Posting credentials to cfhttp body using ColdFusion - coldfusion

I am passing few credentials along with __EVENTARGUMENT, __VIEWSTATE. But I was not able see the variables and data in the console or in the fiddler, Am I missing anything. I tried with url, formfield and body with no success. By the way I am using ColdFusion 9.
<cfset authenticationRequestBody = "__LASTFOCUS=#LASTFOCUS#&__EVENTTARGET=#EVENTTARGET#&__EVENTARGUMENT=#EVENTARGUMENT#&__VIEWSTATE=#EncodeViewState#&__VIEWSTATEGENERATOR=#EncodeViewGenerator#&__EVENTVALIDATION=#EncodeEventValidation#&#encodeForURL(UNameString)#=#UserName#&#encodeForURL(PwdString)#=#encodeForURL(Password)#&#encodeForURL(ButtonString)#=Submit">
<cfset stsUrl = "https://somesite.com/yyy/login.aspx" >
<cfhttp url="#stsUrl#" method="post" resolveurl="no" >
<cfhttpparam type="header" name="Accept" value="application/xhtml+xml,text/html">
<cfhttpparam type="header" name="REFERER" value="#BaseUrl#" >
<cfhttpparam type="header" name="Accept-Language" value="en-US">
<cfhttpparam type="header" name="Content-Type" value="application/x-www-form-urlencoded">
<cfhttpparam type="header" name="Connection" value="keep-alive" >
<cfhttpparam type="header" name="User-Agent" value="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36" >
<cfloop collection="#cookies#" item="i">
<cfhttpparam type = "cookie" name="#i#" value="#cookies[i]#">
</cfloop>
<cfhttpparam type="body" name="PostData" value="#authenticationRequestBody#">
<cfoutput>
<cfdump var="#GetHTTPRequestData()#">
</cfoutput>
This is Not a Problem related to the configuration Because I checked the JVM version and TLS version at the Site using SSL test server. There is something that I am missing here in the code..
Coldfusion 11 (Update 12)
JVM : 1.8
TLS : 1.2
I was ablbe to get till the Login Screen. Even after passing the Username and Password in the body, it doesn't validate. When I access the URL directly with the same credentials it logs me in successfully.

Try doing a
<cfdump var="#cfhttp#">
OR
<cfhttp url="#stsUrl#" method="post" resolveurl="no" result="result" >
...
</cfhttp>
<cfdump var="#result#">

Problem is not with the configuration or compatibility version.. The issue is with the cookies we are passing from the start.. When we navigate through a other page using cfhttp we need to carry the old cookies that we got from the past cfhttp calls.. Also in my case I need to initialize the cookie in the first call.. Below is the example for two calls..
<cfhttp url='#BaseUrl#' method="get" redirect="no">
<cfhttpparam type="header" name="Connection" value="keep-alive" >
<cfhttpparam type="header" name="Cache-Control" value="no-cache">
<cfhttpparam type="header" name="User-Agent" value="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko">
<cfhttpparam type="header" name="cookie" value="TestCookie=;" >
</cfhttp>
<cfhttp url="#stsUrl#" method="post" redirect="no" resolveurl="yes" result="postResult" >
<cfhttpparam type="header" name="REFERER" value="#BaseUrl#" >
<cfhttpparam type="header" name="Cache-Control" value="no-cache">
<cfhttpparam type="header" name="Content-Type" value="application/x-www-form-urlencoded">
<cfhttpparam type="header" name="Connection" value="keep-alive" >
<cfhttpparam type="header" name="User-Agent" value="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36" >
<cfhttpparam type="header" name="cookie" value="TestCookie=;" encoded="yes">
<cfloop collection="#CookieList#" item="i">
<cfhttpparam type="header" name="cookie" value="#CookieList[i]#" encoded="yes">
</cfloop>
<cfhttpparam name="__LASTFOCUS" value="" type="formfield">
<cfhttpparam name="__EVENTTARGET" value="" type="formfield">
<cfhttpparam name="__EVENTARGUMENT" value="" type="formfield">
<cfhttpparam name="__VIEWSTATE" value="#VIEWSTATE#" type="formfield">
<cfhttpparam name="__VIEWSTATEGENERATOR" value="#VIEWSTATEGENERATOR#" type="formfield">
<cfhttpparam name="__EVENTVALIDATION" value="#EVENTVALIDATION#" type="formfield">
<cfhttpparam name="ctl00$MainContent$LoginCtrl$UserName" value="#UserName#" type="formfield">
<cfhttpparam name="ctl00$MainContent$LoginCtrl$Password" value="#Password#" type="formfield">
<cfhttpparam name="ctl00$MainContent$LoginCtrl$LoginButton" value="Submit" type="formfield">
</cfhttp>

