ColdFusion Ajax Debugger Ignores CFSETTING

I’m not quite sure I’d call this a security risk, but it is something you should be aware of. I typically use this line in my open source applications to ensure that debug information doesn’t show up, even if the server has it enabled:

<cfsetting showDebugOutput="false">

This will suppress any debugging information from showing up in the browser. However - it doesn’t seem to work with ColdFusion Ajax debugger. If the Ajax debugger is enabled in the ColdFusion Administrator and if you pass ?cfdebug=1 in the URL, it will always show up, even with the setting. (A bug is already filed with Adobe on this one.)

FYI - this was logged as bug 70324.

Raymond Camden's Picture

About Raymond Camden

Raymond is a developer advocate. He focuses on JavaScript, serverless and enterprise cat demos. If you like this article, please consider visiting my Amazon Wishlist or donating via PayPal to show your support. You can even buy me a coffee!

Lafayette, LA https://www.raymondcamden.com

Comments