From 59f8451ab6ac4e10ea4f5aff50fe58e4a5e167e4 Mon Sep 17 00:00:00 2001
From: "Dan G. Switzer, II" <dswitzer@pengoworks.com>
Date: Fri, 29 Aug 2025 10:29:09 -0400
Subject: [PATCH 1/2] Added new exposeTaffyHeaders to determine if Taffy debug
 HTTP response headers should be written

---
 box.json              |  2 +-
 core/api.cfc          | 42 +++++++++++++++++++++++++++---------------
 docs/@next.md         | 22 ++++++++++++++++++++++
 package.json          |  2 +-
 tests/Application.cfc |  1 +
 5 files changed, 52 insertions(+), 17 deletions(-)

diff --git a/box.json b/box.json
index 70d6877c..8cf5204b 100644
--- a/box.json
+++ b/box.json
@@ -3,7 +3,7 @@
     "shortDescription":"REST Web Service framework for ColdFusion and Lucee",
     "slug":"taffy",
     "author":"Adam Tuttle",
-    "version":"3.7.0",
+    "version":"3.8.0",
     "homepage":"https://taffy.io/",
     "documentation":"https://docs.taffy.io/",
     "type":"mvc",
diff --git a/core/api.cfc b/core/api.cfc
index 70510359..d7ae3a4f 100644
--- a/core/api.cfc
+++ b/core/api.cfc
@@ -65,7 +65,7 @@
 		<cfset setupFramework() />
 		<cfset checkEngineSupport() />
 		<cfset after = getTickCount() />
-		<cfheader name="X-TIME-TO-RELOAD" value="#(after-before)#" />
+		<cfset addTaffyHeader("X-TIME-TO-RELOAD", after-before) />
 		<cfreturn true />
 	</cffunction>
 
@@ -431,19 +431,19 @@
 		<cfheader name="ALLOW" value="#local.allowVerbs#" />
 
 		<!--- metrics headers that should always apply --->
-		<cfheader name="X-TIME-IN-PARSE" value="#m.parseTime#" />
-		<cfheader name="X-TIME-IN-ONTAFFYREQUEST" value="#m.otrTime#" />
+		<cfset addTaffyHeader("X-TIME-IN-PARSE", m.parseTime) />
+		<cfset addTaffyHeader("X-TIME-IN-ONTAFFYREQUEST", m.otrTime) />
 		<cfif structKeyExists(m, "resourceTime")>
-			<cfheader name="X-TIME-IN-RESOURCE" value="#m.resourceTime#" />
+			<cfset addTaffyHeader("X-TIME-IN-RESOURCE", m.resourceTime) />
 		</cfif>
 		<cfif structKeyExists(m, "cacheCheckTime")>
-			<cfheader name="X-TIME-IN-CACHE-CHECK" value="#m.cacheCheckTime#" />
+			<cfset addTaffyHeader("X-TIME-IN-CACHE-CHECK", m.cacheCheckTime) />
 		</cfif>
 		<cfif structKeyExists(m, "cacheGetTime")>
-			<cfheader name="X-TIME-IN-CACHE-GET" value="#m.cacheGetTime#" />
+			<cfset addTaffyHeader("X-TIME-IN-CACHE-GET", m.cacheGetTime) />
 		</cfif>
 		<cfif structKeyExists(m, "cacheSaveTime")>
-			<cfheader name="X-TIME-IN-CACHE-SAVE" value="#m.cacheSaveTime#" />
+			<cfset addTaffyHeader("X-TIME-IN-CACHE-SAVE", m.cacheSaveTime) />
 		</cfif>
 
 		<cfif application._taffy.settings.exposeHeaders>
@@ -478,7 +478,7 @@
 				/>
 				<cfset _taffyRequest.metrics.afterSerialize = getTickCount() />
 				<cfset m.serializeTime = m.afterSerialize - m.beforeSerialize />
-				<cfheader name="X-TIME-IN-SERIALIZE" value="#m.serializeTime#" />
+				<cfset addTaffyHeader("X-TIME-IN-SERIALIZE", m.serializeTime) />
 
 				<!--- apply jsonp wrapper if requested --->
 				<cfif structKeyExists(_taffyRequest, "jsonpCallback")>
@@ -514,7 +514,7 @@
 				<cfif structKeyExists(m, "resourceTime")>
 					<cfset m.taffyTime -= m.resourceTime />
 				</cfif>
-				<cfheader name="X-TIME-IN-TAFFY" value="#m.taffyTime#" />
+				<cfset addTaffyHeader("X-TIME-IN-TAFFY", m.taffyTime) />
 