Related

Export to Excel in ColdFusion

I am posting few inputs into a url using cfhttp and expecting to download some data in a xls file. I am trying to do get data using cffile ="write" which doesn't work. Can any one suggest how can we go with this. Here is the code below
<cfhttp url="#Baseurl#" method="post" result="ExportToExcelresult" redirect="no" resolveurl="true">
<cfhttpparam type="header" name="REFERER" value="#Baseurl#" >
<cfhttpparam type="header" name="Cache-Control" value="no-cache">
<cfhttpparam type="header" name="Content-Type" value="application/x-www-form-urlencoded">
<cfhttpparam type="header" name="Connection" value="keep-alive" >
<cfhttpparam type="header" name="User-Agent" value="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36">
<cfhttpparam type="header" name="cookie" value="TestCookie=;" encoded="yes">
<cfloop collection="#CookieList#" item="i">
<cfhttpparam type="header" name="cookie" value="#CookieList[i]#" encoded="yes">
</cfloop>
<cfloop collection="#PostCookieList#" item="i">
<cfhttpparam type="header" name="cookie" value="#PostCookieList[i]#" encoded="yes">
</cfloop>
<cfloop collection="#PostDefaultCookieList#" item="i">
<cfhttpparam type="header" name="cookie" value="#PostDefaultCookieList[i]#" encoded="yes">
</cfloop>
<cfhttpparam name="ToolkitScriptManager1_HiddenField" value="" type="formfield">
<cfhttpparam name="LeftNav1_LoginView1_treeView1_ExpandState" value="#EXPANDSTATE#" type="formfield">
<cfhttpparam name="LeftNav1_LoginView1_treeView1_SelectedNode" value="#SELECTNODE#" type="formfield">
<cfhttpparam name="__EVENTTARGET" value="" type="formfield">
<cfhttpparam name="__EVENTARGUMENT" value="" type="formfield">
<cfhttpparam name="LeftNav1_LoginView1_treeView1_PopulateLog" value="" type="formfield">
<cfhttpparam name="__VIEWSTATE" value="#VIEWSTATE#" type="formfield">
<cfhttpparam name="__VIEWSTATEGENERATOR" value="#VIEWSTATEGENERATOR#" type="formfield">
<cfhttpparam name="__EVENTVALIDATION" value="#EVENTVALIDATION#" type="formfield">
<cfhttpparam name="ctl00$MainContent$repMUData$ctl00$btnExport" value="Export to Excel" type="formfield">
</cfhttp>
When I do cfdump here is the the result
When I do cfdump that it is giving some binary data. For sure I am getting some data but not sure how to extract the data into xls file
To write the binary data to file just use the function filewrite. In the following snippet I write to a temporary file, but you would write to were you want to permanently store the file. I then read file back into spreadsheet object to verify that the write worked as intended.
<cfhttp url="http://example.com/test.cfm" result="ExportToExcelresult">
</cfhttp>
<cfscript>
//Replace with the file path where you want to permanently store the file
yourFileLocation = getTempFile(getTempDirectory() ,"xls");
//Save to file system
filewrite(yourFileLocation, ExportToExcelresult.filecontent.toByteArray());
//Not needed. Only verifying there is a spreadsheet written to the file location
writeOutput("Is spreadsheet: " & isSpreadsheetFile(yourFileLocation));
//You will not be working with a temp file. Do not delete it.
fileDelete(yourFileLocation);
</cfscript>

