One of the biggest change in ColdFusion 10 is the replacement of underlying application server i.e JRun with Tomcat. There have been a lot of questions and discussions on Tomcat in ColdFusion 10 on various forums and blogs and I will try to address some of them in this post.

Is the inbuilt server in ColdFusion 10 a modified version of Tomcat? If yes, what are the changes and why?

Yes, the in-built server in ColdFusion 10 is a modified version of Tomcat. When we started out, we didn’t envision making any changes in Tomcat, but soon we realized that people would need seamless experience when they move from ColdFusion 9 or a previous version to ColdFusion 10. That meant that the directory structure, the features, connector experience - all need to be as close to previous versions (JRun as inbuilt server) as possible. Some of the important changes that we had to make in Tomcat are

  1. The directory structure - When you install Tomcat separately, its directory structure would be quite different from the directory structure that ColdFusion has. We have ensured that people don’t find themselves in a completely unfamiliar installation structure. So the launcher that launches ColdFusion (actually Tomcat), the way you configure the JVM for Tomcat (jvm.config), the default wwwroot, the directory structure for the entire installation etc. are almost identical to any previous ColdFusion installation. 
  2. SES URL support : Tomcat does not support SES (Search Engine Safe) urls out of the box. Since a lot of ColdFusion customers are used to this kind of URL in their application, this was a very important change required in Tomcat.
  3. Web server connectors : Tomcat does come with connectors for webservers like IIS/Apache, however it has far less features as compared to the JRun connector. We have tried to bridge the gap as far as possible so that you, as a user of ColdFusion, do not lose the features that you have been using. Some of the changes we had to make for connector are
    • Multiple webroot support : Tomcat serves the files only from its application root. That means that the only way for Tomcat to serve the files from IIS/Apache webroot is to configure IIS/Apache webroot as the Tomcat's application root. But that way, it will not serve any file from Tomcat's webroot. ColdFusion always had these two decoupled and supported both the webroots at the same time. So we made changes in Tomcat to retain the old behavior. In fact ColdFusion falls back to its wwwroot for searching a file if it can't be found by IIS/Apache.
    • CGI scope variables : A lot of CGI scope variables were not available with original Tomcat connector because the Tomcat connector did not had any way to query the webserver. We made changes to ensure that your application does not break.
  4. ColdFusion session replication in cluster : If one is not using sticky session in a cluster, it is extremely important to have session replication to ensure that your application works smoothly in a cluster. We had to make some changes in Tomcat to enable the replication of ColdFusion session because of certain classloading issues.

Does that mean that ColdFusion will not run and will not be supported on a standard Tomcat installation?

ColdFusion will definitely run and will be supported on standard Tomcat installation like any other JEE server deployment. As ColdFusion's support on any other JEE server, the deployment will use the inbuilt web server of Tomcat and therefore the 3rd point listed above about web server connectors will not come into play at all. You can definitely use the web server connector provided by Tomcat but like any other JEE server support, since ColdFusion does not provide the connector, we will not be able to provide any support if there are any issues with the connector.

OK.. but, SES URL is still an issue with plain Vanilla Tomcat, right? Yes and No. By default, Tomcat does not allow the SES URL the way JRun  or other JEE servers do. Below is a snippet from the web.xml and as you can see, we have defined the URL pattern as "*.cfm/*" and "*.cfc/*".

    <servlet-mapping id="coldfusion_mapping_7">
    <servlet-mapping id="coldfusion_mapping_8">

However, in Tomcat, to get SES URL to work, you would need to put the exact URL till .cfm/.cfc in the web.xml like the snippet below 

    <servlet-mapping id="mapping1">
    <servlet-mapping id="mapping2">
    <servlet-mapping id="mapping3">
    <servlet-mapping id="mapping3">

You get the idea.. I know that’s a little painful to add all the URLs of your application in the web.xml but that’s the way to go if you want to use SES URL in plain vanilla Tomcat.

Can I deploy my own application (war/ear) on an instance created by instance Manager?

Unfortunately no. The directory structure change also meant that in the ColdFusion standalone installation, one would not be able to deploy any other application (ear/war). This is how the standalone installations of earlier versions of ColdFusion used to behave as well. 

