ColdFusion Tips & Tricks

Not able to run vbscript using cfexecute on Windows 64 bit Machine - Solution

2014-08-31T01:21:00.003-07:00

Goal: To run VBScript using CFexecute using command base script Cscript.exe

Environment: ColdFusion 10, Windows7 , 64 bit Machine.

My VB Script(Excel.vbs) performs simple office automation .

So first I tried with command line to run Excel.VBS.

C:\Windows\System32 > cscript //nologo D:\Excel.vbs D:\test.xls

and got expected o/p Success (Good my Excel VBS is correct)

Now, I have to see whether CF runs correctly or not.
So I use cfexecute to run Excel.VBS.

<cfexecute name = "C:\Windows\System32\CScript.exe"
            arguments = "//NoLogo D:\Excel.vbs D:\test.xls"
            variable = "savedOutput"
            timeout = "3600">
</cfexecute>
<cfdump var="#savedOutput#">

But, I got this error message -

Error: 424 Source: Microsoft VBScript runtime error Description: Object required

Then what is wrong with ColdFusion, same VBScript is running using command line but CFExecute throws error.

So I tried two things :

Checked whether account which runs ColdFusion is having admin rights or not?

Yes CF running with Admin privilege.

Tried using batch file
batchFile.bat :
@echo off
pushd %~dp0
cscript cscript //nologo D:\Excel.vbs D:\test.xls

<cfexecute name = "D:\batchFile.bat"
                   variable = "savedOutput"
                   arguments="/C /Q"
                   timeout = "3600">
</cfexecute>
<cfdump var="#savedOutput#">

Same Error: 424 Source: Microsoft VBScript runtime error Description: Object required

So what will be the solution for this ?
After checking some threads on office automation I found this solution.

We have to add the Desktop folder in the systemprofile and system32 folder to open file by Excel if you have Windows Service or IIS on Windows 7 x64 (dev machine) and Server 2008 x64.

So I added Desktop folder under these 2 directories -
C:\Windows\System32\config\systemprofile
C:\Windows\SysWOW64\config\systemprofile

O/P: Now my cfexecute code gives success and VBScript performs desired office operation.

Also, verify that ColdFusion is allowed to "Interact with Desktop" is enabled or not on Services.

Note: If you are doing office automation then you have to add the Desktop folder inside systemProfile irrelevant of technology you are using under above Environments.

Hope it helps you :)

POI Compatibility Issues with ColdFusion

2014-08-29T22:20:00.002-07:00

In this post I will discuss with Issues coming with the latest POI 3.10 in ColdFusion 9/10..

Recently I worked on Import/Export features of Excel documents in my project. Moreover, this excel documents are too much complex with Multiple trigger and rich with Macros.

In result, I faced lots of Issue in reading such files and faced n no of errors with POI.

Let's discuss How ColdFusion reads excel sheets ?

What is POI ?
- POI is open source java library used to read Microsoft documents.

Why POI in ColdFusion ?
- ColdFusion ships with POI to read Excel sheets. CF also ships with Open Office, by default excel read/manipulation handle by POI. If you want to use Open Office then Configure local/remote Open Office directories under CF Admin. ColdFusion 10 comes with POI 3.6 jar files.

POI jar files present under lib directory of ColdFusion: (Below jar files comes up with POI 3.10)

dom4j-1.6.1.jar
poi.jar
poi-ooxml.jar
poi-ooxml-schemas.jar
poi-scratchpad.jar
stax-api-1.0.1.jar
xmlbeans-2.6.0.jar

Now let's discuss some errors which I have got while reading those XLS/XLSX files using ColdFusion 10.

Some Errors while reading those XLS/XLSX files with ColdFusion 9/10 using inbuilt tags/function available in ColdFusion :

(with XLS) java.lang.NullPointerException at org.apache.poi.hssf.model.LinkTable.getExternalBookAndSheetName
(with XLS)Duplicate PageSettingsBlock record (sid=0x89c)
(with XLS) Unexpected celltype (5)

This error may comes when you have some dirty data or cell value starting with #.
But everything fine in my case.