cfhttp to the stats.ezhostingserver website not working

I have the following Updated code where I am trying to connect to the website using the username/password and siteid combination, i am passing all values using get method and trying to fetch cookie to authenticate and go ahead but somehow i am again getting redirected to the login screen
My Code
<cfhttp method="get" url="https://stats.ezhostingserver.com/Login.aspx" resolveurl="true" redirect="false">
<cfhttpparam type="URL" name="ctl00$MPH$txtUserName" value="********">
<cfhttpparam type="URL" name="ctl00$MPH$txtPassword" value="********">
<cfhttpparam type="URL" name="ctl00$MPH$txtSiteId" value="*****">
<cfhttpparam type="Header" name="Accept-Encoding" value="deflate;q=0">
<cfhttpparam type="Header" name="TE" value="deflate;q=0">
</cfhttp>
<cfset stm_cookies = cfhttp.responseHeader['Set-Cookie'] />
<cfset stm_temp = REReplace(stm_cookies, ";.*", "")>
<cfset stm_cookieName = listfirst(stm_temp,'=')>
<cfset stm_cookievalue = listlast(stm_temp,'=')>
<cfhttp method="get" url="https://stats.ezhostingserver.com/default.aspx" charset="utf-8" result="results" redirect="no">
<cfhttpparam type="cookie" name="#stm_cookieName#" value="#stm_cookievalue#">
</cfhttp>
<cfoutput>#results.filecontent#</cfoutput>
But it is saying me object moved error

