i've seen this error pop up over the years, and never got anywhere with it. i've tried so many things from various other forums that i've honestly lost track. So figured i'd try asking a refined question.

Right now, we are running Coldfusion 2023 with the latest updates (as of February 16, 2025)

The most recent error i got was using an HTTP_User_Agent "Custom-AsyncHttpClient" which posted a Query_String of "request=/hello.world&%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"

now, when i run this exact same query string, i get an expected result, i get forwarded to a new page using a 301 redirect, and i have not been able to replicate the Java error, which returns the coldfusion message "Cannot create a session after the response has been committed"

The funny thing is, the "Stack Trace" is empty, just the message and type, and a CGI dump doesn't give much more than what i listed.

now, as an overview, i've tracked this down to a few lines of code.

first, our web.config does a rewrite "action type="Rewrite" url="urlResolve.cfm?request={URL}" to handle virtual directories as we call them

then our processing file, which has all the necessary processing, runs. but, as far as i can tell, the following lines are where it's getting the error.

<cfset variables.originalRequest = url.request>
<CFIF right(url.request,'1') NEQ '/' AND FindNoCase('index.cfm',url.request) EQ 0>
    <!---<cflocation url="#url.request#/" statuscode="301" addtoken="no">--->
    <CFIF right(url.request,'1') NEQ '/'>
        <cfset url.request = url.request & '/'>
        <cflocation url="#url.request#" statuscode="301" addtoken="no">
    </CFIF>
</CFIF>

We have our systems setup to have a trailing "/" for all requests, hence the 301 redirect.

obviously once it tries to process the redirect, it catches the problems and responds accordingly. But in this case, it's not getting that far.

now, we have been running on the assumption that bots are behind this, and that they are just requesting the pages, but closing the connection before anything can be returned, as nothing has been compromised and no other errors have been detected.

BUT, it is frustrating us to the nth degree, and we are hoping we can find a more viable solution.

any advice would be GREATLY appreciated at this point.

Thanks