(with XLS) coldfusion.excel.ExcelProcessException: An exception occurred while using action=read. NullPointerExceptioN.

There was nothing wrong in my cfspreadhseet syntax

(with XLSX) The supplied POIFSFileSystem does not contain a BIFF8 'Workbook' entry. Is it really an excel file?

Some of the XLSX files are failing

(with XLSX) The Supplied spreadsheet seems to be encrypted .xlsx file. It must be decrypted before use by HSSF

What I have tried so far with inbuilt Tags/Function available in CF : Sucess/Failure ?

As all issues are pointing towards POI issue. So I download the latest version of POI 3.10 and extracted all jar files and put it under \lib directory.

Success: 6/5 issues with 100% success rate with XLS solved using updated POI except encrypted error coming up with some XLSX file.

Adverse effects (Failures):

Formatting rows/columns/cells of Excel Sheets with styles like fonts and color are not working and throw an error "Java: no Method error with fonts and color".

Cause: ColdFusion expecting Font.getCharSet to return a byte, while the latest version of POI returns an int. Stackoverflow thread

Some of the XLSX file which was easily readable using POI 3.6 is now unreadable and through

"org.openxmlformats.schemas.spreadsheetml.x2006.main.CTWorksheet.getColsList()Ljava/util/List
java.lang.NoSuchMethodError"

In the next post I will discuss some workaround for it.

Mach-II Framework - Basic beginner start.

2014-08-15T14:18:00.001-07:00

My journey towards learning Mach-II framework

Few days back, I have added post regarding CF frameworks.
In this post we are going to understand what Mach-II is and what this beautiful framework provides.

There is already a superb Github directory from where you can learn Mach-II.
This post will help you to get familiar with some basics of Mach-II and early hurdles you face if you are a beginner.

Below points will cover whatever I've learned so far in Mach-II.

Let's begin: -
What Mach-II is ?

MVC framework for ColdFusion

Benifit of MVC : Separation of codes into different layers which help to reuse and organize your code better using the Model(mainly CFCs), View(shows your content) and Controller(which link Model and Views)
In Mach-II controller comprises of plugins,listeners and filters

Object Oriented F/W
Event Driven Framework
mach-ii.xml where all configuration needs to be done.

XML contains : Properties, Events, Listeners, Page Views, Filters, Plugins

II stands for Implicit Invocation

As Mach-II is an event driven framework, so all events are handled though event handlers which in turn announced a component for which event is registered.
Know More here Implicit-Invocation-Architectures in MVC

Easy to maintain and provide flexibility in developing robust application.

How to setup Mach-II ?

First download Mach-II f/w code and skeleton from
MachII Github or Mach-II home
A basic folder structure which I kept up while learning Mach-II
Once code downloaded, now we have to run mach-II application based on where you kept our framework files and skeleton files.
If you are keeping f/w files outside web root, then we have to add a mapping in CF administrator. You can also extend Mach-II f/w codes to setup your mach-ii f/w environment.
Here is the link which shows you various ways to setup your mach-ii application
Above Image shows my application folder comprises of both f/w codes + skeleton.

I pointed this directory as a Virtual Directory in my IIS and named as "mach2test"
Now we need to open /config/ mach-II.xml. In property applicationRoot we have to specify the root of our application.
<property name="applicationRoot" value="/mach2test" />
Now, once we have added value for applicationRoot, we have to add mapping or inherit f/w codes using extends attribute.
So for this I have added "MachII.mach-ii" in application.cfc to inherit mach-ii.cfc
<cfcomponent displayname="learnMach-ii" output="false" extends="MachII.mach-ii">
Now code setup is over, you are ready to run your first o/p in the browser.
http://localhost/mach2test/index.cfm. If you have downloaded Mach-II skeleton then first o/p will be Hello Mach-II!