CFHTTP & CloudFlare API: DELETE purge_everything not working

Has anyone else been able to DELETE purge_everything with CFHTTP?
I can't seem to get ColdFusion CFHTTP to successfully purge a CloudFlare zone's cache. But I am able to do other things like list zones, etc. So I know I can successfully CFHTTP to CloudFlare's API.
This is the curl command, which works:
curl -svX DELETE -H 'X-Auth-Email: a#b.c' -H 'X-Auth-Key: XYZ' https://api.cloudflare.com/client/v4/zones/xxxxxxx/purge_cache -H 'Content-Type: application/json' --data '{"purge_everything":true}'
The error returned is:
{"success":false,"errors":[{"code":1012,"message":"Request must
contain one of \"purge_everything\" or \"files\", or
\"tags"}],"messages":[],"result":null}
I've tried so many combinations of code... these are the different variables I've tried:
<cfset stFields = '{"purge_everything":true}'>
<cfset stFieldsJson = {"purge_everything":true}>
<cfset stFieldsJson2 = {
"fields" : {
"purge_everything" : true
}
}>
<cfset stFieldsJson3 = {
"purge_everything" : true,
"fields" : {
"purge_everything" : true
}
}>
<cfset tmp = {} />
<cfset tmp['purge_everything'] = true />
... and here are some different combinations of calls I've made...
<cfhttp url="https://api.cloudflare.com/client/v4/zones/4da78b2707f9753eb79a93d505b4d0d3/purge_cache" method="DELETE" result="cFlare" charset="utf-8">
<cfhttpparam type="header" name="X-Auth-Email" value="a#b.c">
<cfhttpparam type="header" name="X-Auth-Key" value="XYZ">
<cfhttpparam type="header" name="Content-Type" value="application/json; charset=utf-8">
<cfhttpparam type="header" name="accept" value="*/*">
<cfhttpparam type="body" value="#serializeJson(stFieldsJson)#" encoded="false">
</cfhttp>
<cfdump var="#cFlare#"><Cfflush>
<cfhttp url="https://api.cloudflare.com/client/v4/zones/4da78b2707f9753eb79a93d505b4d0d3/purge_cache" method="DELETE" result="cFlare" charset="utf-8">
<cfhttpparam type="header" name="X-Auth-Email" value="a#b.c">
<cfhttpparam type="header" name="X-Auth-Key" value="XYZ">
<cfhttpparam type="header" name="Content-Type" value="application/json; charset=utf-8">
<cfhttpparam type="header" name="accept" value="*/*">
<cfhttpparam type="body" value="#serializeJson(stFieldsJson2)#" encoded="false">
</cfhttp>
<cfdump var="#cFlare#"><Cfflush>
<cfhttp url="https://api.cloudflare.com/client/v4/zones/4da78b2707f9753eb79a93d505b4d0d3/purge_cache" method="DELETE" result="cFlare">
<cfhttpparam type="header" name="X-Auth-Email" value="a#b.c">
<cfhttpparam type="header" name="X-Auth-Key" value="XYZ">
<cfhttpparam type="header" name="Content-Type" value="application/json">
<cfhttpparam type="header" name="accept" value="*/*">
<cfhttpparam type="body" value="#serializeJson(stFieldsJson3)#" encoded="false">
</cfhttp>
<cfdump var="#cFlare#"><Cfflush>
<cfhttp url="https://api.cloudflare.com/client/v4/zones/4da78b2707f9753eb79a93d505b4d0d3/purge_cache" method="DELETE" result="cFlare">
<cfhttpparam type="header" name="X-Auth-Email" value="a#b.c">
<cfhttpparam type="header" name="X-Auth-Key" value="XYZ">
<cfhttpparam type="header" name="Content-Type" value="application/json">
<cfhttpparam type="header" name="accept" value="*/*">
<cfhttpparam type="body" value="#serializeJson(tmp)#" encoded="false">
</cfhttp>
<cfdump var="#cFlare#"><Cfflush>
<cfhttp url="https://api.cloudflare.com/client/v4/zones/4da78b2707f9753eb79a93d505b4d0d3/purge_cache" method="DELETE" result="cFlare" charset="utf-8">
<cfhttpparam type="header" name="X-Auth-Email" value="a#b.c">
<cfhttpparam type="header" name="X-Auth-Key" value="XYZ">
<cfhttpparam type="header" name="Content-Type" value="application/json; charset=utf-8">
<cfhttpparam type="header" name="accept" value="*/*">
<cfhttpparam type="body" value='{"purge_everything":true}' encoded="false">
</cfhttp>
<cfdump var="#cFlare#"><Cfflush>
<cfhttp url="https://api.cloudflare.com/client/v4/zones/4da78b2707f9753eb79a93d505b4d0d3/purge_cache" method="DELETE" result="cFlare" charset="utf-8">
<cfhttpparam type="header" name="X-Auth-Email" value="a#b.c">
<cfhttpparam type="header" name="X-Auth-Key" value="XYZ">
<cfhttpparam type="header" name="Content-Type" value="application/json; charset=utf-8">
<cfhttpparam type="header" name="accept" value="*/*">
<cfhttpparam type="body" value='"purge_everything":true' encoded="false">
</cfhttp>
<cfdump var="#cFlare#"><Cfflush>
<cfhttp url="https://api.cloudflare.com/client/v4/zones/4da78b2707f9753eb79a93d505b4d0d3/purge_cache" method="DELETE" result="cFlare" charset="utf-8">
<cfhttpparam type="header" name="X-Auth-Email" value="a#b.c">
<cfhttpparam type="header" name="X-Auth-Key" value="XYZ">
<cfhttpparam type="header" name="Content-Type" value="application/json; charset=utf-8">
<cfhttpparam type="header" name="accept" value="*/*">
<cfhttpparam type="body" value='purge_everything' encoded="false">
</cfhttp>
<cfdump var="#cFlare#"><Cfflush>
I've also tried with and without the 'Encoded' Body attribute, with and without the 'Charset' attribute in all places.
Any help is appreciated.
Not sure which version of CF you are running. However, I suspect you are not doing anything wrong, but that <cfhttp> simply is not sending a body when the method="DELETE", which would make sense given the error message.
A simple way to test it is point your <cfhttp> call to a test page on your local CF server. On the test page dump GetHttpRequestData() so you can view the actual headers and content submitted. (Another option is to use the built in TCPMonitor on an open port, which provides more detail about both request and response. However, for this scenario, the first method is simplest.)
Test Page
<!--- echo request headers and content --->
<cfdump var="#getHTTPRequestData()#">
Request
<!--- simulate request --->
<cfset requestBody["purge_everything"] = true>
<cfhttp url="http://localhost/testPage.cfm" method="DELETE" result="cFlare" charset="utf-8" >
<cfhttpparam type="header" name="X-Auth-Email" value="a#b.c">
<cfhttpparam type="header" name="X-Auth-Key" value="XYZ">
<cfhttpparam type="header" name="Content-Type" value="application/json; charset=utf-8">
<cfhttpparam type="header" name="accept" value="*/*">
<cfhttpparam type="body" value="#serializeJson(requestBody)#" encoded="false">
</cfhttp>
<!--- display request headers and content --->
<cfoutput>#cFlare.fileContent#</cfoutput>
Notice the content, or body, is empty when method="DELETE"? However, change it to method="POST" and the content magically appears.
Sending a body with a DELETE request should be valid, so it sounds like a bug. If so, you will need to find a different tool to make the http request, such as invoking curl.exe from cfexecute, or using a custom tag like cfx_http5, or use java classes like as URLConnection or Apache's HTTPClient.
After reading up on some docs, it appears that the CloudFlare API is mixing methods in a way that CFHTTP will not.
CloudFlare's API states to use the DELETE method and content type header of "application/json". Their exact example is:
$ curl -X DELETE "https://api.cloudflare.com/client/v4/zones/023e105f4ecef8ad9ca31a8372d0c353/purge_cache" \
-H "X-Auth-Email: user#example.com" \
-H "X-Auth-Key: c2547eb745079dac9320b638f5e225cf483cc5cfdda41" \
-H "Content-Type: application/json" \
--data '{"purge_everything":true}'
However when one uses --data, curl will POST with content-type application/x-www-form-urlencoded. https://curl.haxx.se/docs/manpage.html#-d
CFHTTP however is following specs.
POST is used to send data. DELETE is for deleting the URI.
POST: https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.5
DELETE: https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.7
When I CFHTTP with POST I get an error that only DELETE is accepted for the URI. When I CFHTTP with DELETE, no content is being POSTed.
My workaround, without going out of standard CFML, was to use their v1 API. It's working like a champ. https://www.cloudflare.com/docs/client-api.html

