Sending XML with CFHTTP

[ACS LLC]

I have some code that works perfectly well with one customer, but with another it's a total fail. They are telling me that the content type is not being sent.

The goal is to send a XML data to them over SSL/Port 8443

Am I missing something here that some servers react badly to?

<cfparam name="form_timeout" default="5">

<cfparam name="form_port" default="8443">

<cfset objXml = createObject("component","xml2Struct")>

<!--- Request XML--->

<cfxml variable="xmlRequest">

<?xml version="1.0" encoding="UTF-8"?>

<request>

<header>

<signature>BHNUMS</signature>

<details>

<productCategoryCode>01</productCategoryCode>

<specVersion>43</specVersion>

</details>

</header>

<transaction>

<primaryAccountNumber>9877890000000000001</primaryAccountNumber>

<processingCode>615400</processingCode>

<transactionAmount>000000000000</transactionAmount>

<transmissionDateTime>140223183057</transmissionDateTime>

<systemTraceAuditNumber>385224</systemTraceAuditNumber>

<localTransactionTime>103057</localTransactionTime>

<localTransactionDate>140223</localTransactionDate>

<merchantCategoryCode>5411</merchantCategoryCode>

<pointOfServiceEntryMode>011</pointOfServiceEntryMode>

<acquiringInstitutionIdentifier>60300000063</acquiringInstitutionIdentifier>

<retrievalReferenceNumber>000007385224</retrievalReferenceNumber>

<merchantTerminalId>26065     001   </merchantTerminalId>

<merchantIdentifier>60300000063    </merchantIdentifier>

<merchantLocation>Simulation</merchantLocation>

<transactionCurrencyCode>840</transactionCurrencyCode>

<additionalTxnFields>

<productId>07675019009</productId>

<redemptionPin>#form_redemptioncode#</redemptionPin>

</additionalTxnFields>

</transaction>

</request>

</cfxml>

<!---Make a test request --->

<cfhttp url="HTTPS URL OF CUSTOMER HERE" method="post" port="#form_port#" timeout="#form_timeout#">

    <cfhttpparam type="header" name="Accept" value="application/xml" />

    <cfhttpparam type="header" name="Accept-Language" value="en-us,en" />

    <cfhttpparam type="header" name="Accept-Charset" value="utf-8" />

    <cfhttpparam type="header" name="Keep-Alive" value="115" />

    <cfhttpparam type="header" name="Connection" value="keep-alive" />

    <cfhttpparam type="body" value="#xmlRequest#" />

</cfhttp>

<CFOUTPUT>#cfhttp.statuscode#</CFOUTPUT>

[WolfShade]

There could be several things at play, here.  I do find it odd that you are trying to send SSL/TLS on port 8443.  Typically, SSL/TLS is done on port 443 (reserved).

If your webserver is using only TLS 1.0 or 1.1, and the client browser is restricted to TLS 1.2, that could cause issues.  Conversely, if your webserver is only 1.2 and the client browser isn't set up for 1.2, that could also cause issues.

HTH,

^ _ ^

[Dave Watts]

Yeah, the key is to separate these two issues. I'd try sending it manually using a browser and Fiddler to see what's happening. As for the TCP/8443 bit, that's not surprising for internal HTTPS services, it's a pretty standard port for those.

Dave Watts, Fig Leaf Software

[ACS LLC]

Yes, this is an internal server to server post. I have a dashboard that I use to push config such as timeout, but that just triggers the CFHTTP port.

Both the customers I am using this with are using 8443, and it's fine with one of them

I did try a hit on the URL with a browser, but it won't connect to the link, I guess because I am not sending XML content

I'm not familiar with fiddler

[Dave Watts]

You should learn about Fiddler! It's a great diagnostic tool, and works on any Windows client. It's free!

Fiddler - Free Web Debugging Proxy - Telerik

Dave Watts, Fig Leaf Software

[ACS LLC]

Will give it a go now to see if it can help, I hope that it does not have a long learning curve

[Dave Watts]

No, it's pretty easy to use.

Dave Watts, Fig Leaf Software

[ACS LLC]

I don't think Fiddler is going to help me, I need to send XML data to that URL and I have to do it on the server where the IP is whitelisted.

Perhaps it can do it, but there's quite a few options in here, it's not something I can pick up and use.

Do you see anything wrong with my original code and why, this is the log from the receiving server, as you can see ContentTye: null not supported.

2018-09-11 06:01:31,433 [btpool3-22 - /transactionManagement/v2/transaction] ERROR [com.bhn.beas.acquirerbhnumshttp.service.BHNUMSTransactionServlet] SC_INTERNAL_SERVER_ERROR

1. java.lang.Exception: ContentType: null not supported

[Dave Watts]

So, sending XML via Fiddler isn't a problem, you'd just have to build a URL locally that does this for you, or use POSTMan, or use cURL or wget, etc. If it can only be done from the server, you could optionally install Fiddler on the server long enough to identify the problem. The problem with trying to figure it out from the remote server's logs is that they don't tell you much. Why is the remote server getting a null? What is actually being sent over the wire? It's kind of important to be able to see what's being sent and what's being received. If you could temporarily get the remote server to accept requests from your workstation, you could do that instead of installing Fiddler on the server. But whether you use Fiddler or not, you're going to have a hard time figuring out what the cause of the error is if you can't actually see the traffic.