Flow of Mach-II Application:

All Mach-II request flows from index.cfm because it follows pattern called Front Controlerl

Wiki: It provides a centralized entry point for handling requests.

As Mach-II is event driven in nature, so everything goes on by calling an event which creates event objects. Let's look for one example to get a clear Idea on Mach-II flow.
Say for example: If you have a basic login page in your application

URL : http://localhost/mach2test/index.cfm?event=login. So first request goes to central page index.cfm and start looking for Mach-II.xml
As we are calling an event called login (If we don't specify any eventParameter then defaultEvent will execute) so It will look for event-handers where an event is login
Now event handler told to open a view called login.cfm.
In login.cfm - we have one form whose action calls "index.cfm?event=checkLogin"
Now, once again flows go to Mach-II.xml and look for checkLogin event. checkLogin event handler calls listener loginListener which looks for validateLogin method present under loginComponent CFC which resides under the model.
validateLogin() return success/failure and announces an event loginSucess and shows home.cfm or loginFailure which shows error message.

Hope you get a basic flow of Mach-II framework.
I am still driving deeper into Mach-II framework, hope I will be coming with some more post related to Mach-II soon.

Happy Learning :)

ColdFusion Frameworks - Which one to choose ?

2014-08-03T12:21:00.001-07:00

Someone asks me a few days back regarding Skill set of ColdFusion frameworks -

Conversation Starts.

Anonymous - Do you know any of the CF frameworks like Mach-II ?
Me - No, I have not worked with any of them in my project so far, but I am having some Idea about MVC frameworks.

Anonymous: Ok, good. So how long It will take you to learn Mach-II framework ?
Me: Probably x days to get acquainted with all stuffs in it.
Anonymous: Ok, tx.

Conversation ends.

I am not great fan of Frameworks yet.

Yes, I heard that Frameworks do make developer's life easy and you can do some stuffs very easily by writing a few lines of code rather than a bunch of plain codes.

Once I attended Seminar on FuseBox framework months back. Holy crap that was too much of fuses and circuits drama.
To just add a Login Functionality. We have to take care of too many settings.

So, what to do now ?
Lot's of question coming to my mind.

After lot's of reading and searches, I thought that It's the best time to learn some frameworks not because someone asking me to learn but I found interesting after seeing this "Sunsetting Mach-II".
Even if the core developers move out from Mach-II but still Mach-II and FuseBox are most popular CF frameworks.

Frameworks available for ColdFusion
1. Mach-II - one of the first Object Oriented ColdFusion frameworks.
2. FuseBox
3. ColdBox
4. Cold Spring
5. Model-Glue
6. F/W 1
7. CF wheels
*There may be much more of it.

So, I am going to take Mach-II as my first CF framework which will be added to my skill set then FuseBox.

What I want from these frameworks -
1. Easy to Use
2. Rapid Development
3. Good Community Support

Let's Begin ..

isapi_redirect 500 Internal Server Error

2014-05-09T11:25:00.000-07:00

Today I was Installing Dev Version of ColdFusion Splendor in my Machine.
I completed CF 11 Installation successfuly but when I try to run CFM code then I got this strange error.

500 Internal Server Error -

I was not aware of such kind of error in past so
What is isapi_redirect DLL ?
What is the need of isapi_redirect DLL in running .cfm page?

Here comes the Answer -

As we know IIS is an External Web server and It tends to process HTML content and Tomcat/Jrun is Built In web server which in turns execute Java and JSP applications.

As we know ColdFusion is built on top of Java EE so we need some one to run those Javabyte codes and that is why we need Tomcat/Jrun.

So, here isapi_redirect is Middle guy which send your request from IIS to Tomcat. In technical term, It is a Plugin which helps IIS to send servlet/JSP request to Tomcat to process any client request.