CFHTTP returning different cookies to XMLHttpRequest or Fiddler

I have the following CFHTTP function which should return 3 cookies (XSRT-TOKEN, hl, and EASFC-WEB-SESSION) but instead only returns a JSessionID cookie.
<cfhttp url="http://www.easports.com/uk/fifa/football-club/ultimate-team" method="GET" result="stage1">
<cfhttpparam type="header" name="Accept" value="text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" />
<cfhttpparam type="header" name="Accept-Encoding" value="gzip, deflate" />
<cfhttpparam type="header" name="Accept-Language" value="en-US, en;q=0.5" />
<cfhttpparam type="header" name="Connection" value="keep-alive" />
<cfhttpparam type="header" name="Host" value="www.easports.com" />
<cfhttpparam type="header" name="User-Agent" value="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36" />
</cfhttp>
Yet when I make a request to the page using an XMLHttpRequest function and look at the repsonse it has returned the 3 cookies as expected. Also when I load the URL in a browser and have a look in Fiddler the page again is returning the expected 3 cookies.
Anyone have any ideas what might be going on at all?
Are you running Fiddler on the same server that is doing CFHTTP? On the actual web server?
Also - try using userAgent param of the CFHTTP - not sending it as a separate header.

ColdFusion CFHTTP GET strips cookie

I'm running into issues trying to pass a cookie in my CFHTTP GET Statement.
Has anyone else experienced this? Pointers would be appreciated. BTW - I am using the x-http-method-override, because I saw this on a few other sites that were discussing this topic.
<cfhttp url="#this.apiServer#/api/v#this.version#/user.json"
method="POST" result="jorn">
<cfhttpparam type="COOKIE" name="ms_user" value="#arguments.patAppSession#" />
<cfhttpparam type="header" name="Content-Type" value="application/json" />
<cfhttpparam type="header" name="x-http-method-override" value="GET" />
<cfhttpparam type="body" value='#variables.dataFields#' />
</cfhttp>
<cfdump var = "#jorn#">