IIS7 displays BOTH its 404 Message & CF9; Must display by itself

Question

My goal seems simple.

I want IIS 7.5 to process ALL 404 files not found, whether static or dynamic (ColdFusion 9), as well as direct users to their custom 404 HTML page.

I believe that I need the IIS settings existingReponse=Replace , errorMode=Custom and the file path specified for 404. This is what I did.

It works with the installation of ColdFusion 10. With ColdFusion 9, for some reason, both the IIS 404 static response and the ColdFusion 404 response are sent to the client and displayed . Very strange.

I tried all kinds of alternative configurations, and there seems to be some kind of problem with each approach.

Any ideas why IIS will not replace ColdFusion 404? Can't ColdFusion contact IIS (via the appropriate header) to send 404? Is IIS stubborn? Why will this be different from ColdFusion 10 and ColdFusion 9?

ColdFusion 9 via CFAdmin

 Global Settings - Missing Template Handler = [no path specified] 

IIS 7 through IIS Manager

 Configuration Editor -> system.webServer/httpErrors - allowAbsolutePathWhenDelegated = false - defualtPath = [no path specified] - defaultResponseMode = File - errorMode = Custom - existingResponse = Replace Configuration Editor -> system.webServer/httpErrors -> Edit Collection - 404 Error path = [DriveLetter]:\inetpub\wwwroot\CAES\global\errorHandling\404.html prefixLanguageFilePath = [none specified] respnseMode = File statusCode = 404 subStatusCode = -1 - 403 Error path = [DriveLetter]:\inetpub\wwwroot\CAES\global\errorHandling\403.html prefixLanguageFilePath = [none specified] respnseMode = File statusCode = 404 subStatusCode = -1 

Answer 1

This should actually solve more than one question / issue regarding ColdFusion and IIS 7.5. On my new Win2k8 R2 / 64-bit server running CF9 Standard, this solved the problem of double-displaying IIS and CF error patterns, eliminating the need to install IIS to display detailed error messages to the public and return the correct error codes to the client browser.

If you don’t have special reasons to uncheck it, leave the “ColdFusion Enable HTTP Status” HTTP status field set on the “CF-admin settings” screen so that CF can correctly return status codes to IIS (approximately 404 solutions work by unchecking in this field due to the loss of these useful headers).

Step 1:
Set up the missing template handler in the CF administrator. Mine is global for the server and is stored in the ColdFusion web feed, which is separate from the IIS web root and defaults to c: \ ColdFusion9 \ wwwroot. This global template is 404handler.cfm and contains the following simple code that you can extend:

 <h1>404</h1> <p>Page Not Found</p> <cfheader statuscode="404" statustext="Not Found"> 

At this point, visit the website and run the bad ColdFusion URL: http: // [domain] /bogus.cfm. You will see the IIS screen with the removed error / banner, and then the ColdFusion error screen. Check the title and it will be 404. The next step will solve the problem with two screens.

Step 2:
Create a local 404 handler somewhere under the root of the website of the individual website. I named this file "local404.cfm". It consists of the following:

 <h1>404</h1> <p>Page Not Found (local)</p> <!--- demonstrate ColdFusion is functional with some simple output ---> <cfoutput> <p>#now()#<br>#cgi.server_name#</p> </cfoutput> <cfheader statuscode="404" statustext="Not Found"> 

Go to IIS Manager and click on your website. Click "Error Pages" and edit the 404 handler for this site. Install it to execute the url and enter url '/local404.cfm' (or any other path). Save your work. On the right side of the screen, click "Edit Settings" and make sure that it is set to "Detailed errors for local queries and custom error pages for remote queries." Then, while still in IIS, select “Handler Handlers” and make sure that your ColdFusion handlers are set to the “File” path type (this step may not be necessary to solve this problem, but in accordance with the ColdFusion Lockdown recommendations).

Run another incorrect ColdFusion URL: http: // [domain] /bogus.cfm. This time you will see only the ColdFusion error screen. Check the header and it is 404. Do the same for a non-CF permitted URL, for example http: // [domain] / bogus. htm and invalid type http: // [domain] /web.config. In all cases, you should see that the local error pattern is executed, and the correct 404 header is issued.

What's happening? Only the local ColdFusion-based IIS 404 template is executed ... As soon as you enable the local ColdFusion template in IIS, the global ColdFusion template is effectively and completely disabled. However, it can be replaced as shown.

