CFHTTP not working with multipart form data

I’m testing migrating an application from ACF to Lucee. I’m using Lucee inside of a Docker container. I’ve tested with these two versions:

docker.io/lucee/lucee:6.2.0.321-tomcat10.1-jre21-temurin-jammy
docker.io/lucee/lucee:6.1.1.118-tomcat9.0-jre11-temurin-jammy

The application submits multipart form data using the CFHTTP tag, including a file, to a remote API hosted by a vendor and when running on Lucee, I get back a 400 Bad Request error. I did some traffic sniffing and I think the issue is that Lucee is not providing the “boundary” attribute on the Content-Type HTTP header. From what I’m reading, this is a required attribute.

Working Example from ACF:

POST / HTTP/1.1
Authorization: Bearer
Accept: application/json
Content-Type: multipart/form-data; boundary=-----------------------------7d0d117230764
User-Agent: ColdFusion
Content-Length: 557129
Host:
Connection: Keep-Alive
Accept-Encoding: gzip,deflate

-------------------------------7d0d117230764
Content-Disposition: form-data; name=“input_type”
Content-Type: text/plain; charset=UTF-8

csv

-------------------------------7d0d117230764
Content-Disposition: form-data; name=“input_data”; filename=“/path/to/file.csv”
Content-Type: text/csv

Non-Working Example from Lucee:

POST / HTTP/1.1
Authorization: Bearer
Content-Type: multipart/form-data
Accept: application/json
TE: deflate;q=0
Accept-Encoding: deflate;q=0
User-Agent: Lucee (CFML Engine)
Content-Length: 557150
Host:
Connection: Keep-Alive

–x12S0ZbWDkrVi5GKakMD0wEdwcMtVePp
Content-Disposition: form-data; name=“input_type”
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

csv

–x12S0ZbWDkrVi5GKakMD0wEdwcMtVePp
Content-Disposition: form-data; name=“input_data”; filename=“file.csv”
Content-Type: text/csv
Content-Transfer-Encoding: binary

Ok after working on this for days, I figured out the issue 5 minutes after posting this :person_facepalming:

The original code had this header set:
CFHttpParam( Type="Header" , Name="Content-Type" , Value="multipart/form-data" ) ;

Commenting that out allowed Lucee to put the correct boundary value in the header field.

1 Like