http HEAD returning content body

[Noodles]

Using win2k and win2003 (IIS5 and IIS6) and CFMX6.1. I've just noticed when you
send a request to the server like this:

HEAD /file.cfm HTTP/1.1
Host: [url]www.mysitename.com[/url]

It returns the header and the content body. Whereas if I just do something
like:

HEAD /imagefile.gif HTTP/1.1
Host: [url]www.mysitename.com[/url]

It returns just the header (as is expected).

So it seems to be something wrong with coldfusion, rather than IIS. Is this a
bug/feature of cold fusion or is there something I can do in the config?

[BKBK]

How do you make the request? When I use the cfhttp tag it works for cfm files
as expected:

<cfhttp url="http://127.0.0.1:8500/index.cfm" method="head" throwOnError="Yes">
<cfdump var="#CFHTTP#">
<cfhttp url="http://127.0.0.1:8500/xmas_tree.gif" method="head"
throwOnError="Yes">
<cfdump var="#CFHTTP#">

[Noodles]

I'm making the request using a telnet like program.

When I make the request using cfhttp it seems to work fine, but that doesn't help me

[MikerRoo]

Try setting the headers like a polite client:

Accept-Encoding, Connection, Host, TE, User-Agent.

[Noodles]

I've tried setting all those headers (with exception to TE as I don't know what
that is) and others, but the result is the same.

It looks to me to be a bug in CFMX6.1 as it's not just my server affected.
I've tried a CFMX7 server (namely the macromedia.com server) and it doesn't
have this problem.

[Telemedianer]

are you sure this is not the webserver doing this ? for example it's normal for
apache to treat head requests like get requests. it's up to the client to use
the body part or throw it away, the response header in HEAD and GET should be
(by RFC) exactly the same.

have you tried to do the same on a plain ascii or html file (you are comparing
a cf request -> ascii to a image request -> binary).

Cheers,
-S

[Noodles]

I think you need to brush up on your RFC's, according to RFC2616, section 9:

The HEAD method is identical to GET except that the server MUST NOT return a
message-body in the response.

So it looks like CFMX6.1 is breaking RFC's by returning the message body.

I have tried the same process with a .txt file and it works fine, just seems
to be pages parsed by cold fusion.

[Noodles]

Not only does it break RFC's, by returning the whole page it's using up
bandwidth that need not be used.

Google may even be punishing sites that do this, as google and other search
engines use HEAD to check if the page exists and if it has been changed since
they were last spidered.

[MikerRoo]

Maybe you're right.
My CF7 servers respond correctly to the telnet clients I've tried.