The multi-server installation of ColdFusion 9 and earlier used to lay down plain app server and then deploy ColdFusion as one of the application. This allowed you to install any other application (ear/war) as well on any instance. However, with ColdFusion 10, when you create an instance from the instance manager, it is a replication of the main default instance of standalone installation and therefore you cant deploy any other application (war/ear) on any instance. 

That’s all good, but how do I upgrade the in-built Tomcat, in case Tomcat comes out with a critical fix or a security fix?

Well, ColdFusion 10 now has an amazing delivery mechanism with hotfix notification and installer. We will use the same infrastructure to keep the Tomcat engine updated. CF-Tomcat update should be available soon after Tomcat comes out with any critical fix. We will also make the same available for you to download and use.

I hope I have covered most of the questions that you all have raised. Now let the comments pour in!

58 Comments to “What’s the deal with Tomcat in ColdFusion 10?”

  1. Kevin
    I have a dedicated server with CF9 installed. There are 10 or so websites on the server. Will I easily be able to upgrade to 10 or could there be code that doesn't work with the change to Tomcat? I obviously don't want to go and update several websites just to upgrade. Thanks!
  2. Rupesh
    There are absolutely no backward compatibility issues because of tomcat. So you should not face any issues while upgrading from ColdFusion 9.
  3. snake
    excellent stuff, something Railo never managed to achieve.
  4. Seth
    @Snake, what are you referring to? Railo runs on Tomcat 7 out of the box and has for quite some time.
  5. snake
    Seth, read the article, it does more than just run on tomcat
  6. Seth
    @Snake, Railo supports SES out of the box, I'm not sure what else is the take-away here. Railo has had an automated hotfix installer and has for some years. I'm not a Railo fan boy, I use both Railo and ACF depending on the project (particularly the budget). I'm asking what is it that you are referring in this article that Railo never managed?
  7. Snake
    Seth, read section 3.... AFAIK Railo still does not do this.
  8. Josh Knutson
    Please include the jakarta fix so users can have their coldfusion users connect to ms sql databases with Windows Authentication.
  9. Jordan
    @snake The mod_cfml project addresses the features in section 3, and is usable by any CFML engine.
  10. Mike Collins
    Good Article. I like the CF-Tomcat approach that is arriving soon.
  11. Rupesh
    @Josh, we haven't seen any issues with connecting to mssql db with windows authentication. and I am wondering what role could tomcat play in this. can you give us some more details?
  12. snake
    Jordan, yes I have seen the mod_cfml project, it does the job I guess, but its rather a CLUDGE solution of 3 different components plus Perl is required, I think Coldfusion wins this one.
  13. Isaac
    @Rupesh, I work with Josh. In the past we've been able to alter the logon credentials for the windows service and take advantage of integrated authentication to our named SQL instances. It was only after integrating the jTDS driver I was able to regain this functionality - at the expense of "applicationIntent" property for the connectionstring. We even tried the MS JDBC driver to no avail.
  14. Jordan
    First it doesn't exist, now it's a CLUDGE solution. Classy. It's been a pleasure dispelling your FUD. FWIW, I agree with you on one point. ACF10 is awesome. However...

    "The wise speak only of what they know, Gríma son of Gálmód. A witless worm have you become. Therefore be silent, and keep your forked tongue behind your teeth. I have not passed through fire and death to bandy crooked words with a serving-man"
  15. Mike Collins
    This was added with the 3.5 drivers for MS Sql.

    You mention TDS, are you using Sybase? CF9?
  16. Damien
    I know that ColdFusion adds support for WebSocket. Which library does it use underhood. Does it use the WebSocket implementation in latest Tomcat.
  17. Rupesh
    @Damien, we have written the complete implementation of websocket ourselves. Tomcat has only added the websocket implementation in its latest release that came out last month.
  18. Damien
    Thanks for replying Rupesh and congrats on ColdFusion 10 release!! Is there any performance stats that you have that tells me that ColdFusion 10 is X times faster than its predecessor. I have a client who is looking to upgrade. But yeah not sure how pricing would affect him.
  19. Will
    I am curious as to what changes you had to make in Tomcat to get the session replication working. I've read both the Tomcat documentation and the ColdFusion 10 documentation regarding session replication and can not get it to work. All of the configurations per the Tomcat documentation are in place as far as I can tell.
  20. Rupesh
    @Will, there were some classloading issues regarding the session replication for which we had to make change in the Tomcat source.

