How to Disable Robust Exception Information on Railo
As you know one of the first things you should do on a production ColdFusion server is disable robust exception information (this includes things like source code, and file path disclosures in error messages), in the ColdFusion Administrator. This information is great for developers debugging problems, but it's also great info for hackers.
If you are using Railo, it too outputs this information in error messages by default. You can disable server wide by going into the Railo Server Administrator
/railo-context/admin/server.cfm. Click on the Error link under Setttings. Change General Error Template (500) from
error-public.cfm, also change Missing Template Error (404) from
Your pages will now output a message in red:
We're sorry - An Error Occurred
Now that you know how to change the default, you might want to create a custom global 500 and 404 handler cfm file.
- ColdFusion returning empty response with server-error: true
- Careful applying CF11u16, CF2016u8, CF2018u2
- Sessions don't work in Chrome but do in IE
- csrfVerifyToken does not invalidate the token
- The cf_sql_ is optional in cfqueryparam
- Cookie Expires / Max-Age 1969-12-31T23:59:59.000Z
- Burst Throttling on AWS API Gateway Explained
- How to Resolve Java HTTPS Exceptions