ColdFusion

I am currently implementing an API using the OAuth2: Client credentials authentication.  The oauth is working to a degree but when after API manager proxies the request to the Coldfusion endpoint, it is removing the authorization header.  Is there any way to preserve the header?  My main reasoning is that I need a way to identify the user on the CF server side after going through API manager.  Thanks in advance.

We would like to inform users that certain previously deprecated features and associated dependencies will be removed in the next bug fix update. This is part of our efforts to enhance security, performance, and modernization.   History  We previously announced the removal of deprecated features before ColdFusion 2025's release. See the following for more information:  Community forum blog  Deprecated features in ColdFusion     What will be removed in the next bug fix update*  Feature  ColdFusion 2025  ColdFusion 2023  ColdFusion 2021  COM/DCOM  Removed  Will be removed in the next bug fix update.  Will be removed in the next bug fix update.   Axis1  Removed  Will be removed in the next bug fix update.    Will be removed in the next bug fix update.    * Tentatively planned for Q1, 2026   Axis1  The web service

Hello all, I am having an issue with ColdFusion 2023 where exporting to Excel only fails when the AppDynamics Java Agent is enabled. As soon as I add this JVM argument -javaagent:C:\AppDynamics\JavaAgent\ver25.6.0.37159\javaagent.jarmy excel export fails and which results: 500 - Internal server error. If I remove that line and restart ColdFusion services, the export works perfectly again.I think the issue here is AppDymanics agent is interfering with ColdFusion's functionality. Has anyone  esle run into this with CF 2023 and AppDynamics, or is there any known conflict between these two? any adivce, tips or shared experience would be really helpful.  Thanks  

We're getting an error running a CF scheduled task. The error says "Attribute validation error for tag CFSTOREDPROC.-It does not allow the attribute(s) DBTYPE.The valid attribute(s) are  BLOCKFACTOR,CACHEDAFTER,CACHEDWITHIN,CACHEID,CACHEREGION,CLIENTINFO,DATASOURCE,DBPOOL,DEBUG, FETCHCLIENTINFO,PASSWORD,PROCEDURE,RESULT,RETURNCODE,TIMEOUT,USERNAME." However there are NO references to DBTYPE in the whole of the code! Other stored procs run on same server same db connection without a problem. cfstoredproc procedure="namehere" datasource="ourdb"Anyone experienced this?

Hi all, I've just purchased a ColdFusion 2025 Standard Edition license, and activated my trial version. From my understanding, it should be valid for one year. However, in the ColdFusion admin panel, the license is showing as valid only until October 20, 2025 which is just three months from now (see screenshot below). Does anyone know if this is a standard issue, or if there might be a problem with the license activation? I've written to Adobe but I'm not sure when I'll get their reply. Any insights would be greatly appreciated! Thanks in advance.Simon  

Hi,In previous CF versions I had TTF fonts registered in "Font Management" for "Barcode Printing" purposes in a cfdocument without issues. The font shows the same name “without spaces” for all 3 options “Font Family”, “Font Face” and “Postscript Name” and I use that name as in-line CSS style to show barcodes on generated PDF’s.Now in CF 2021, I cannot make them work.So far, I have tried:Multiple installs in "Font Management" with different paths, making sure folders did not have user’s restrictions (permissions), using different fonts; and making sure they show as usable in PDF/FlashPaper column.Install font also in Windows.Restart CF Services.Restart physical server.Convert font to WOFF (Shows in browser using CSS @11220649-face / in-line styling) but does not work inside the cfdocument.Any other suggestion to fix this in cfdocument?

Hi,We are experiencing this cache issue, we have 4 instances and one instance, we have this issue, We manually cleared the cache and uncheck all the cache options and restarted the service but still we got issue, Any help would be greatly appreciated<cfquery name="abc" datasource="#xyz#" cachedwithin="#createtimespan(0,1,0,0)#"> 9 : SELECT test_column 10 : FROM tast_table  Error : Cache initialization failed due to following reason: Error configuring from null. Initial cause was Cannot invoke "java.net.URL.openStream()" because "url" is nullStack Traceat cffacilities2ecfm1461612999.runPage(D:/web/live/mercury/view/facilities.cfm:8)coldfusion.tagext.io.cache.CacheExceptions$CacheInitializationException: Cache initialization failed due to following reason: Error configuring from null. Initial cause was Cannot invoke "java.net.URL.openStream()" because "url" is null at coldfusion.cache.ehcache.GenericEhcache.getCacheManager(GenericEhcache.java:418)

