Andrew Schwabe's Blog - Railo

Building Facebook apps with CFML

Tue, 22 Jun 2010 17:08:00 -0400

Packt Publishing put up an article I wrote about getting started with Facebook application development using CFML. This was based on a presentation I did at NCDevCon last month. Take a look, let me know if it helped ya... http://www.packtpub.com/article/facebook-application-development-with-coldfusion-railo I'm considering writing another article about using the new Facebook Social Plugins and the new Graph API since it is a bit different from the old RESTful API that most developers have been using.

Flash Builder 4 (aka Flex 4 aka "Gumbo") is released!

Mon, 22 Mar 2010 17:27:00 -0400

Lots of aka's (i know). Flex 4 SDK (open source) has been out for a while, or at least as a public beta. Now that Flash Builder 4 (the new IDE that replaces Flex Builder 3 -- note the product naming difference), there is a lot to be excited about. A new skinning system that brings in the best of declarative graphics and fixes quirks with scale 9 and manual skinning of components. Supposedly everything is a lot more efficient and light weight. Flex 3 was pretty to look at, but a bit memory intensive. I don't have specifics on that yet, but all improvements are welcome to make it scalable for larger apps. It is also designed for backward compatibility, so hopefully all our Flex3 apps compile nicely. Looks like a great upgrade! If you are into ColdFusion/Railo as well, be sure to check out their bundle of Flash Builder 4 and ColdFusion Builder at a good price. Here are some details: http://www.adobe.com/products/flex/overview/

My new articles on packt publishing

Thu, 11 Mar 2010 19:44:00 -0400

Packt Publishing asked me to write a bit about Railo. It took me forever due to being busy (as always), but here they are! Enjoy and share the love. Introduction to Railo Open-Source CFML Engine:
http://www.packtpub.com/article/introduction-to-railo-open-source Tutorial: Rendering web pages as PDF using Railo
http://www.packtpub.com/article/rendering-web-pages-pdf-using-railo-open-source

Multi-web configuration for Railo 3.1 and BlazeDS

Fri, 20 Nov 2009 12:54:00 -0400

Seems like lots of people are having a problem with Railo configured for multiple websites on a single host, but also need to support AMF via BlazeDS. The common symptom is when you restart railo services, sometimes you will get a big error instead of your web page that says something like:


MessageBroker failed to start: flex.messaging.config.ConfigurationException: MessageBroker already defined from MessageBrokerServlet with init parameter messageBrokerId = '__default__'

Here is what I found to work for me: 1. Read this post by Roland Ringgenberg at the railo google group and follow the directions to install the java jar and edit the flex/services-config.xml file:


    
        
        
                
		
        	
            	yourcustomBroker

2. For me, railo runs on port 8600 internally, and I have IIS configured to serve up content. BlazeDS however doesn't get mapped through IIS, so you need to talk on the native port (again, for MY configuration, YMMV). So to access it, i needed to open TCP port 8600 through the firewall. 3. Once i could talk to the server over port 8600, I changed my flex app that uses remoting to point to http://myserver:8600/flashservices/gateway/ and eveyrthing worked great! One other interesting observation... When using Flash remoting with CF7/8/9, you can talk to your CFCs and invoke methods that are set to "public." With BlazeDS, your methods need to be marked as "remote" to be accessible. Minor syntax difference, but a huge impact on security. make sure you secure your CFCs!

Railo 3.1 Install on Linux -- Caucho security note

Wed, 26 Aug 2009 13:56:00 -0400

Now that Railo 3.1 is out, I think we will see a jump in commercial usage. I have done a few installs on production machines now, and wanted to point out a security note. By default when you install Railo 3.1 (with caucho) on Linux (prob the same for OSX), it adds the following to your apache httpd.conf file:


LoadModule caucho_module /usr/lib/httpd/modules/mod_caucho.so

ResinConfigServer localhost 6800
CauchoConfigCacheDirectory /tmp
CauchoStatus yes

The bottom one is the problem -- it enables CauchoStatus by default. That means that you can open up a web browser to http://your.host.com/caucho-status and see status info, but there is a lot of detailed info there, including the names of each of the hosts you configured in resin, so people can snoop and see all the railo-enabled sites on that machine. This might also give a would-be-attacker the info they need to plan a DOS attack, SQL injection attack, etc.. especially since they can see how the server is responding to their attacks. Pessimistic, I know, but who can you trust on the Internet anymore ? Kid hackers are emerging just following directions posted online, and some don't even really know what they are doing, but they are causing trouble for you and I. Better to be safe. So the simple fix is to update your httpd.conf file and set the status option to no:


CauchoStatus no

For those so inclined, check out Nessus, an open source vulnerability scanner, which picked this up on one of our servers.