Common ColdFusion Problems & Solutions

-Xms8g -Xmx8g (example for 8GB heap)

// Clear large session variables
<cfset structDelete(session, "largeData")>

// Limit query caching
<cfquery name="q" cachedWithin="#createTimeSpan(0,0,5,0)#">

-XX:+UseG1GC -XX:MaxGCPauseMillis=200 -XX:G1HeapRegionSize=16m

<cfapplication
  name="myApp"
  sessionmanagement="yes"
  sessiontimeout="#createTimeSpan(0,0,30,0)#"
  setclientcookies="yes">

// Add indexes to frequently queried columns
CREATE INDEX idx_userid ON users(userid);

// Use cfqueryparam for all variables
<cfquery name="getUser">
  SELECT * FROM users
  WHERE userid = <cfqueryparam value="#userid#" cfsqltype="cf_sql_integer">
</cfquery>

// Template caching
<cfcache action="cache" timespan="#createTimeSpan(0,1,0,0)#">

// Query caching
<cfquery name="getData" cachedWithin="#createTimeSpan(0,0,10,0)#">
  SELECT * FROM products WHERE active = 1
</cfquery>

// Object caching with Redis
<cfset cachePut("userdata_#userid#", userData, createTimeSpan(0,0,30,0))>

// In server.xml
<Connector port="8500"
  maxThreads="200"
  minSpareThreads="25"
  connectionTimeout="20000"
  acceptCount="100"
  enableLookups="false"
  compression="on"
  compressionMinSize="2048"/>

// Defer non-critical operations
<cfif structKeyExists(url, "loadExtras")>
  <cfset heavyData = getExpensiveData()>
</cfif>

// VULNERABLE CODE - DO NOT USE
<cfquery name="badQuery">
  SELECT * FROM users WHERE username = '#form.username#'
</cfquery>

// SECURE CODE - ALWAYS USE
<cfquery name="secureQuery">
  SELECT * FROM users
  WHERE username = <cfqueryparam value="#form.username#" cfsqltype="cf_sql_varchar" maxlength="50">
</cfquery>

// Input validation
<cfif NOT reFindNoCase("^[a-zA-Z0-9_]{3,20}$", form.username)>
  <cfthrow message="Invalid username format">
</cfif>

// Whitelist approach
<cfset validSortColumns = ["name", "date", "id"]>
<cfif NOT arrayContains(validSortColumns, url.sortBy)>
  <cfset url.sortBy = "name">
</cfif>

// Use ORM instead of dynamic queries
entityLoad("User", {username: form.username}, true)

// Use queryExecute with params
queryExecute(
  "SELECT * FROM users WHERE username = :username",
  {username: {value: form.username, cfsqltype: "varchar"}}
)

// HTML context encoding
<p>#encodeForHTML(userInput)#</p>

// JavaScript context encoding
<script>
  var userName = "#encodeForJavaScript(userInput)#";
</script>

// URL context encoding
<a href="profile.cfm?user=#encodeForURL(userInput)#">Profile</a>

// CSS context encoding
<div style="color: #encodeForCSS(userColor)#">

// In Application.cfc
function onRequestStart(targetPage) {
  cfheader(name="Content-Security-Policy",
    value="default-src 'self'; script-src 'self' 'unsafe-inline' https://trusted-cdn.com; style-src 'self' 'unsafe-inline'");
  cfheader(name="X-Content-Type-Options", value="nosniff");
  cfheader(name="X-Frame-Options", value="SAMEORIGIN");
  cfheader(name="X-XSS-Protection", value="1; mode=block");
}

// Use OWASP Java HTML Sanitizer
<cfset cleanHTML = createObject("java", "org.owasp.html.HtmlPolicyBuilder")
  .allowElements("p", "br", "strong", "em")
  .toFactory()
  .sanitize(userHTML)>

// In ColdFusion Administrator or Application.cfc
this.datasources["myDB"] = {
  driver: "MSSQLServer",
  host: "dbserver",
  database: "mydb",
  port: 1433,
  username: "user",
  password: "encrypted:...",
  connectionLimit: 100,  // Increase from default
  connectionTimeout: 30,
  loginTimeout: 30
};

// Always close connections in finally block
<cftry>
  <cfquery name="getData" datasource="myDB">
    SELECT * FROM products
  </cfquery>
  <cfcatch>
    <cflog file="errors" text="#cfcatch.message#">
  </cfcatch>
  <cffinally>
    <!--- Connection auto-closed with cfquery --->
  </cffinally>
</cftry>

// Close stored proc connections
<cfstoredproc procedure="myProc" datasource="myDB">
  <cfprocresult name="result">
</cfstoredproc>

// Set reasonable timeouts
<cfquery name="getData"
  datasource="myDB"
  timeout="30"
  maxrows="1000">
  SELECT * FROM large_table
  WHERE date > <cfqueryparam value="#dateAdd('d', -7, now())#" cfsqltype="cf_sql_timestamp">
</cfquery>

// Check pool usage
<cfset poolStats = getConnectionPoolStats("myDB")>
<cfif poolStats.activeConnections / poolStats.maxConnections GT 0.8>
  <!--- Alert: Pool usage > 80% --->
  <cflog file="monitoring" text="Connection pool usage critical: #poolStats.activeConnections#/#poolStats.maxConnections#">
</cfif>