Hello Community,I have inheritted some ColdFusion servers (2021). That has been running great so far but recently, I encountered an odd issue with one of the servers. The issue is that the server stopped processing requests on all instances, whether from websites, APIs, etc. I have tried a number of actions to get this server to start processing requests but all actions have been proven futile at this point.Steps I've taken: rebooting the serverresetting the IIS (restart all coldfusion services) recreate the IIS connectors (restart all coldfusion services) Ensure all services are running Upgrading to the latest available patch (22) on all instances Tried creating a new cluster and instance I've given elevated permission to the IIS user (IUSR) for all sites Verified certs Verified Handler mappings I checked all possible logs (server, application, exception, etc) but can't find anything that would indicate the error. Check event mana

I've read the EULA and read notes about the license in the  ColdFusion End User Licensing Agreement (EULA), and my understanding (which may be wrong) is its one license per VM with a maximum of 8 cores.My current cf enterprise is a vmware instance with less than 8 cores has one ColdFusion server running 2 enterprise instances on different ports. Its configured in an HA config and I hae a second server similarly configured usign cluster configuration.I am working through 2 phases of this to migrate 206 to 2023 to AWS AMI,  then once everythig is up and running turn it to a containerized solution using AWS ECS or EKS:1. I'm moving CF 2016 to an Coldfusion 2023 on aws linux with 2-4 CPU with a single core per CPU until I can develop the resource configuraiton for AWS ECS.2. After we migrate the server to the new environment I'll be building a containerized solution where each enterprise intance  will be its own container.Creating the same configuration isn't a problem

I understand that bytecode execution limitations were introduced with the Hotfixes earlier this year (2025), but I am suddenly running into new problems with this. I have recently been trying to implement CF Enterprise 2021 Hotfix 22 over a successful install of Hotfix 21, and I have got it working on a local instance of Tomcat for Windows. However, when I move the WAR file to Tomcat on Azure, I run into this error opening the Administrator: "ColdFusion, by default, disables the execution of bytecode in .cfm and .cfc files. To enable it, open the JVM.config file, and set -Dcoldfusion.compiler.block.bytecode=false or add path: (here it lists the path to my CF Admin)/CFIDE/adminapi/security.cfc to bytecodeexecutionpaths key of root/lib/pathfilter.json" I don't get this error locally. I've tried adding the path to pathfilter.json, and even to pathfinder.txt when that didn't work, and restarting the service. The error has persisted, and I can't get into the Administrator. Ob

Hello, everyone. About a week ago, our SA and DBA started a migration from CF2021 to CF2023, we are experiencing a couple of odd issues, and the weird thing is - it's limited to just one project.  No other projects are experiencing these issues.  The issue is in our custom built Workflow application. One issue is with setting an identifier for a user using data pulled from the user's Common Access Card (CAC).  We are pulling the DoDID (lastName.firstName.middleName[.cadenceName].EPIDnumber) and I'm getting the 10 digit EPID from this string that is in the CGI scope. <cfset session.userepid = REMATCH("\d{10}",cgi.SSL_CLIENT_S_DN_CN)[1] />The number that is in the DoDID can be either a 10 digit number, or a 16 digit number.  So I'm looking for all 10 digit numbers and taking the first position in the array as the desired number.  This is the actual EPID.  But I'm getting an error that position 1 of the array doesn't exist.  I can ou

Hi, all. I will be installing CF2023 side-by-side with CF2021 on an important server soon, and I have some questions related to my particular situation that I have not been able to answer by searching the Web:  In the CF2023 Administrator, in Package Manager -> Settings, there are Proxy fields at the bottom. After installing CF2023 on other servers, I find that Proxy Username (admin) and Proxy Password (*******) are already filled on first access of the page, and yet I don't know of anywhere that I specified them during CF2023 installation. Can anyone tell me what this magic password is, and where the Username/Password came from? I'll be using the standard GUI exe installer and specifying the Server Configuration (No J2EE). Should I run the installer as administrator? When installing CF2023 side-by-side on other machines, I was at some point offered the option to import the admin settings from CF2021. Can I expect that option every time I install CF2023 side-by-s

Hi all. I've been asked by a client to upgrade a production server from CF2021 to CF2023. While researching the existing server configuration, specifically what "server profile" is being used for CF2021, I was able to find in the original installation log that "Development Profile" was chosen. I'm hesitant to choose "Production" as the server profile when I do the CF2023 upgrade, as I'm not sure what unexpected effects this may have on the application. Regarding this, does the choice of "Server Profile" during installation only serve to appropriately pre-configure various CF Admin settings? If so, the CF Admin settings made in the years after initial CF2021 installation, which will be copied to the CF2023 installation, should suffice even if I choose "Development" as the server profile during CF2023 installation. If it affects more than Cf admin settings, I'd like to know necessary details about it. Thanks! 

