Improve performance by placing Application.cfc or Application.cfm, or ColdFusion might locate and execute a file above web root directory

A close look at the following screen clipping will show you exactly why it is important to place an Application.cfc or an Application.cfm file under your web root. If your web root or the requested page’s directory does not have an Application.cfc or Application.cfm file then ColdFusion would search up the directory tree to locate either of the files until it reaches root directory (C:\ and in my case D:\). This is NOT a bug.

Error Occurred While Processing Request
http://localhost/
Screen clipping taken: 2/2/2009, 2:06 PM

To demonstrate this, I placed one Application.cfc under by root directory (D:). What happened next when I open my website? You can see that for yourself in this image. ColdFusion found my Application.cfc placed at D:\Application.cfc and processed it. And while the file is located above my my DocumentRoot. In my case I am using Apache to demonstrate to why Application.cfc is needed. Even if you are using IIS, ColdFusion would behave in the same manner and would pick and execute any Application.cfc file it will encounter above the web root or document root (C:\inetpub\wwwroot\).
Learning: to improve performance always use Application.cfc in CF7+ because ColdFusion would look for Application.cfc file before it will be look for Application.cfm file. The official documentation says the following under: How ColdFusion MX finds and process application definition pages:

ColdFusion MX uses the following rules to locate and process the Application.cfc, Application.cfm, and OnRequestEnd.cfm pages that define application-specific elements. The way ColdFusion MX locates these files helps determine how you structure an application.

Each time ColdFusion MX processes a page request it does the following:

1. When ColdFusion starts processing the request, it does the following:
   
   • It searches the page’s directory for a file named Application.cfc. If one exists, it creates a new instance of the CFC, processes the initial events, and stops searching. (ColdFusion MX creates a new instance of the CFC and processes its initialization code for each request.)
   • If the requested page’s directory does not have an Application.cfc file, it checks the directory for an Application.cfm file. If one exists, ColdFusion MX logically includes the Application.cfm page at the beginning of the requested page and stops searching further.
   • If the requested page’s directory does not have an Application.cfc or Application.cfm file, ColdFusion MX searches up the directory tree and checks each directory first for an Application.cfc file and then, if one is not found, for an Application.cfm page, until it reaches the root directory (such as C:\). When it finds an Application.cfc or Application.cfm file, it processes the page and stops searching.
   
   
2. ColdFusion MX processes the requested page’s contents.
3. When the request ends, ColdFusion MX does the following:
   
   • If you have an Application.cfc, ColdFusion MX processes the CFC’s onRequestEnd method and releases the CFC instance.
   • If you do not have an Application.cfc, but do have an Application.cfm page, ColdFusion MX looks for an OnRequestEnd.cfm in the same directory as the Application.cfm page ColdFusion uses for the current page. ColdFusion does not search beyond that directory, so it does not run an OnRequestEnd.cfm page that resides in another directory. Also, the OnRequestEnd.cfm page does not run if there is an error or an exception on the application page, or if the application page executes the cfabort or cfexit tag.
   
   

The following rules determine how ColdFusion MX processes application pages and settings:

• ColdFusion processes only one Application.cfc or Application.cfm page for each request. If a ColdFusion page has a cfinclude tag pointing to an additional ColdFusion page, ColdFusion MX does not search for an Application.cfc or Application.cfm page when it includes the additional page.
• If a ColdFusion page has a cfapplication tag, it first processes any Application.cfc or Application.cfm, and then processes the cfapplication tag. The tag can override the settings from the application files, including the application name and the behaviors set by the cfapplication tag attributes.
• You can have multiple Application.cfc files, Application.cfm files, and cfapplication tags that use the same application name. In this case, all pages that have the same name share the same application settings and Application scope and can set and get all the variables in this scope. ColdFusion uses the parameter settings of the cfapplication tag or the most recently processed file, if the settings, such as the session time-out, differ among the files.

Note: If your application runs on a UNIX platform, which is case-sensitive, you must spell Application.cfc, Application.cfm, and OnRequestEnd.cfm with capital letters, as shown.

I’d recommend that you make it a rule of thumb to place Application.cfc, since CF7 and above will look for this file before processing any request. Tough I am sure that CFers are already following this simple guideline and making use of Application.cfc. However this post will tell you exactly what can happen if you don’t place Application.cfc or Application.cfm in your page’s directory or document root.