-in feature of Livewire JS that allows you to invoke an Action's results on mouseOver.

Grant Copley
Grant Copley
September 20, 2022
Into the Box 2022 - Conference Recap

Into the Box 2022 - Conference Recap

This years Into the Box has just wrapped up, but we are already preparing for 2023’s Into the Box, May, Houston Texas! The event was a huge success, we had solid attendance in person, and almost doubled our online viewership from 2021, great feedback from attendees in Houston, and online. So many attendees didn’t say goodbye at the end of the conference, they said see you next year, which, as an organizer lets you know you’ve done things right, and the hard work has paid off.

Gavin Pickin
Gavin Pickin
September 16, 2022