Apply the above to all websites on the server and you can remove the global missing CF template handler. One global template would be preferable, but this method solves the problem and returns full functionality without creating security or SEO problems.

Answer 2

Update 2/17/2015 . Adobe has confirmed my suspicions on its own blog, http://blogs.coldfusion.com/post.cfm/onmissingtemplate

---

I faced the same situation using ColdFusion 9 and IIS 7.5. I was waiting for an answer in the hope that someone else would share their configuration, and also because I'm not too happy with the “resolution” that I came up with. I will swallow my pride and publish what I have done for this situation. Feel free to comment.

My conclusions first. It's been a while since I worked on this, but here's what I remember. In the ColdFusion administrator, in the "Server Settings - Settings" section, if you select the "Enable HTTP status codes" checkbox, which causes this situation. This parameter causes the ColdFusion server to return status codes, such as 404 (and others) with it. Therefore, when IIS receives this 404 status after processing ColdFusion, it also processes the 404 error handler. If the Enable HTTP status codes check box is not selected, ColdFusion will send 200 OK for ALL errors (including 500 errors). When IIS receives status 200, it assumes that everything is in order and does not process error handlers. This may be what some people want; when ColdFusion handles its own errors and the IIS that it owns - separately. Do not return the actual status code 404, however, this could be detrimental to search engine indexing.

Like you, this is not what I wanted. I wanted IIS and ColdFusion to share the same 404 handler. Unlike you, I wanted all 404 errors to be handled by ColdFusion, not a static HTML page. This allows me to do a few things. When pages are moved or renamed, I can handle the ColdFusion 404 handler and redirect the request accordingly. Even changing the status code, which is useful for indexing search engines (301 and / or 302 code). I can also create short abbreviations if I want to avoid this, error logs, email errors, etc.

So, in my configuration, I have IIS 404 errors pointing to my ColdFusion page. In the ColdFusion admin, I have a skipped template handler pointing to the same ColdFusion page, and I have the option "Enable HTTP status codes" enabled (checked). With this setting, page 404 is called twice for all non-existent .cfm templates (both from IIS and CF handlers), but it is called only once for every other file type (only from IIS).

I never found a way to avoid duplicate 404 processing for nonexistent .cfm templates, so I added code to my ColdFusion page. (Note that I can do this because the 404 handler is a ColdFusion page, not a static HTML page.) I just need a way to differentiate when the page was called from the IIS handler and the ColdFusion handler. I found that whenever an IIS 404 handler calls a ColdFusion page, the variable CGI.SCRIPT_NAME is the file name of my ColdFusion page, regardless of which page is actually being requested. (IIS adds the requested URL to the query string added with 404;) When the ColdFusion missing handler handler invokes the page, the CGI.SCRIPT_NAME variable contains the actual file name of the requested ColdFusion template.

Example URL from IIS 404 Handler:

 http://www.yourdomain.com/404handler.cfm?404;http://www.yourdomain.com:80/non-existent-file.cfm 

Example ColdFusion URL form missing template handler:

 http://www.yourdomain.com/non-existent-file.cfm 

Knowing this, I can now include some code in the ColdFusion handler to basically ignore one of the requests. I prefer to ignore the ColdFusion request because they are only for .cfm templates. IIS requests will be for all files. So, at the top of my ColdFusion 404 page, I have code like this (this is not very pretty, but it seems to work for me):

 <cfif CGI.SCRIPT_NAME NEQ "/404handler.cfm"> <!--- Do some processing here if you want ---> <!--- Basically we will ignore this request from the ColdFusion handler ---> <cfelse> <!--- This request is from the IIS handler ---> <!--- All non-existent file types will come through here ---> <!--- Do all of your processing here ---> </cfif> 

Another thing I noticed with this. When a request comes through the ColdFusion handler, it does not match the life cycle of a regular request. I.E. The request does not call the Application.cfm file. Therefore, you need to be careful if you use application variables on the ColdFusion page that you set for the missing template handler. (You can always simply cfinclude Application.cfm file for these requests.) When the request arrives through the IIS 404 handler, it processes the Application.cfm file as usual. I assume IIS is making a request for the .cfm file.

When using the Application.cfc onMissingTemplate function, the ColdFusion administrator parameter is completely eliminated in favor of the function. When this function is triggered, it also does not flow through the normal request life cycle. You should also check for application variables in this function (if you use any functions), as this has already bit me.