CGI Environment Variables

When a browser makes a request to a server, environment variables are created by the Web server and by the browser. In ColdFusion, these variables are referred to as CGI environment variables and they use the "CGI" prefix (even if your server uses a server API instead of CGI to communicate with the ColdFusion Server).

Environment variables contain data about the transaction between the browser and the server, such as the IP Address, browser type, and authenticated username. You can reference CGI environment variables for a given page request anywhere in the page. CGI variables are read-only.

Note

The environment variables available to your applications depend on the browser and server software.

Testing for CGI variables

Because all CGI variables are not supported by all browsers, ColdFusion always returns TRUE when testing for the existence of a CGI variable, even if the variable is not supported by the client browser. To work around this, test for an empty string to determine if the CGI variable is available.

<cfif CGI.varname IS NOT "">

  CGI variable exists

<cfelse>

  CGI variable does not exist

</cfif>

CGI server variables

The following table describes common CGI environment variables created by a server (not all of these will be available with every server):

CGI Server Variable

Description

SERVER_SOFTWARE
Name and version of the information server software answering the request (and running the gateway). Format: name/version.

SERVER_NAME
Server's hostname, DNS alias, or IP address as it appears in self-referencing URLs.

GATEWAY_INTERFACE
Revision of the CGI specification with which this server complies. Format: CGI/revision.

SERVER_PROTOCOL
Name and revision of the information protocol this request came in with. Format: protocol/revision.

SERVER_PORT
Port number to which the request was sent.

REQUEST_METHOD
Method with which the request was made. For HTTP, this is Get, Head, Post, and so on.

PATH_INFO
Extra path information, as given by the client. Scripts can be accessed by their virtual pathname, followed by extra information at the end of this path. The extra information is sent as PATH_INFO.

PATH_TRANSLATED
Translated version of PATH_INFO after any virtual-to-physical mapping.

SCRIPT_NAME
Virtual path to the script being executed; used for self-referencing URLs.

QUERY_STRING
Query information that follows the ? in the URL that referenced this script.

REMOTE_HOST
Hostname making the request. If the server does not have this information, it sets REMOTE_ADDR and does not set REMOTE_HOST.

REMOTE_ADDR
IP address of the remote host making the request.

AUTH_TYPE
If the server supports user authentication, and the script is protected, the protocol-specific authentication method used to validate the user.

REMOTE_USER
AUTH_USER
If the server supports user authentication, and the script is protected, the username the user has authenticated as. (Also available as AUTH_USER.)

REMOTE_IDENT
If the HTTP server supports RFC 931 identification, this variable is set to the remote username retrieved from the server. Use this variable for logging only.

CONTENT_TYPE
For queries that have attached information, such as HTTP POST and PUT, this is the content type of the data.

CONTENT_LENGTH
Length of the content as given by the client.

CGI Server Variable	Description
SERVER_SOFTWARE	Name and version of the information server software answering the request (and running the gateway). Format: name/version.
SERVER_NAME	Server's hostname, DNS alias, or IP address as it appears in self-referencing URLs.
GATEWAY_INTERFACE	Revision of the CGI specification with which this server complies. Format: CGI/revision.
SERVER_PROTOCOL	Name and revision of the information protocol this request came in with. Format: protocol/revision.
SERVER_PORT	Port number to which the request was sent.
REQUEST_METHOD	Method with which the request was made. For HTTP, this is Get, Head, Post, and so on.
PATH_INFO	Extra path information, as given by the client. Scripts can be accessed by their virtual pathname, followed by extra information at the end of this path. The extra information is sent as PATH_INFO.
PATH_TRANSLATED	Translated version of PATH_INFO after any virtual-to-physical mapping.
SCRIPT_NAME	Virtual path to the script being executed; used for self-referencing URLs.
QUERY_STRING	Query information that follows the ? in the URL that referenced this script.
REMOTE_HOST	Hostname making the request. If the server does not have this information, it sets REMOTE_ADDR and does not set REMOTE_HOST.
REMOTE_ADDR	IP address of the remote host making the request.
AUTH_TYPE	If the server supports user authentication, and the script is protected, the protocol-specific authentication method used to validate the user.
REMOTE_USER AUTH_USER	If the server supports user authentication, and the script is protected, the username the user has authenticated as. (Also available as AUTH_USER.)
REMOTE_IDENT	If the HTTP server supports RFC 931 identification, this variable is set to the remote username retrieved from the server. Use this variable for logging only.
CONTENT_TYPE	For queries that have attached information, such as HTTP POST and PUT, this is the content type of the data.
CONTENT_LENGTH	Length of the content as given by the client.

CGI client variables

The following table describes common CGI environment variables that are created by the browser and passed in the request header:

CGI Client Variable

Description

HTTP_REFERER
The referring document that linked to or submitted form data.

HTTP_USER_AGENT
The browser that the client is currently using to send the request. Format: software/version library/version.

HTTP_IF_MODIFIED_SINCE
The last time the page was modified. The browser determines whether to set this variable, usually in response to the server having sent the LAST_MODIFIED HTTP header. It can be used to take advantage of browser-side caching.

CGI Client Variable	Description
HTTP_REFERER	The referring document that linked to or submitted form data.
HTTP_USER_AGENT	The browser that the client is currently using to send the request. Format: software/version library/version.
HTTP_IF_MODIFIED_SINCE	The last time the page was modified. The browser determines whether to set this variable, usually in response to the server having sent the LAST_MODIFIED HTTP header. It can be used to take advantage of browser-side caching.

CGI client certificate variables

ColdFusion makes available the following client certificate data. These variables are available when running Microsoft IIS 4.0 or Netscape Enterprise under SSL if your Web server is configured to accept client certificates.

CGI Client Certificate Variable

Description

CERT_SUBJECT
Client-specific information provided by the web server. This data typically includes the client's name, e-mail address, etc. For example:
O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "www.verisign.com/repository/RPA Incorp. by Ref.,LIAB.LTD(c)98", OU = Persona Not Validated, OU = Digital ID Class 1 - Microsoft, CN = Matthew Lund, E = mlund@macromedia.com

CERT_ISSUER
Information about the authority that provided the client certificate. For example:
O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "www.verisign.com/repository/RPA Incorp. By Ref.,LIAB.LTD(c)98", CN = VeriSign Class 1 CA Individual Subscriber-Persona Not Validated

CLIENT_CERT_ENCODED
The entire client certificate binary, base-64 encoded. This data is typically of interest to developers integrating with other software that uses client certificates.

CFML Reference
ColdFusion Expressions: Operands, Operators and Other Constructs

CGI Client Certificate Variable	Description
CERT_SUBJECT	Client-specific information provided by the web server. This data typically includes the client's name, e-mail address, etc. For example: O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "www.verisign.com/repository/RPA Incorp. by Ref.,LIAB.LTD(c)98", OU = Persona Not Validated, OU = Digital ID Class 1 - Microsoft, CN = Matthew Lund, E = mlund@macromedia.com
CERT_ISSUER	Information about the authority that provided the client certificate. For example: O = "VeriSign, Inc.", OU = VeriSign Trust Network, OU = "www.verisign.com/repository/RPA Incorp. By Ref.,LIAB.LTD(c)98", CN = VeriSign Class 1 CA Individual Subscriber-Persona Not Validated
CLIENT_CERT_ENCODED	The entire client certificate binary, base-64 encoded. This data is typically of interest to developers integrating with other software that uses client certificates.