    Are you saying that you are not able to get session replicated on ColdFusion 10 cluster? Is that standalone ColdFusion with its in-built tomcat server?
  21. Rupesh
    Thanks a lot. We don't have any stats as such which can tell 'X' because the performance varies for each application. From what we have seen and heard from our customers, ColdFusion 10 on Tomcat is quite fast as compared to its predecessors.
  22. Will
    Nope, it doesn't seem to want to work for me. sessionmanagement is enabled in application.cfm. I have one page that creates a session variable (session.var), outputs the Server.ColdFusion.Rootdir so I can see what instance is being used, and a link that takes you to the "check" page. The check page checks for session.var being set and also outputs the Rootdir for a second verification of the instance being used. Once I create the session and test the variable, I restart the instance, refresh the check page and whether I end up using the same instance or the other instance in the cluster the variable is no longer set. I've even output the session ID value and it changes each time. I am using the ColdFusion 10 Beta release with Developer license, not sure if either of those would cause issue with replication, with two clustered instances configured with equal failover and sticky sessions enabled. Just haven't gotten around to downloading and installing the official release yet. And no adjustments to Tomcat have been made.
  23. John
    Are there any more specifics on point 3 regarding which CGI variables will not be available with plain old tomcat deployments?
  24. Kavya
    @Will :

    If its possible can you share me your code and the detailed setup with the steps that you are following? This would help us to identify what's going wrong.
  25. Rupesh
    you can send it to kamaiya at adobe
  26. Will
    @Rupesh & @Kavya
    Thanks, I sent an email to Kamaiya. Hopefully you can shine some light on what I am missing.
  27. Kavya
    Hi Will,

    I think the particular problem you were facing regarding session replication is solved with the official build. Let me know if you have any more concerns.
  28. Brett
    The cfg 'redirect' variables like 'redirect_url' are not being passed through on a 404 redirect using the Apache errorDocument directive. I believe Tomcat is either wiping them out or not passing them through to the application. I proved this by changing the redirect to a php script that simply dumped out the available cgi variables.

    The problem has been logged in the CF10 bugbase but there is no indication of whether this will be fixed. Without a fix I am not able to deploy CF10 or even use it in development.

    Can you provide any insight into this issue and whether it will be addressed, soon!?!
  29. Rupesh
    Thanks Brett for reporting this bug. We will investigate this and let you know how it goes.
  30. Mark
    Will NTLM ever work with CF? A bug/feature request made 4 years ago was flagged as "not enough time" ( and then a similar request for CF10 was closed as a duplicate of 3035879 (

    Another bug logged for a similar request ( has been marked as "ToDefer".

    Will this issue ever be addressed?
  31. Brett
    I've just found another difference between CF10 and previous versions and that is the handling of multiple form elements with the same name - like a set of checkbox options. Previously these would be passed through to CF as a simple comma delimited string but in CF10 they appear to be passed as an array.

    Can anybody else confirm this behaviour?


  32. Rupesh
    @Brett, We have identified the reason for the redirect issue that you had mentioned earlier and we will make the fix available soon.
    Regarding the change in behavior for form fields with same name, the change can only be seen if the application sets the flag sameformfieldsasarray to true. This flag is false by default. Since your old application would not have this flag, it can not break any existing application. If it is, could you please provide a simple test case which can prove it.
  33. Rupesh
    @Mark, We have this bug on our radar. however, lets keep the comments focused around Tomcat for this post.
  34. Brett
    Thanks Rupesh.

    I have some more information... This only happens if you process the form within application.cfm (it is a legacy system, I haven't tested using application.cfc). We run the 'blocker.cfm' script from within application,cfm to catch SQL injection hacks and it is trying to read the content of the form.

    I've put together an example here: with code available.

    Thanks again.

  35. Rupesh
    Thanks a lot Brett. I think we were missing the case you mentioned. We will look into this.
  36. Brett
    I found a simple fix to the form problem...

    use enctype="multipart/form-data" in the form attributes and all is good...

