Prevent Direct Access to Custom Tags

csgaraglino  wrote http://www.yourdomain.com/my-custom-tag.cfm How do I stop any direct URL access  to a CT or CFC - and only allow the CT to run when called?

You could just use the settings in your web-server to deny access to the URL.

We avoid using custom tags but some of our legacy tags have code similar to the following:

<cfif NOT thisTag.hasEndTag>

    <cfabort showerror="You need to supply a closing &lt;CF_Head&gt; tag.">

</cfif>

<cfif thisTag.executionMode EQ "end">...

You may be able to simply check for the existence of thisTag - isDefined("thisTag").

Another option is updating your application.cfm or application.cfc to white list the templates that can be accessed from the outside world. You can do the same via folders and access permissions similar to what haxtbh mentioned - but restructuring your app may be more difficult than <cfif NOT listFindNoCase("big.cfm,ugly.cfm,list.cf,of.cfm,files.cfm",cgi.script_name)><cfabort showerror="Go away!" /></cfif>

Not storing them in the web root would be the first thing. Is there a reason they need to go in the webroot?

If they must be there, then put them in a sub folder which is only accessible by the CF service, if anyone else navigates to them it will give them a 401/3