Dev-mode inline notice when ?reload=true is refused (empty reloadPassword / missing or wrong password) #3311

Activity

1. bpamiri

   added

   enhancement

   on Jul 14, 2026
2. wheels-bot commented on Jul 14, 2026

   

   wheels-botBot

   on Jul 14, 2026

   Contributor

   More actions

   Wheels Bot — Triage

   Classified as framework-design (API/feature design question).
   Cross-framework research will follow shortly — Rails, Laravel, Django,
   and other modern frameworks will be consulted before any path forward
   is proposed.
3. wheels-bot commented on Jul 14, 2026

   

   wheels-botBot

   on Jul 14, 2026

   Contributor

   More actions

   Wheels Bot — Cross-Framework Research

   Question

   Since the fail-closed reload gate shipped (#3062, 4.0.4), ?reload=true when URL reload is disabled — most often an empty reloadPassword — is a silent browser no-op: the page serves normally with no sign the reload was requested and refused. Feedback lives only in wheels_security.log and the debug footer. The ask: in development only, show an inline, browser-visible, actionable notice at request time saying why it was refused and what to do — for (1) empty reloadPassword, (2) missing password param while one is configured, (3) wrong-password / rate-limited (generic, no oracle) — while testing/production/maintenance stay a silent no-op. The fail-closed behavior stays; only request-time discoverability is missing.

   How other frameworks handle this

   Framework	Naming	Surface	Trade-offs	Edge cases
   Rails	"Actionable Errors" (action DSL); consider_all_requests_local	Fix-it buttons on the dev error page (pending-migrations is canonical)	Must raise; no passive banner on a 200; gating implicit	Buttons inert unless detailed-exceptions on
   Laravel	Ignition Solution/ProvidesSolution; config('app.debug')	Exception page w/ solution title + "what to do" + docs links; Debugbar overlay	Exception-driven; app.debug is binary; dev-only deps	APP_DEBUG=true in prod = RCE/leak (CVE-2021-3129)
   Django	DEBUG; System Check Framework; messages	Technical 500/404 page; startup checks w/ hint; debug-toolbar before </body>	Single global DEBUG; checks are startup not per-request	Toolbar hidden if IP not in INTERNAL_IPS
   Phoenix	debug_errors/code_reloader (dev.exs); Plug.Exception.actions/1; put_flash	Plug.Debugger page w/ action buttons; or flash for handled refusals	raise=page, return=flash; config-gated, prod-silent	Debugger re-raises; CSP stripped; flash needs session
   Spring Boot	Whitelabel + server.error.include-* (NEVER/ALWAYS/ON_PARAM); FailureAnalyzer	Error detail gated by profile; Action: line in analysis	Fail-closed by default, but only fires on a thrown error	FailureAnalyzer is startup/console, not per-request browser
   Symfony (+1)	Web Debug Toolbar; when@dev; addFlash	Toolbar auto-injected before </body>, HTML-only, non-redirect	Passive (not actionable alone); dev-gate at registration time	Skips redirect/JSON → header-only fallback

   Why Symfony as +1: its Web Debug Toolbar is the canonical "dev-only banner injected before </body>, HTML-only, absent in prod by construction" — the exact shape this issue proposes.

   Dominant pattern

   All six gate dev diagnostics on an explicit dev/debug flag and stay silent (fail-closed) in production by default. They split into (a) exception-driven actionable pages (Rails/Laravel/Phoenix/Spring — must throw, interrupt the request) and (b) passive banners injected into the HTML response in dev (Symfony toolbar, django-debug-toolbar, Laravel Debugbar). They converge on: env-gated, HTML-only, a "why + what to do" string, nothing leaked in prod. The divergence — interrupt vs. passive — is decided by this issue's shape: a refused ?reload= still returns HTTP 200, and Spring/Rails both note their error machinery never fires without a thrown error. So archetype (a) doesn't fit a silent-success refusal — (b), the passive injected banner, is the match, and it respects the issue's note that a friendly-error interstitial (option 3) is "too aggressive for case 3."

   Recommended path for Wheels

   Passive banner (Symfony/Debugbar shape), split into a dumb template side and a framework-side renderer — the issue's preferred option. The four public/Application.cfc copies only record a category on the request scope (never the password; wrong-password folds into refused alongside rate-limited to keep the #3062 no-oracle property). The framework renders a development-only banner at request-end, independent of showDebugInformation so it still shows when an app disables the debug bar in dev (the gap in option 1), reusing onrequestend/debug.cfm's existing AJAX/HTMX/Turbo/JSON skip guards. Shown in tag syntax for portability; cfscript is 1:1.

   <!--- public/Application.cfc (all 4 copies): RECORD ONLY, right after the gate --->
   <cfif local.reloadRequested AND NOT local.reloadAuthorized>
       <cfif NOT StructKeyExists(request, "wheels")><cfset request.wheels = StructNew()></cfif>
       <cfif NOT StructKeyExists(application.wheels, "reloadPassword") OR NOT Len(application.wheels.reloadPassword)>
           <cfset request.wheels.reloadRefusedReason = "emptyPassword">
       <cfelseif NOT StructKeyExists(url, "password")>
           <cfset request.wheels.reloadRefusedReason = "missingParam">
       <cfelse>
           <cfset request.wheels.reloadRefusedReason = "refused"><!--- wrong pw OR rate-limited --->
       </cfif>
   </cfif>
   