  37. Mat
    I would like some clarification if you could on the deployment of applications (ear/war) on an instance created by instance manager. We have LCDS applications that we deployed to the root and those got deployed by JRUN on starting the CF instance. I have been able to get those apps deployed by copying them in the runtime/ folder but from what I understand, this is not supported???? How are we to deploy those apps then? I haven't been able to find any documentation on a "recommended" option.
    Also, is there any update regarding relasing CF-Tomcat as a separate download? I don't see it under
  38. Gabriel
    Subscribing to get more info about CF-Tomcat
  39. Gary
    I see that the CF Administrator for CF 10 still has the JVM configuration settings page:

    How exactly does this work with Tomcat?
  40. Snake
    in exactly the same way as it worked with cf6/7/8/9.
    Tomcat is a java servlet container just as JRUN was, it still needs a JVM to run.
  41. Gary
    Thank you Snake - I missed that above. I guess it's effectively just a better jrun.
  42. Kirk
    Is there any documentation on resolving the classloading issue so that I can use Native Tomcat with session replication?
  43. Rob C.
    There seems to be a discrepancy between this statement:

    "ColdFusion will definitely run and will be supported on standard Tomcat installation like any other JEE server deployment"

    and the official support matrix at:
  44. Markus
    One mayor issue that has stopped us from upgrading to CF10 so far is problems with symbolic links. I described the issue on Raymond Camden's blog (and I think in the official CF forums, though I cannot find nor remember where exactly):

    As long as CF still won't find CFCs or cfincluded templates on symlinked paths, upgrading is a no-go. I wonder if this issue will ever be resolved.

    Kind regards

  45. nginx guy
    more than a year after the post, does tomcat now support SES url's?
  46. Mike A.
    I cannot get *.jsp files to run within my CF 10 Enterprise standalone installation on Win2k8/IIS 7.5 server. I had to add the following snippet into my <cf-home>/cfusion/wwwroot/web.xml file:


    and a 404 error is returned when the hello.jsp file is clearly present in the file system. All of the CFM/CFC files are working fine. Any ideas or other files to check would be appreciated.

  47. Pat Branley
    Id like more info about CF-Tomcat

    Im trying to setup a base tomcat install now with a CF10 war and use the CF10 Connector, but I'm having issues. Is this a supported way to install CF10 ?
  48. Scott Pell
    What is the status of this intention to deliver some flexibility for those of us who absolutely need to deploy Java WAR files?
    "We will make ColdFusion's modified version of Tomcat (let's call it CF-Tomcat) as well as the connectors available for you, so that you can use it like a standard Tomcat installation. This will allow you to take advantage of all the changes that we have made in Tomcat and at the same time, you can deploy any application on it the way you want. We are also exploring the option of open-sourcing the changes that we have made in Tomcat."
  49. sujith
    I've installed CF10 in my java hosting server (hosted in , however it is showing "500 internal server" errors while accessing JSP pages.
    Is it related with the server permissions or CF settings?
  50. Mark
    If I start ColdFusion 10 under Tomcat, I am no longer able to get Tomcat to shutdown gracefully. It appears that are a number of threads CF leaves dangling. This is causing a massive number of database connections to be left open to sql server in my development environment.
  51. Rupesh
    @Mark, do you mean you are deploying ColdFusion war on a standard Tomcat installation? or is it ColdFusion standalone intsallation? What is the error that you get when you try to shutdown Tomcat?
  52. Mark
    @Rupesh, I run the installer for CF10 to create a J2EE .war file. I explode that war file into my own installation of Tomcat 7.0.50. I start tomcat, cf loads up and works under my cfusion context. I place and edit my .cfm's and .cfc's directly inside the webapps/cfusion, and they work. Trying to gracefully stop tomcat however, doesn't work. I get several messages about coldfusion having created threadlocal date instances that don't get cleaned up properly, and then it hangs. It's the only thing deployed on this tomcat instance.

    Actually, if you want to get technical, I'm importing the exploded war into eclipse, where I edit my .cfm/.cfc's, and which deploys the whole thing automatically for me to tomcat setup through eclipse.

    But when I export the resulting .war and deploy it that way, I get the same result.
  53. Mark
    @Rupesh - I re-did my deployment with the latest installer, applied the mandatory update and chf13, and the issue appears to have resolved.
  54. Chris Bacigalupo
    Re: Getting cfusion.war to work on a pre-existing tomcat instance.

