cfml

Hi. I have problem with logging to Lucee under Commandbox. It can't log in to "Web" part while I reset context. After restart it is happening again. I recorded it <https://dl.dropboxusercontent.com/s/hz6usnnp1numiun/mstsc_cLWCFOczLR.mp4> I have same problem on several instances and don't know how to fix it

so your are resetting the web context password, which then after a restart no longer works?

Yes. I can't log in web.cfm, but get error "*Access is protected". After that I log in <http://server.cf|server.cf>*m, reset password and can log in to web.cfm. After restart I need to do it again.

yeah i think commandbox always sets a password on startup, which is slightly different behavior than under tomcat. that made more sense when lucee defaulted to an open admin asking the user to set a password, which was fixed years ago

Oh, I fixed it by my own. I've found out that hspw and salt in lucee-web/lucee-web.xml.cfm is different to lucee-server.xml and changed it. It works now :slightly_smiling_face:

since a while, if there's no web context password set, lucee defaults back to the server admin password (if set)

Maybe it was imported by cfconfig from other instance...

<@U0CSYJF7S> I don't think the salt has anything to do with it

I'd bet money you have a `.cfconfig.json` file or CFConfig environment variable that is setting the admin password on server start.

Review your server configuration to see what you have in place.  Also, do a
```server start --verbose```
and there is a ton of debugging information in the server startup that shows everything CFConfig is doing

&gt; i think commandbox always sets a password on startup
Not necessarily.  CommandBox proper will never touch Lucee's passwords.  The CFConfig module does have a check IF the server `profile` is `production` AND there is no password set, it will set a random one for you and notify you in the debug output of the `server start`.  If this is a development profile server, CFConfig won't touch the Lucee password unless you configure it to do so.