title: Read Request Payload in ColdFusion
body: <p>Trying out Content Security Policy and using the Report Only method and the data is sending a POST (See edits, supposed to be POST, but Request Headers say GET) to my page which I then use to email myself. In the browser developer tools I can see the data in the Request Payload, but I don't know how to access this scope. The <code>FORM</code> scope is empty and the <code>GetHttpRequestData()</code> doesn't show a <code>Payload</code> key. </p>
  
  <p>How do I access the data in the Request Payload in ColdFusion?</p>
  
  <p><strong>EDIT:</strong> In the dev tools I can see in the network tab a POST to the page with 4 sections: <code>General</code>, <code>Response Headers</code>, <code>Request Headers</code> and <code>Request Payload</code>. I need to access the <code>Request Payload</code> data.</p>
  
  <p><strong>Request Headers:</strong></p>
  
  <pre><code>GET /campuses/content-report/ HTTP/1.1
  Host: domain.com
  Connection: keep-alive
  User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.130 Safari/537.36
  Accept: */*
  Referer: http://domain.com/page/
  Accept-Encoding: gzip, deflate, sdch
  Accept-Language: en-US,en;q=0.8
  Cookie: **[Removed]**
  </code></pre>
  
  <p><strong>Request Payload:</strong></p>
  
  <pre><code>{
     "csp-report":{
        "document-uri":"http://domain.com/page/",
        "referrer":"http://domain.com/",
        "violated-directive":"default-src 'self' 'sha256-L2Tc50iUaBz2udc-dnkwO-FKzrsl5cLnzkFu5LgX5ao=' https://stats.g.doubleclick.net http://netdna.bootstrapcdn.com http://www.google-analytics.com https://www.google.com https://fonts.gstatic.com https://ajax.googleapis.com https://cdn.jsdelivr.net https://maxcdn.bootstrapcdn.com http://www.etutoring.org",
        "effective-directive":"img-src",
        "original-policy":"default-src 'self' 'sha256-L2Tc50iUaBz2udc-dnkwO-FKzrsl5cLnzkFu5LgX5ao=' https://stats.g.doubleclick.net http://netdna.bootstrapcdn.com http://www.google-analytics.com https://www.google.com https://fonts.gstatic.com https://ajax.googleapis.com https://cdn.jsdelivr.net https://maxcdn.bootstrapcdn.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com;script-src 'self' https://www.google-analytics.com https://ajax.googleapis.com https://cdn.jsdelivr.net 'nonce-3E89EBDB49F712C7D90D1B39E348BBBF';report-uri /campuses/content-report;",
        "blocked-uri":"https://www.google-analytics.com",
        "status-code":200
     }
  }
  </code></pre>
  
  <p><code>GetHttpRequestData</code> contains Request Headers but not Request Payload. I did notice that the website I read said the Security policy would send the data via POST but the Headers say GET. Would that cause the issue? Should they be in the <code>URL</code> scope? Not at my machine at the moment.</p>