    I've deployed the cfusion.war on a pre-existing tomcat instance also hosting Liferay(6.1.x). Both are in the webapps directory. I had to work through some issues related to taglib in the web.xml of the deployed cfusion.war. But it finally deployed without errors. Now I have the issue that tomcat doesn't know what to do with a .cfm (causing the browser prompting for download of instead of rending it with coldfusion). I think I have to do some servlet mapping in the "main" /tomcat/conf/web.xml (not /webapps/cfusion/WEB-INF/web.xml)

    I've seen the few blogs, forum posts and other searchable information on this. It looks like CF10 can run fronted by Apache and using, but I can't do this as it will probably mess with the Liferay instance I'm using ( it's delivered with a vendor's portal product).

    Any thoughts on how to configure the pre-existing (not deployed with CF) tomcat instance web.xml to map to CF servlets in the deployed cfusion.war would be greatly appreciated.

    In looking at the SES URL information above, how might I create an entry in the web.xml of the deployed cfusion.war to map to the index.cfm of CFIDE/administrator?
  55. Sumit Verma
    Looks like CF 10 tomcat is still at version 7.0.23. Do you guys have an ETA on update? There has been lot of security updates and our internal scans are logging it as a critical vulnerability and recommending it should be upgraded to 7.0.50+
  56. snake
    I think it would be a good idea if Adobe documented how to upgrade Tomcat independently of CF so that security issues can be quickly plugged.
  57. Baci
    Conversly, how about the ability to deploy CF10 on an already running instance of Tomcat (not the one deployed in the install)
  58. Mark
    It looks like there's a regression somewhere. I've installed Hotfix 14 and 15, and the shutdown problem appeared again. This is on Apache Tomcat 7.0.59, jdk 1.8u40.

    In the webapps/cfusion/WEB-INF/cfusion/logs/server.log, I see:
    "Information","localhost-startStop-2","03/31/15","09:51:58",,"Pool Manager Started"
    "Information","localhost-startStop-2","03/31/15","09:51:58",,"ColdFusion stopped"

    And in my tomcat/logs/catalina.out, I see:
    Mar 31, 2015 9:51:58 AM org.apache.catalina.loader.WebappClassLoader checkThreadLocalMapForLeaks
    SEVERE: The web application [/cfusion] created a ThreadLocal with key of type [coldfusion.util.DateUtils$1] (value [coldfusion.util.DateUtils$1@7f553b4e]) and a value of type [java.util.GregorianCalendar] (value [java.util.GregorianCalendar[time=1427807433458,areFieldsSet=true,areAllFieldsSet=true,lenient=false,zone=sun.util.calendar.ZoneInfo[id="America/New_York",offset=-18000000,dstSavings=3600000,useDaylight=true,transitions=235,lastRule=java.util.SimpleTimeZone[id=America/New_York,offset=-18000000,dstSavings=3600000,useDaylight=true,startYear=0,startMode=3,startMonth=2,startDay=8,startDayOfWeek=1,startTime=7200000,startTimeMode=0,endMode=3,endMonth=10,endDay=1,endDayOfWeek=1,endTime=7200000,endTimeMode=0]],firstDayOfWeek=1,minimalDaysInFirstWeek=1,ERA=1,YEAR=2015,MONTH=2,WEEK_OF_YEAR=14,WEEK_OF_MONTH=5,DAY_OF_MONTH=31,DAY_OF_YEAR=90,DAY_OF_WEEK=3,DAY_OF_WEEK_IN_MONTH=5,AM_PM=0,HOUR=9,HOUR_OF_DAY=9,MINUTE=10,SECOND=33,MILLISECOND=458,ZONE_OFFSET=-18000000,DST_OFFSET=3600000]]) but failed to remove it when the web application was stopped. Threads are going to be renewed over time to try and avoid a probable memory leak.
    Mar 31, 2015 9:51:58 AM org.apache.coyote.AbstractProtocol stop
    INFO: Stopping ProtocolHandler ["http-bio-8080"]
    Mar 31, 2015 9:51:58 AM org.apache.coyote.AbstractProtocol stop
    INFO: Stopping ProtocolHandler ["ajp-bio-8009"]
    Mar 31, 2015 9:51:58 AM org.apache.coyote.AbstractProtocol destroy
    INFO: Destroying ProtocolHandler ["http-bio-8080"]
    Mar 31, 2015 9:51:58 AM org.apache.coyote.AbstractProtocol destroy
    INFO: Destroying ProtocolHandler ["ajp-bio-8009"]

    At that point it just hangs - I've waited for 20 minutes, and it just will not die - I have to stop the process.

Leave a Comment

Leave this field empty: