Hide Your Errors (Application Events: onError)
I have noticed that a great many ColdFusion sites show the default ColdFusion error when something goes wrong. This is a bad idea for many reasons.
In the "Research-Based Web Design & Usability Guidelines" (pdf) put out by Usability.gov, "Detect Error Automatically" was given an importance of 5 out of 5. In his popular "Top 10 Web Security Tips" article, Michael Smith listed "Have an error-handler" as his number-one security tip.
In his article "Toward Better Error Handling" (part 1, part 2, part 3), Charlie Arehart covers some techniques for error-handling in ColdFusion. As of the release of ColdFusion MX 7, a new method exists for handling errors in ColdFusion; the onError event of Application.cfc.
Comments (Comment Moderation is enabled. Your comment will not appear until approved.)
[Add Comment]
Small error - you've defined the returntype as VOID for your onError() but are returning boolean.
# Posted By Me
| 11/17/06 11:26 AM
Good catch. That is fixed now.
# Posted By
| 11/17/06 4:59 PM
Another small error: you cannot use cfcookie and cflocation together. Use cfheader to set the redirection header manually.
# Posted By Russ
| 1/29/09 5:18 PM
[Add Comment]