// In jvm.config
-XX:+UseG1GC
-XX:MaxGCPauseMillis=200
-XX:G1HeapRegionSize=16m
-XX:InitiatingHeapOccupancyPercent=45
-XX:G1ReservePercent=10

// Set min = max for consistent performance
-Xms8g -Xmx8g

// Heap should be 50-70% of total RAM
// 16GB server → 8-10GB heap

// Parallel GC threads (default: CPU cores)
-XX:ParallelGCThreads=8

// Concurrent GC threads (1/4 of parallel)
-XX:ConcGCThreads=2

// Reuse objects instead of creating new
<cfset stringBuilder = createObject("java", "java.lang.StringBuilder").init()>
<cfloop array="#items#" index="item">
  <cfset stringBuilder.append(item)>
</cfloop>
<cfset result = stringBuilder.toString()>

// Avoid in-loop object creation
<cfset pattern = createObject("java", "java.util.regex.Pattern").compile("regex")>
<cfloop array="#data#" index="item">
  <cfset matcher = pattern.matcher(item)>
</cfloop>

// Stop ColdFusion
sudo systemctl stop coldfusion

// Run password reset
cd /opt/coldfusion2025/cfusion/bin
./cfpm resetadmin

// Follow prompts to set new password
// Start ColdFusion
sudo systemctl start coldfusion

// Edit: /opt/coldfusion2025/cfusion/lib/neo-security.xml
// Find and comment out:
<!--
<var name='allowedAdminIPList'>
  <string>127.0.0.1,192.168.1.100</string>
</var>
-->

// Restart ColdFusion

// Edit: neo-security.xml
<var name='mfaEnabled'>
  <boolean>false</boolean>  <!-- Change from true -->
</var>

// Restart ColdFusion

// Use CFBuilder or CF Admin mobile app
// Connect via RDS to manage settings
// RDS password in rds.properties

// Linux/Mac
cd /opt/coldfusion2025/cfusion/runtime/bin
./wsconfig -ws apache -dir /etc/apache2 -v

// Windows
cd C:\ColdFusion2025\cfusion\runtime\bin
wsconfig.exe -ws iis -site "Default Web Site" -v

// Restart web server
sudo systemctl restart apache2

// Check if AJP port listening
netstat -an | grep 8012

// Should see: tcp 0.0.0.0:8012 LISTEN

// If not, check server.xml
<Connector port="8012"
  protocol="AJP/1.3"
  redirectPort="8445"
  secretRequired="true"
  secret="your-secret-key"
  address="127.0.0.1"/>

// Apache: In worker.properties
worker.cfusion.secret=your-secret-key

// IIS: In isapi_redirect.properties
connection_pool_size=10
secret=your-secret-key

// Must match server.xml secret

// Linux - Apache needs read access
sudo chmod 644 /etc/apache2/mod_jk.conf
sudo chmod 644 /etc/apache2/workers.properties
sudo systemctl restart apache2

// Application.cfc
this.sessionManagement = true;
this.sessionStorage = "redis";
this.sessionTimeout = createTimeSpan(0, 0, 30, 0);

this.redis = {
  server: "redis.example.com",
  port: 6379,
  password: "encrypted:...",
  database: 0,
  connectionPoolSize: 50
};

// Store only essential data in session
<cfset session.userId = userQuery.id>  // ID only
<cfset session.userName = userQuery.name>

// Load full user object on demand
<cffunction name="getCurrentUser">
  <cfif NOT structKeyExists(request, "currentUser")>
    <cfset request.currentUser = userService.getById(session.userId)>
  </cfif>
  <cfreturn request.currentUser>
</cffunction>

// NGINX example
upstream coldfusion {
  ip_hash;  // Sticky sessions by client IP
  server cf1.example.com:8500;
  server cf2.example.com:8500;
}

// Or use cookie-based
sticky cookie srv_id expires=1h;

// In ColdFusion Admin:
// Server Settings > Memory Variables
// Enable: "Use J2EE session variables"

// Provides standard servlet session
// Better cluster support

// In Apache config or .htaccess
<LocationMatch "^/CFIDE/(administrator|adminapi|componentutils)">
  Require ip 127.0.0.1
  Require ip 192.168.1.0/24
  Require ip 10.0.0.0/8
</LocationMatch>

// Restart Apache
sudo systemctl restart apache2

// In web.config for CFIDE directory
<configuration>
  <system.webServer>
    <security>
      <ipSecurity allowUnlisted="false">
        <add allowed="true" ipAddress="127.0.0.1" />
        <add allowed="true" ipAddress="192.168.1.0" subnetMask="255.255.255.0" />
      </ipSecurity>
    </security>
  </system.webServer>
</configuration>

// In CF Admin: Server Settings > Settings
// Administrator URL Path: /cf-secure-admin-abc123

// Creates new path, old path disabled
// Access via: /cf-secure-admin-abc123/

// In CF Admin: Debugging & Logging > Debug Output Settings
// Enable: "Display debug output"
// Restrict to IP addresses:
127.0.0.1
192.168.1.0/24

// Or in Application.cfc
this.debuggingIPAddresses = "127.0.0.1,192.168.1.100";

// Linux firewall (iptables)
sudo iptables -A INPUT -p tcp --dport 8500 -s 127.0.0.1 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8500 -j DROP
sudo iptables -A INPUT -p tcp --dport 8012 -j DROP

// Make persistent
sudo iptables-save > /etc/iptables/rules.v4