So, now solve our Main Issue - 500 Internal Server (Check above screenshot showing error message )

Steps to Follow to solve it -
> Open ISAPI Filters in IIS
> Right Click/ Click Action "Add"
> Give any filter name say "CFIASPI" and under Executable Text box give path of your isapi_redirect DLL present under #root#\config\wsconfig\1\isapi_redirect.dll
> Now restart IIS once
> Load your CFM page, Issue solved

If issue not solved even after adding required DLL under ISAPI.
-- Check web.xml under your project folder and see for any reference of ISAPI present or not.
Above scenario may only happen when you have CF 10 already Installed and due to mismatch in handler mapping It cause to read wrong path of ISAPI DLL.
-- If found in web.xml check config setting for ISAPI. Validate its path.

If you still facing any issue, Please share. It is also new to me.
Hope it may help :)

How to Secure your ColdFusion Server

2014-05-08T05:03:00.001-07:00

Take a look on My Seminar Video -

ColdFusion Security: How to Secure your ColdFusion Server

Check Seminar Slides here
Hope it may help you.

Securing ColdFusion Server - Seminar Response

2014-05-02T07:21:00.002-07:00

Here is my Feedback Summary of Seminar which I have given last week - How to Secure your ColdFusion Server

Quick Look on Seminar Slides: http://shamcf.blogspot.in/2014/05/coldfusion-security-how-to-secure-your.html

Thanks all for your useful responses.
Check Slide here
Check Video here

Hope you all have taken preventive measures to secure your ColdFusion Server.

ColdFusion Security - How to Secure your ColdFusion Server

2014-05-02T05:17:00.002-07:00

Recently I have given Seminar on ColdFusion Security - How to Secure your ColdFusion Server in company Level

In seminar I discussed about recent CF vulnerabilities, how CF server can be hacked, how we can prevent such attacks by securing our CF server etc

Here is my slide - Please look into it.

Cold fusion Security-How to Secure Coldfusion Server from Mindfire Solutions

Video Presentation here
Hope it may help you :)

Cookies : setDomainCookies Funda

2014-05-01T08:29:00.004-07:00

All knows what setDomainCookies does.
If not Please revisit "setDomainCookies Used to set CFID and CFTOKEN cookies for a domain (not just a host) ". and generally we use to set it as false always.

I faced real time problem in my Application few days back.
We create multiple websites through single Applications, Hosted with different domains.

The issue was here:
Let's say we have 2 different websites altogether.
Named as
1. shamRealty.indiatimes.com
2. kasleRealty.indiatimes.com

The problem was when you open shamRealty.indiatimes.com and on another tab kasleRealty.indiatimes.com.
kasleRealty websites show same content of shamRealty.
More simple way: you have open Google.com in one tab and then opened Facebook in another tab, facebook.com opens with google page in it.
Weird right ?

I thought this might be some IIS related Issue, but once I clear my browser cookie/cache. Issue was not reproducible.

I start looking into Cookie assignment and found this:
CFID and CFTOKEN was generating twice in website
one for
shamRealty.indiatimes.com (CFID:2313, CFTOKEN:234124)
and one for
.indiatimes.com (CFID:23412 , CFTOKEN:345435)

These give us a hint that why domain specific CFID/CFTOKEN is generating.
We start Looking into Application Level settings and found that by mistake we have enabled setDomainCookies to true.

Funda : Don't enable setDomainCookies to true until your application is not running in Clustered Environment because If CFID and CFToken variable combinations already exist on each host in the cluster, ColdFusion migrates the host-level variables on each cluster member to the single, common domain-level variable.
source - Adobe

So we have turned off setDomainCookies and Issue was solved.
Hope it may help

ColdFusion Splendor - Released (Finger Crossed)

2014-04-29T22:38:00.002-07:00

ColdFusion Splendor released yesterday

http://blogs.coldfusion.com/post.cfm/announcing-the-launch-for-coldfusion-11-and-coldfusion-builder-3

Hope this will not be like a CF 10 with lots of bugs all around.

If product is like CF 10 (not 10.0.1 ..) then seriously we have to look around ColdFusion Road Map.

