I spent most of Friday morning with a strange ColdFusion and XML issue. A number of customers reported that a flash application we run was hanging on the loading screen. The flash accepts a XML file created by ColdFusion. The flash application appeared to be working in FireFox and Chrome but not in good old IE! The plot thickens, when the request was made on port 80 and not SSL the flash worked in IE and the load was successful.

The problem got even more strange, some IE users were successfully loading the flash. The only difference between the two IE users where some had installed a set of IE updates (xml did not load) and the other had not (xml worked, flash loaded).

Google provided the answer, Mark Speck with flex and Dan G. Switzer seemed to have a similar issue in a blog post they both made. Their solution was setting a Cache-Control header in the XML that was being generated.

<!---// send the headers //--->
<cfheader name="Content-type" value="text/xml" />
<!---// this is required so IE will load the XML over SSL //--->
<cfheader name="Cache-Control" value="no-store, must-revalidate" />
<cfheader name="Pragma" value="public" />
<cfheader name="Expires" value="-1" />
<cfcontent reset="true" />
<xml>
    <goes />
    <here />
</xml>

I still don't know why user pre the security updates did not get the flash loading header, however the fix seemed to work by setting a "Cache-Control" header to true.