Pete Freitag Pete Freitag

How to Disable Robust Exception Information on Lucee or Railo

Updated on August 07, 2020
By Pete Freitag
coldfusion

As you know one of the first things you should do on a production ColdFusion server is disable robust exception information (this includes things like source code, and file path disclosures in error messages), in the ColdFusion Administrator. This information is great for developers debugging problems, but it's also great info for hackers.

If you are using Lucee or Railo, it too outputs this information in error messages by default. You can disable server wide by going into the Lucee Server Administrator /lucee/admin/server.cfm. Click on the Error link under Settings. Change General Error Template (500) from error.cfm to error-public.cfm, also change Missing Template Error (404) from error.cfm to error-public.cfm.

Your pages will now output a message in red:

We're sorry - An Error Occurred

Now that you know how to change the default, you might want to create a custom global 500 and 404 handler cfm file.



railo security errors lucee

How to Disable Robust Exception Information on Lucee or Railo was first published on May 13, 2010.

If you like reading about railo, security, errors, or lucee then you might also like:

FuseGuard Web App Firewall for ColdFusion

The FuseGuard Web Application Firewall for ColdFusion & CFML is a high performance, customizable engine that blocks various attacks against your ColdFusion applications.

CFBreak
The weekly newsletter for the CFML Community


Comments

It's harder to turn it ON in such a fashion that you get a good debug info a la CF8. I still cannot for the life of me get URL, FORM and Attributes variables in the debug info. What am I not seeing?
by Sebastiaan on 05/17/2010 at 8:12:18 AM UTC