coldfusion 2023 debugging ip address list does not work

[jeff38011374seqk]

I am using Coldfusion 2023 (developer version, for now while I test it).

In the debugging IP address section (see image below) I have entered 127.0.0.1

But, it doesn't matter what IP address I connect from, I still see the debugging info when I test with a .cfm page that has an error in it.

I thought that debugging info would only show if I connected from the ip address in the debugging list.

Is there something else that I need to configure?

[Dave Watts]

What IP address do you see in the CF debug output?

Dave Watts, Eidolon LLC 

[jeff38011374seqk]

I'm testing from a remote computer (see below). So, I wouldn't expect the remote computer to get debugging messages since it isn't in the IP debugging list. I am assuming there must be something else that needs to get configured, but I can't figure out what that might be.

[Priyank Shrivastava.]

Hi @jeff38011374seqk 

If you are using remote server debugging then use the "Add current" and it will add your machine IP address and it will show the debugging info.

Also, enable debugging in CF Admin so you can see what debugging info you are looking for.

[jeff38011374seqk]

Actually, the issue is the opposite.

I'm seeing the debugging info no matter what IP I connect from.

What I want is to configure my CF server so that I see debugging info only if I connect from one of the IP addresses listed in the debugging list.

[BKBK]

What happens when you uncheck the checkboxes on the "Debug Output Settings" page?

[jeff38011374seqk]

It doesn't resolve the problem (i.e. it just send less debug info to browsers).

I finally gave up on this - looks like it's a bug in the CF Admin program - so it's unlikely something that I can fix.

Instead, I'm using a workaround that I believe others are already using.

In the CF admin, I set CF to send 500 errors to IIS (so that no debugging info gets shown to site vistors) and then setup a sitewide CF error page that dispays a generice error message while at the same time emailing me the error details that I need for debugging.

[BKBK]

Please report a ColdFusion bug.

[BKBK]

@jeff38011374seqk ,

Yet another test, if only just for curiosity. What happens when:

(1) you add the following IPs to the list (in addition to 127.0.0.1)

    0:0:0:0:0:0:0:1

    ::1

(2) you restart ColdFusion afterwards.

[Charlie Arehart · Accepted solution]

If I may step in, there's no bug here to report, for reasons I will explain. And I'll offer a couple alternatives besides your wise decision to go with an error handler.  With all due respect to everyone trying to help so far, this issue is one that can trip up lots of folks--so don't feel bad for struggling with it, Jeff . 🙂 

First and to the main concern you raised here, the debug output setting and ip address features in fact have ZERO to do with the error details you're reporting and are concerned to hide (rightfully so). Instead, note that on that Cf admin debug output settings page there is the "robust exception handling" option, which controls how much DETAIL is shown in error messages. Unchecking that, alone may have suited your need.

(It's indeed unfortunate that this setting is on that page. It can lead to reasonable confusion with other debug output which IS controlled by that debug ip list.) 

Second, as you've now found, using an error handler (site-wide or app-level) is indeed the way to prevent a user seeing ANY error info from CF. And yes, you could send that error info to yourself in such an error handler (and/or log it, or store it in a db, etc.)

And finally to further address the reasonable security concern over error messages, note that cf10 and above offer a secure profile feature (in the admin security section), which if enabled would set a site wide error handler--if you've not set one yourself--and that would show the user a blue ball and only a very brief indication that there was an error (and it also logs the error). 

Hope that's helpful, and sorry I'm only now seeing this. I was out of the country last week at the cfcamp conference in Germany. This is a great topic to help get clarified for the community every once in a while! 🙂

I welcome any feedback. As always, just trying to help. (Sadly, the intent behind words on screen can often be misconstrued.  I've tried to write carefully here.) 

[BKBK]

I still think there are grounds to report a bug. The instruction in ColdFusion Administrator reads:

Specify the IP addresses that should receive debugging messages, including messages for the AJAX Debug Log window. 

To include an IP address in the list, enter the address and click Add. To delete an IP address from the list, select the address and click Remove Selected. 

When no IP addresses are selected, all users receive debugging information.

That is clear. Hence, @jeff38011374seqk 's expectation that no IP other than 127.0.0.1 should display debug output.

If ColdFusion does not behave as it says on the tin, then one is right to suspect a bug.

[Charlie Arehart]

Nope, Alfred (bkbk). You're continuing to confuse matters.

"Debug output" is that stuff that appears at the end of a request...if enabled and if your ip matches any in the list.

Again, Jeff's concern was about details in an error message. That's NOT controlled by these two things. That's NOT a bug. 

If you're wanting to claim that "something needs to change", I'll repeat that the confusion on all this stems from the "robust exception handling" being on this debug output settings page. THAT should be moved. Feel free to file a tracker ticket for it, or ask Jeff if he will, or I could.

But I'm OK to wait and see how this discussion concludes, should you or anyone else have more to say. (Sometimes this is how nothing changes, as the discussion goes quiet without any action being taken.)

All that said, I hope what I shared helps everyone following this discussion. Again, it's a good one to have as this confusion arises once in a while. And even very experienced and smart people (including from Adobe) can slip in connecting all the dots. 

[BKBK]

@Charlie Arehart ,

I know what debug output is. You are right to mention that there is possibility for confusion, and that is in fact my point. But the confusion is ColdFusion's, not mine nor that of "very experienced and smart people (including from Adobe)".

To be clear, I was thinking of a documentation bug, nothing more. I am satisfied that, your remarks notwithstanding, you too can at least see a shortcoming, namely:

 ... I'll repeat that the confusion on all this stems from the "robust exception handling" being on this debug output settings page. THAT should be moved. Feel free to file a tracker ticket for it, or ask Jeff if he will, or I could.

By @Charlie Arehart

[Charlie Arehart]

Whatever you say, to quote the Martina McBride song.  But yes, I've created a bug report proposing the setting be moved out of that page: CF-4222564 (You mention now a "documentation bug". If you want to file that for whatever you're thinking of, go for it.)

[jeff38011374seqk]

Hi Charlie,

You are correct, I did think the two settings were linked (detailed info shown on error messages and the allowed debug IP addresses).

I agree - it would probably be better if the setting were on different pages so that there is no confusion about the relationship between the two (i.e. that there is no relationship between them).

In the meantime, I'm happy with the way I have things set now (site-wide error handler in place, no error details shown to end users and detailed error messages emailed to myself)

[Charlie Arehart]

Thanks for that, Jeff, and for marking that reply as an answer. (And understood, that your using the error handler solved things--as I'd acknowledged in my reply.)

Finally, for everyone following along, I have just created a tracker ticket for the issue, requesting that Adobe consider moving that setting out of that page: CF-4222564 . It really is important that people interested in the matter at least add a vote, as Adobe is motivated by those.

[BKBK]

+1 voted for CF-4222564