Also please give CF world a time and timespan between 2 product release. Hope you understand what I am telling about.

Finger Crossed, Hope CF Splendor will be Awesome Product for Adobe.
Right now, lets accept it and be Pride of CF

Welcome <cfSplendor>

ColdFusion Security Statistics Report 2014 - My look

2014-04-26T12:31:00.000-07:00

2014 Website Security Statistics Report released few days back which gives brief Info about security issues related to all web technologies.

Here are few points and some care which we need to take:

1. ColdFusion 5th most widely used languages.
2. But the main Point in the report which brings me sad is "10.59% of ColdFusion sites had at least one SQL Injection vulnerability, the highest among all Programming Languages"

Who is responsible ?

Yes, we developers who are not writing secure CFML code to stop SQL Injection Vulnerabilities.
Not using QueryParam is not at all accepted in CF World.

Writing a Parametrized Query can stop most of SQL Injection Vulnerabilities. Please follow it.

3. XSS (46%), SQL Injection(11%) and Information Leakage(24%) Vulnerabilities are major concerns.

Hope we will write Secure CFML code and protect our ColdFusion Sever to prevent such vulnerabilities in future.

How ColdFusion Server was allowing to Install IIS malware which Steals data

2014-04-24T10:39:00.001-07:00

I was preparing for my company Level seminar on ColdFusion Security this week and gone through numerous blog and slides to learn about recent ColdFusion attacks.

The one which brings me more Interest is IIS Malware attack.

What is it ?
How IIS malware injected in your server ?

Lot's of questions to be asked but the reason for such attack was CF Backdoor Vulnerability.

Yes, If you keep your Door open some one will come and steal some data from your Server.
Here Door terms your ColdFusion Server.

Lets check this IIS Malware Injection through flow chart.


Flow Chart of IIS Malware Injection though CF Backdoor Vulnerability

CF vulnerability allowing to create a Web Shell (A Web shell is a type of Remote Access Tool (RAT) or backdoor Trojan file) in server which in turns execute DLL and adds that module in IIS.

Injected DLL was capturing the post request for specific page example paymentProcess.cfm (Installer added this page during installing DLL) and writing POST parameters info in some log file.

Specifically design DLL was also undetectable by modern Anti-Virus.
Even SSL can't stop this. As it captures data after SSL post is decrypted by the server.

It says that how much Imp was to read ColdFusion Lock Down guide. If you have locked your server then well and good. If not then check lock down guides and lock your server soon.

If you are not aware of CF lock down guide please visit :
http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf10/cf10-lockdown-guide.pdf

I will be coming with next blog which will contain detail recent CF Vulnerabilities.

Hope it may help

Get Active threads / Kill any specific Thread using CF Admin API.

2014-04-13T09:43:00.002-07:00

As we know we can create threads using <cfthread> tag.
We can run, join or terminate a thread but lets say we have a real world scenario and we want to show all CF threads in our web Application which are running and do all operations though web App.

So for this we have to get Metadata Info for all threads.

In my Last post we have discussed about how we can access CF Administrative APIs.
So to achieve this we are going to use CF Admin API using servermonitoring.cfc.
You can also visit Server Monitoring in ColdFusion Administrator and see those threads and Manage it.

getActiveThreadsRunning() will return all metadata info of Threads which are running currently like ThreadName, TimeTaken,CFStrackTrace etc.

Let’s move on to see how we can Kill any thread.
You may get into situation where any threads are running for longer period of time and because of that other process are waiting in queue:

We can call abortCFThread() present under servermonitoring.cfc to achieve this.

Hope it will help you.
Happy Coding :)

ColdFusion Administrative API: An OverView

2014-04-13T09:26:00.001-07:00

Most of the times or generally we use to do Admin level settings via going to CF Admin Page
But we can also change admin Level settings through code base using CF Admin APIs
Say for example Login in CF admin, adding a datasource or to see how many threads are running in our CF server.