How can I host a Static coldfusion website for free?

We have recently migrated our Coldfusion 2021 environment to Coldfusion 2023 on Windows Server 2022 using Oracle JDK 17.0.16.  We've noticed that on Coldfusion 2023, whenever we restart the server, there is a chance that each instance will generate a JVM error log & dump file in Coldfusion2023\instance_name\bin.  The log (named in the pattern hs_err_pidXXXX.log, where XXXX is a 4 digit number) reports an EXCEPTION_ACCESS_VIOLATION (see the error details at the bottom).  Also, a 1gb+ memory dump file named hs_err_pidXXXX.mdmp is generated. We have various ideas for strategies on how to clean up these files, but are concerned that they are an indication of some problem in our CF2023 environment.  So far, we have not seen any indication that the environment is unstable, and the files only generate when the server is rebooted - not when manually shutting down CF services.  We use the Adobe provided Oracle JDK build, but have reproduced this with Redhat Ope

Hi,The issue I have is that I have a bunch of emails that were undelivered because the password of the email addresse used for CFMail was changed.  I was not aware of the problem for a day or so.   So, there a bunch of undelivered emails.  I am able to update the password and CFMail on webpages are now working. SI would like to resend the undelievered mails. From the Administration portal, Server Settings, Mail section, I can "respool" undelivered mails.When I "respool" an undelivered mail, it will disappear from the listing, but will reappear a few minutes later.  I tried manually moving an undelivered mail from the "Undelivr" folder to the "Spool" folder.  The .cfmail file will move back to "Undelivr" folder a few minutes later. Opening up one of the .cfmail file, I saw that there is a password on the file. So, I found correct "password" from the .cfmail file in the Spool folder by triggering a webpage that uses CFMail to send em

Current application runs on ColdFusion 2021 using SAML.  We have setup up the SP and IDP configuration in CF Admin and it has been working for half a year.  Installed ColdFusion 2023 on the same server as ColdFusion 2021.  Used the CFSETUP utility to export and import the spconfiguration as a json file since that doesn't come over when you install and upgrade to ColdFusion 2023.  Verified in ColdFusion 2023 Admin that the SP information was imported and the site is now running on ColdFusion 2023.  I noticed however they keystore in CF2023 is pointing to or looking for it under CF2021 when I try to migrate my application to a new server with just CF2023 installed. Am I wrong to assume that the CFSETUP utility was supposed to create the necessary files from ColdFusion 2021 to ColdFusion 2023 regarding the SAML keystore in addition to adding an entry in ColdFusion 2023?  It seems that if remove ColdFusion 2021 on the same server I installed ColdFusion 20

Subject: Planning CF21 to CF23 Migration in 2026 - Security & Support Concerns?Current Setup:ColdFusion 2021, Version 2021,0,02,328618 (Update 2)Planning to migrate to ColdFusion 2023 in 2026Question: I'm aware that ColdFusion 2021 reaches end-of-life on November 10, 2025. I'm currently running CF21 Update 2 (from September 2021) and planning to migrate to CF23 sometime in 2026.My concerns:What are the security risks of running CF21 after November 10, 2025 with no more updates available?Should I at least update to CF21 Update 22 before the EOL date?Is it feasible/safe to wait until 2026 for the CF23 migration, or should I accelerate this timeline?Are there any compliance issues (PCI, HIPAA, etc.) with running an unsupported CF version?Any advice on the best path forward would be appreciated. Should I prioritize updating to the latest CF21 patch first, or should I fast-track the CF23 migration?Thanks in advance for your guidance!

