500 - Internal server error

We have a new Coldfusion 10 install that is running the identical code on many other systems but it is throwing a 500 - Internal server error and not running the <cferror routine that we have built. For example: Running a simple ErrorTest.cfm that holds only this one line <cfoutput>#Garbage#</cfoutput> Throws this error: 500 - Internal server error. There is a problem with the resource you are looking for, and it cannot be displayed. Been all over the CFAdmin thinking there is some new setting or something but coming up empty. Is there something about IIS7 on a Windows 2008 box that needs something special to make all this work?  Hours online only seems to lead me in circles. Anything you might suggest would be a welcome path to investigate. Thanks!

Not sure about CF10 but on Railo I think you have to set Error Reporting to Detailed in IIS7 to get the error.

> Not sure about CF10 but on Railo I think you have to set Error > Reporting to Detailed in IIS7 to get the error. In IIS 7 this setting would be in the site properties, "Error Pages" under the "IIS" settings category, then the "Edit Feature Settings..." link on the right side menu.  From there you can set it to Detailed (for all users) or the option to show detailed to local only and Custom to remote users (which is the default I believe) depending on how you're set up.  IIS is essentially seeing that there was a 500 error and showing a custom error to prevent presumably sensitive server information from leaking out.  If you're using a custom error handler in CF then you could set this to Detailed and let that content through.  Alternately, you could create an HTML file and configure IIS to use a Custom error page and let it know where that HTML file lives so it can handle displaying that for you. -Justin

?You checked on the settings page, to make sure use HTTP status codes was unchecked, yes? -- Cheers! Michael David ----- Excess quoted text cut - see Original Post for more -----

I think CF10 implements a setting in ColdFusion, Post Parameter Limit. This limits the number of parameters in a post request. The default value is 100. If a post request contains more parameters as specified, server will not process the request and throws an exception or 500 error. Edit file after making a copy of (by way of backup): ColdFusion10\cfusion\lib\neo-runtime.xml This line: <var name='postParametersLimit'><number>100.0</number></var> What value 300, 500? Depends do your own testing. Restart CF10 application service. See ColdFusion Security Hotfix APSB12-06: http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix.html HTH, Carl. ----- Excess quoted text cut - see Original Post for more -----

I think CF10 implements a setting in ColdFusion, Post Parameter Limit. This limits the number of parameters in a post request. The default value is 100. If a post request contains more parameters as specified, server will not process the request and throws an exception or 500 error. Edit file after making a copy of (by way of backup): ColdFusion10\cfusion\lib\neo-runtime.xml This line: <var name='postParametersLimit'><number>100.0</number></var> What value 300, 500? Depends do your own testing. Restart CF10 application service. See ColdFusion Security Hotfix APSB12-06: http://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix.html HTH, Carl. ----- Excess quoted text cut - see Original Post for more -----

RightOn you guys! Turns out that both Justin and Michael's tips were successful... either or both of the switches together made the the <cferror routine that we built run properly. Yes! and Thank You!  Now as for Carl's parameter limit... don't know how that might be useful unless of course we run into this again and have a zillion parameters being passed to CF ;-) I would think we would want to pass the typical IIS errors and check that in the CFAdmin settings... but it is clearly not necessary. However we do have it checked in all our other installs... both Windows and Linux and all is well everywhere except with this new install... which is apparently fixed now. So this brings up the question now of what's the full purpose of the CFAdmin setting and it's use with the IIS setting for Details vs Custom IIS error pages? Thanks! Gonzo

> ... So this brings up the question now of what's the full > purpose of the CFAdmin setting and it's use with the IIS > setting for Details vs Custom IIS error pages? Basically IIS is looking at the response codes from an application and when it sees anything other than normal 200 (OK) code (and some others, such as 30X redirects), it will look at the error handling settings to see how it should respond to the user.  If the custom errors are enabled for the visitor in question, then it will use whatever is set in the IIS settings (e.g. display a static HTML file, a generic error code, redirect to a page, etc.).  This is to prevent any sensitive information from leaking out of the server in the case of an error (such as the info that would normally come from a robust error handling exception in ColdFusion).  IIS is helping to protect the security of the application and handle error conditions for you. The setting in the CF admin controls what status code is sent out when there is an error.  Normally when CF encounters an error it will send a 500 (Internal Server Error) code which IIS then intercepts and handles as described above.  If you change this setting, you can have CF send a 200 (OK) code even in the event of an error which bypasses the IIS error handling routines and allows whatever output CF generates (page, error page, custom error handler output, etc.) to get through just like any other regular content.  IIS just sees it as a normal response at that point and allows it through. -Justin

for CF sites it should be fine to simply enable errors in IIS as all your errors are going to be returned by CF anyway. The only exception would be if your running a mixed site with CF and other technology. In which case as long as you separate your technologies into different folders, you can put a web.config into each folder with different settings. So CF could have errors enable and asp.net disabled for example. Or you could simply create a custom error on IIS and have that displayed instead. have you tried using the sitewide error template in CF, I don't think that causes the server 500 error. ----- Excess quoted text cut - see Original Post for more -----

Okay... egg on my face and a huge apology to Carl Meyer. I ran into the postParametersLimit exceeded issue today and knew EXACTLY what to to. This list has once again saved my life and my job. Thank you to everyone who keeps it running. Thanks! Gonzo ----- Excess quoted text cut - see Original Post for more -----