Dave Watts, Fig Leaf Software

[ACS LLC]

It'll take them two weeks to list my local IP, so that's out of the question.

I'll have to do a temp install on the server, but first I need to figure out how the heck I use it. So can I take the code above and make a CFM (which I already did) and them just open that link in any browser? It's a bit of a rush job, against the clock on time lines, so I don't have a lot of time to study fiddler, it's one of those when you know how it's easy.

Can we agree that the code above is technically correct and should be sending in XML format?

[ACS LLC]

I have this running locally with some mock responses, so I can test locally in dev without SSL.

I ran one of those tests, I'm unsure where to find what actual content was sent to the mock API? I hit the XML but that was empty, I tried all the tags and could not find anything. I can confirm locally that it does work.

[ACS LLC]

I am having a difficult time with Fiddler. When I open it, it kills my browser SSL, so trying to run anything on the server fails as it functions over SSL. I see there's some way to add trusted certs from fiddler which I accepted but I am not sure if they went it. It's a little too much to sniff it out this way

[ACS LLC]

I might be getting somewhere, they had complained about a null content type

i don't have a CFHTTP param with content-type, and I've found that one does exist

<cfhttpparam type="HEADER" name="Content-Type" value="application/json; charset=utf-8">

I now need to find one the correct setting is for XML, I tried changing json to XML and it still failed. but maybe it's another error, getting a 500 response code as you pointed out tells you nothing!

[Dave Watts]

Ask them what content type they expect to receive for XML payloads.

Dave Watts, Fig Leaf Software

[ACS LLC]

Well this is proving to be a bit of a nightmare, I'm now getting a 400 error, so their server can't accept it

They told me they needed Application/xml

So I add the header

<cfhttpparam type="header" name="Content-Type" value="Application/xml" />

So all the headers look like this now

<cfhttpparam type="header" name="Accept" value="application/xml" />

    <cfhttpparam type="header" name="Accept-Language" value="en-us,en" />

    <cfhttpparam type="header" name="Accept-Charset" value="utf-8" />

    <cfhttpparam type="header" name="Keep-Alive" value="115" />

    <cfhttpparam type="header" name="Connection" value="keep-alive" />

    <cfhttpparam type="body" value="#xmlRequest#" />

    <cfhttpparam type="header" name="Content-Type" value="Application/xml" />

[ACS LLC · Accepted solution]

I got it!

It did need this

<cfhttpparam type="header" name="Content-Type" value="Application/xml" />

This was incorret

<cfhttpparam type="header" name="Accept" value="application/xml" />

Even though I had fixed it, I had been supplied some bad data, or at least not explained clearly, so once that was fixed it all worked.

Their server was just throwing a 400 status, so it was rather uninformative.

[ACS LLC]

My only challenge now is that I'm running a series of these calls using a single CFM page that calls a CFM as a template multiple times, about 20 times.

Two of the calls take a short while and I end up with a 500 error, and a log in CF that says I exceeded the allowable time limit for the tag: CFHTTP

Last thing I need is a 500 error for the end users when these API's have to do their checks.

I did add throwonerror=no to the CFHTTP thinking that would also stop it throwing an error if it time out, but apparently not.

Is there any way to set a small time out, say 8 seconds and if it exceeds it then do not produce an error.

I think I've seen CFCATCH as part of something like this??

[Charlie Arehart]

CFHTTP has a TIMEOUT attribute, that would allow the cfhttp to take longer (if that is the problem). But you seem to want to "set a small timeout" and have it "not produce an error" if it exceeds that. Why? You can use a cfcatch that does nothing, but that's always risk (you won't know the error is happening.

Let me warn you also that perhaps you want to focus not on the CFHTTP timeout but on the entire page timeout--either the CF page doing the cfhttp calls, or the one calling it (from your description). For that, use the tag:

cfsetting requesttimeout="xx"

where xx is in seconds.

[ACS LLC]

The CFHTTP is being used to communicate with a third party API to validate a code which allows the end user to progress at my side.

I don't want them sat around waiting for a long period of time if there is a problem connecting, in-fact they ask that we wait no more than 8 seconds.

I had set <cfsetting requestTimeOut = "9000" /> on the page to test it and sure enough I could stop the error, but if there is a problem it would indeed hang for a long time which would not be acceptable.

What I want to do is try to do the hit, if it doesn't work after a reasonable amount of time I want to respond to the end user with a message, a 'sorry due to technical reasons we can't process your code'

So I need to catch that error, stop the server 500 error, when it finishes running the template with the CFHTTP if there are no values present (they return a status value to pass the request) then I could use that lack of value to act accordingly.

The only thing I'm not sure is how to catch that problem to stop the 500 error

[Dave Watts]

It looks fine to me, but I can't really be sure it's 100% right without seeing request and response data.

Dave Watts. Fig Leaf Software