Hi,I came across something odd while working with ColdFusion 2021 . I have an array of structs representing student data and I'm trying to build a nested struct using arrayEach. Here's the code:<cfscript> arrayData = [ { "name": "Aisha Khan", "age": 21, "major": "Computer Science", "gpa": 3.5, "hobbies": ["coding", "chess", "hiking"] }, { "name": "Liam Patel", "age": 28, "major": "Economics", "gpa": 3.5, "hobbies": ["debating", "football", "photography"] }, { "name": "Sofia Zhang", "age": 20, "major": "Psychology", "gpa": 3.5, "hobbies": ["reading", "painting", "yoga"] }, { "name": "Noah Smith", "age": 23, "major": "Mechanical Engineering", "gpa": 3.2, "hobbies": ["robotics", "gaming", "cycling"] }, { "name": "Fatima Yusuf", "age": 21, "major

When I import the JSON into ColdFusion, the datasource password doesn’t work.The log shows this message:Datasource XXX could not be found. Ensure that you have spelled the name correctly and that the data source is registered in the ColdFusion Administrator Data Sources page.When I go to the datasource screen, without changing the password, and click submit, I get this message:An error occurred while trying to encrypt or decrypt your input string: Input length must be multiple of 16 when decrypting with padded cipher.However, if I enter the password and save it, the error disappears.I’m using Docker.Docker Log:2025-04-01 15:31:02 Import of DATASOURCE, MAIL, DEBUG successful.

First off – thanks for all the fantastic help so far.  Just one last issue to resolve. Can I clear down the input fields once the user presses Submit to update the database?Otherwise if they press the submit button again, it add more (duplicate) records to the database. (my other option if to manage it in SQL code, ignoring duplicate entries) How it works------------------Page displays a variable list of rows, and a field to allow entry of a new date value on each row (as each row may have a different value, or indeed no changes).  Each time a value is entered, we want to create a new “change log” record for that change.example layout :                key     current value    data entry field to allow new value                key     current value  &

Been banging my head against this server for a few days now. We are currently working with ColdFusion 2021 on update 21.While using cfcompile, we received an error concerning jsafe not being found. From what I can find, update 14 phased this encryption out in favor of a more modern standard. The problem I'm finding is I cant get around this error. The jsafejce.jar file is also missign from the coldfusion directory. See below. java.lang.reflect.InvocationTargetExceptionat java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.base/java.lang.reflect.Method.invoke(Method.java:566)at coldfusion.tools.CommandLineInvoker.main(CommandLineInvoker.java:112)Caused by: java.lang.NoClassDefFoundError: com/rsa/jsafe/provider/JsafeJCEat coldfusion.security.Abstr

I am trying to run the ColdFusion 2025 Auto-Lockdown on ColdFusion Update 4. At first it was failing with the following error in the application log: Function getAdminSettings does not support adminpassword as an argument in ...CFIDE\lockdown\lockdown.cfc. I read on the Update 2 page (https://helpx.adobe.com/coldfusion/kb/coldfusion-2025-update-2.html), If you want to apply lockdown on this update, add the -Dcoldfusion.runtime.remotemethod.matchArguments flag. So I did that. Now I am getting a new error: The USERNAME parameter to the getAdminSettings function is required but was not passed in. Are there any other modification or jvm flags I need to add to run the auto-lockdown? Thank you.

Objective------------Creating a new page which allows you to amend dates in a table on the display, which then creates a “change log” in a SQL database table.  How it should work--------------------------Page displays a variable list of rows, and a field to allow entry of a new date value on each row (as each row may have a different value, or indeed no changes).  Each time a value is entered, we want to create a new “change log” record for that change.                example layout :                key     current value    data entry field to allow new value                key     current value    data entry field to allow new value - optional 2nd row     

Anyone else using Sendgrid with Coldfusion 2023? We are using the Sendgrid SMTP API, https://www.twilio.com/docs/sendgrid/for-developers/sending-email/integrating-with-the-smtp-api, and the issue is with the password. They have you create an API key for the password, and the key is 70 characters long in the format  SG.xxxxxxxxxxxxxxxxxxxxxx.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. When entering this as the password in the Coldfusion administrator mail server settings, and doing a test with cfmail, mail.log shows the error "Can not decode string "SG". The input string is not base64-encoded." All we can think is Coldfusion is treating it as a JWT since it has two dots in the string. When entering anything else, we get the normal authentication error in mail.log. Also tried the cfadmin API to set the mail settings and have the same issue. Can you think of a way we could change the way we enter the password in the mail settings? We could always use the Sendgrid Web API instea