All these can be achieved through Admin APIs which perform all CF Administrative work.

ColdFusion Provides reach Admin API located under CF directory (<CF Directory>\cfusion\wwwroot\CFIDE\adminapi).

There are almost 18 Components in total present in CF 10
CF11(Splendor: Beta Version) adds one more which is document.cfc.

Most of the CF Administrative work we can achieve it using these admin CFCs.

Above Image shows a list of Admin APIs present in CF splendor.

As all CF admin APIs are encrypted but we can check list of methods available under each CFC by calling them.
Let’s say we have to see what are the methods present under adminsitrator.cfc

use: http://coldfusion10/CFIDE/adminapi/administrator.cfc
enter your RDS password and you can check the methods available under administrator.cfc.

To call any CF admin APIs, you have to first Log in to CF administrator:
So first we have to create objects for those CFC and call it:
So, walk over to all the Admin APIs and get familiar with It.

Hope it will help you.
Happy Coding :)

Get Recent Tweets using Twitter REST API v1.1 by ColdFusion - Part 2

2013-08-13T07:16:00.001-07:00

Let's start where we left in Part 1. In this post our main Goal will be to create Dynamic Oath Header for authorizing an API request. We already created Oath Header using shamApp Application and get our latest tweet but this is not our permanent solution .

To create Oath Header we need
1. Oath Settings - which we created using Twitter Application
2. Time Stamp - when we create our oath request.
3. Oath Nonce - create using 32 byte random alphanumeric characters.
4. Oath Signature - create using HMAC-SHA1 encryption with Signing Key and Signature Based String (Secret Message).
5. Oath Creation - using above 4
6. HTTP request to User Time Line API to get latest Tweets.

Declare your Oath Settings values first:

Now Create Time Stamp and Oath nonce:
Note: We can also create Timestamp using now() function too but I suggest you to first convert into GMT format time and then to epoch time.

Now lets move to create Signing Key and Signing base string(Message) using Percent Encoding which will be used to create Oath Signature using HMAC-SHA1 Encryption.

So our Signature Key and Signature base string(secret message) is ready. Lets pass these two to our function called HmacSHA1 encryption to get Oath Signature.
"There is no MAC function Included in CF 9 but CF 10 provides HMAC function to achieve this. So Let's do it in CF 9 using MAC and Secret Key class provided by JAVA to achieve it"

So our Final step is to create Oath Header and send this Oath Header via HTTP request to User Timeline API to get our latest tweet post.

This HTTP request will give our recent tweeter posts along with lots of details associated with it in JSON format.
To see our Twitter post we have to first deserialise this JSON response.

So we get our final o/p of latest Tweets posted by user. So now you can display latest tweet in web pages. This is same result which we got from shamApp application in part1

Goal Achieved :)

Useful Links:

https://apigee.com/console/twitter (Major API console to debug )

http://quonos.nl/oauthTester/ (Signature Testing for Twitter)

https://dev.twitter.com/docs/auth/authorizing-request (Twitter Oath request)

https://dev.twitter.com/docs/auth/creating-signature(Create Signature)

http://en.wikipedia.org/wiki/Hash-based_message_authentication_code(HMAC wiki)

http://docs.oracle.com/javase/7/docs/api/javax/crypto/Mac.html (mac class provided by JAVA)
http://docs.oracle.com/javase/7/docs/api/javax/crypto/spec/SecretKeySpec.html (secretkey class provided by JAVA)

Hope it will help you.
Happy Tweet :)

Get Recent Tweets using Twitter REST API v1.1 by ColdFusion - Part 1

2013-08-13T04:41:00.000-07:00

Recently Twitter Published API V 1.1 in June 2013.
Twitter has made lots of changes in it to increase security Level to prevent malicious use of the Twitter API. New API requires authentication on every API endpoint, that means every request to the API will be authenticated. Most Important they have dropped XML, Atom, and RSS support and only functional with JSON support.
To know more about API v1.1. Please visit https://dev.twitter.com/docs/api/1.1/overview

In one of my Project I was showing Latest Twitter Post using RSS feed.
In June my client noticed that her Twitter Post are not displaying. In result I checked my code and found that.
RSS Feed URL:https://api.twitter.com/1/statuses/user_timeline.rss?screen_name=shamtwit
through an error "The Twitter REST API v1 is no longer active. "
This situation results me to explore API V 1.1 and to write this Blog.