   <!--- vendor/wheels/events/EventMethods.cfc: resolver (public + $-prefixed; testable; no oracle) --->
   <cffunction name="$reloadRefusedNotice" access="public" returntype="string">
       <cfargument name="reason" type="string" required="true">
       <cfswitch expression="#arguments.reason#">
           <cfcase value="emptyPassword"><cfreturn "Reload disabled: reloadPassword is empty. Set reloadPassword in config/settings.cfm and pass &password=... (fail-closed since 4.0.4, ##3062)."></cfcase>
           <cfcase value="missingParam"><cfreturn "Reload requested but no password parameter supplied. Add &password=... to the URL."></cfcase>
           <cfdefaultcase><cfreturn "Reload refused. See wheels_security.log for details."></cfdefaultcase>
       </cfswitch>
   </cffunction>
   
   <!--- vendor/wheels/events/onrequestend/reloadnotice.cfm: RENDER (dev-only, debug-bar-independent) --->
   <cfif $get("environment") IS "development" AND StructKeyExists(request, "wheels") AND StructKeyExists(request.wheels, "reloadRefusedReason")>
       <cfoutput><div role="alert" style="position:fixed;top:0;left:0;right:0;z-index:2147483647;background:##f9e2af;color:##1e1e2e;padding:10px 14px;font:13px/1.4 monospace;border-bottom:2px solid ##f5c211;"><strong>Wheels — reload refused:</strong> ##EncodeForHTML($reloadRefusedNotice(request.wheels.reloadRefusedReason))##</div></cfoutput>
   </cfif>

   Lives in: vendor/wheels/events/onrequestend/reloadnotice.cfm (render) + vendor/wheels/events/EventMethods.cfc ($reloadRefusedNotice()); the four Application.cfc copies (public/, cli/lucli/templates/app/public/, examples/starter-app/public/, examples/tweet/public/) record the flag only.
   Composes with: the dev debug footer (onrequestend/debug.cfm, same hook + skip guards), the fail-closed gate (#3062), $get("environment"), and ReloadPasswordGateParitySpec (extend it to pin the four flag-recording blocks).

   Cross-engine notes

   Clean. Only a request-scope struct flag, a cfswitch, and a .cfm include via cfoutput/EncodeForHTML — no closures, no struct member functions, no application-scope function members, no arguments-as-attributeCollection tag wrappers (invariant #10), no reserved-scope shadowing. $reloadRefusedNotice() is public + $-prefixed so it integrates on Lucee/Adobe/BoxLang (invariant #7). Hex colors and interpolations are ##-escaped for .cfm. No Lucee-only/Adobe-only APIs.

   Open questions

   • Which output path? Riding the debug footer (option 1) adds no new output but misses debug-bar-off apps; the standalone partial (above) covers them but adds a small second request-end output path. Recommend the standalone partial — confirm acceptable.
   • Duplication: if both the footer and this banner render, should one defer to the other?
   • Redirect/non-HTML: like Symfony's toolbar, skip those (matching current debug.cfm) — OK?

   Confidence: medium

   Downgraded from high: the modern consensus favors exception-driven actionable pages (Rails/Laravel/Phoenix/Spring), which don't fit a silent HTTP-200 refusal, so I adapted toward the passive-banner minority pattern (Symfony/Debugbar); and the recommendation adds a small new request-end render path (a non-trivial "which output path" trade-off, flagged above). The CFML sketch respects every Wheels convention with no cross-engine concerns.

   Sources

   • Rails — https://github.com/rails/rails/blob/main/actionpack/lib/action_dispatch/middleware/actionable_exceptions.rb ; https://github.com/rails/rails/blob/main/activerecord/lib/active_record/migration.rb
   • Laravel — https://laravel.com/docs/12.x/errors ; https://github.com/spatie/ignition
   • Django — https://docs.djangoproject.com/en/5.2/topics/checks/ ; https://docs.djangoproject.com/en/5.2/howto/error-reporting/
   • Phoenix — https://plug.hexdocs.pm/Plug.Exception.html ; https://phoenix.hexdocs.pm/custom_error_pages.html
   • Spring Boot — https://docs.spring.io/spring-boot/reference/using/devtools.html ; https://www.baeldung.com/spring-boot-failure-analyzer
   • Symfony — https://symfony.com/doc/current/profiler.html ; https://github.com/symfony/web-profiler-bundle/blob/8.1/EventListener/WebDebugToolbarListener.php
4. wheels-bot commented on Jul 14, 2026

   

   wheels-botBot

   on Jul 14, 2026

   Contributor

   More actions

   Wheels Bot — Fix on hold for human review

   The proposed fix touches a sensitive area (the fail-closed reload-password gate in public/Application.cfc and its three template copies — password/security-gate code) and the bot's safety net requires a human in the loop before any code is written.

   Specifically, the researched path records a refusal category (emptyPassword / missingParam / refused) inside the reload gate, and the correctness of that categorization is security-relevant: it must preserve the #3062 no-oracle property (wrong-password and rate-limited must fold into a single indistinguishable refused state). Newly-written logic in that area — plus the still-open design questions flagged in the medium-confidence research comment (which output path; footer-vs-banner de-duplication; redirect/non-HTML handling) — should be authored and reviewed by a human rather than auto-proposed by the bot.

   The framework-side pieces (the dev-only onrequestend banner render and the $reloadRefusedNotice() string resolver) are low-risk on their own, but they are inseparable from the gate-side flag recording, so the whole change is held together.
5. bpamiri

   closed this as completedin #3313on Jul 28, 2026
6. cursor

   added a commit that references this issue on Sep 9, 2026

   fix(debugbar): hide collapsed extras without matching notice specs

   ...

   08ceedb