So, let's start. As we discuss earlier new API V 1.1 needs Oath Authentication and will be fulfilled by creating an application in Twitter Account.

1. Go to https://dev.twitter.com/apps, login with your twitter account.
2. Click on "Create a New Application button". Fill necessary details. (Website Field is must but we are not going to use as a source to create tweets for our application. Just add any local URL).

3.We have created our Application "shamApp" with Consumer Key and Consumer Secret.
Now create your Access Token and Access Token Secret.

4. Your access Token is created now. Points to be noted here
     a. Select HTTP method as GET
     b. Select Request URL as User Time Line https://api.twitter.com/1.1/statuses/user_timeline.json
   c. It is necessary to pass screen_name or user_id when requesting user timeline API.
   d. You can also pass number of tweet to be retrieved by passing value in "count"
     e. Before Generating oauth Token, Please verify your settings.
   Please visit this Page for more overview https://dev.twitter.com/docs/api/1.1/get/statuses/user_timeline

6. Oath Signature is created now (Valid for few minutes). Let's review two imp results
     Signature based String : This will be used to create Oath Signature using HMAC-SHA1
   encryption which in-turn help us to create our Oath Header.
     Oath Header : Oath Header will be used to pass authorization request to User Time line API to get
     recent tweet posted by user.
   To explore more on Authorization, Please visit : https://dev.twitter.com/docs/auth/authorizing-request

Above 6 steps finishes our Application Setup Creation, You just need to note down your Oath Settings to create Signature Based String, Oath Signature and Oath Header. Lets Check whether Oath Header created by mySham Application able to get latest twitter post or not by posting HTTP request to User Timeline API.

User Time Line API: https://api.twitter.com/1.1/statuses/user_timeline.json

HTTP Method: GET

HTTP Parameters: Count,user_id,Oath Header(created above)

Note: Be careful to give these parameters correct. If its wrong then Unauthorized access may come.

Let's see response Header of this HTTP request

So our HTTP request to User Time Line is success with Status 200 OK.

Lets see what we get in File Content.

<cfoutput>#cfhttp.fileContent#</cfoutput>

You can see our data in JSON format. We have to Deserialize this JSON format to see our tweet post.

<cfloop from = 1 to = #arraylen(DeserializeJSON(cfhttp.fileContent))# index = "i">
<cfoutput>
Twit: #DeserializeJSON(cfhttp.fileContent)[i].text#
</cfoutput> <br/>
</cfloop>

Here is our o/p shown above which shows latest 2 Tweets which I posted from my Twitter Account.

Not only you can get Latest Tweet from User Timeline but It also contains lot of Information like Date creation, Hash tags, comments etc..

Q: Can we use this Response Header created by shamApp to get latest tweets every time we make request to UserTimeLine API ?

Answer is No. (When you run same code after an hr. It will show an error "Time Stamp Out of Bound")

When you check Response Header you will see Oath_nonce,oath_TimeStamp and Oath_Signature which are not present while creating Application Settings. These 3 makes API v 1.1 more secure as these values are not same on each request. Oath_nonce(random 32 bytes of random data), Oath_TimeStamp(Timstamp value when request was created) and Oath_Signature (Created using HMAC-SHA1 encryption by passing Signature base string and Signature Key) are dynamic and It combines with some other oath settings to make Oath Header.

So we have to do all this process though code base to achieve this.

Let's move on to my next Blog where we crate dynamic Oath Header for each request to be passed to get Latest Tweet