 				<cfcontent reset="true" type="#application._taffy.settings.mimeExtensions[_taffyRequest.returnMimeExt]#; charset=utf-8" />
 				<cfif _taffyRequest.resultSerialized neq ('"' & '"')>
@@ -528,19 +528,19 @@
 			<cfelseif _taffyRequest.resultType eq "filename">
 				<cfset m.done = getTickCount() />
 				<cfset m.taffyTime = m.done - m.init - m.parseTime - m.otrTime - m.resourceTime />
-				<cfheader name="X-TIME-IN-TAFFY" value="#m.taffyTime#" />
+				<cfset addTaffyHeader("X-TIME-IN-TAFFY", m.taffyTime) />
 				<cfcontent reset="true" file="#_taffyRequest.result.getFileName()#" type="#_taffyRequest.result.getFileMime()#" deletefile="#_taffyRequest.result.getDeleteFile()#" />
 
 			<cfelseif _taffyRequest.resultType eq "filedata">
 				<cfset m.done = getTickCount() />
 				<cfset m.taffyTime = m.done - m.init - m.parseTime - m.otrTime - m.resourceTime />
-				<cfheader name="X-TIME-IN-TAFFY" value="#m.taffyTime#" />
+				<cfset addTaffyHeader("X-TIME-IN-TAFFY", m.taffyTime) />
 				<cfcontent reset="true" variable="#_taffyRequest.result.getFileData()#" type="#_taffyRequest.result.getFileMime()#" />
 
 			<cfelseif _taffyRequest.resultType eq "imagedata">
 				<cfset m.done = getTickCount() />
 				<cfset m.taffyTime = m.done - m.init - m.parseTime - m.otrTime - m.resourceTime />
-				<cfheader name="X-TIME-IN-TAFFY" value="#m.taffyTime#" />
+				<cfset addTaffyHeader("X-TIME-IN-TAFFY", m.taffyTime) />
 				<cfcontent reset="true" variable="#_taffyRequest.result.getImageData()#" type="#_taffyRequest.result.getFileMime()#" />
 
 			</cfif>
@@ -571,7 +571,7 @@
 			,_taffyRequest.statusArgs.statusCode
 			) />
 		<cfset m.otreTime = getTickCount() - m.beforeOnTaffyRequestEnd />
-		<cfheader name="X-TIME-IN-ONTAFFYREQUESTEND" value="#m.otreTime#" />
+		<cfset addTaffyHeader("X-TIME-IN-ONTAFFYREQUESTEND", m.otreTime) />
 
 		<cfif len(trim(local.resultSerialized))>
 			<cfoutput>#local.resultSerialized#</cfoutput>
@@ -607,10 +607,9 @@
 	<cffunction name="setupFramework" access="private" output="false" returntype="void">
 		<cfset var local = structNew() />
 		<cfparam name="variables.framework" default="#structNew()#" />
-		<cfheader name="X-TAFFY-RELOADED" value="true" />
 		<cfset request.taffyReloaded = true />
 		<cfset local._taffy = structNew() />
-		<cfset local._taffy.version = "3.7.0" />
+		<cfset local._taffy.version = "3.8.0" />
 		<cfset local._taffy.endpoints = structNew() />
 		<!--- default settings --->
 		<cfset local.defaultConfig = structNew() />
@@ -638,6 +637,7 @@
 		<cfset local.defaultConfig.exposeHeaders = false />
 		<cfset local.defaultConfig.jsonp = false />
 		<cfset local.defaultConfig.noDataSends204NoContent = false />
+		<cfset local.defaultConfig.exposeTaffyHeaders = true />
 		<cfset local.defaultConfig.globalHeaders = structNew() />
 		<cfset local.defaultConfig.mimeTypes = structNew() />
 		<cfset local.defaultConfig.returnExceptionsAsJson = true />
@@ -717,6 +717,9 @@
 		<cfset local._taffy.contentTypes = getSupportedContentTypes(local._taffy.settings.deserializer) />
 		<!--- hot-swap! --->
 		<cfset application._taffy = local._taffy />
+
+		<!--- we must write the header *after* we have initialized our settings --->
+		<cfset addTaffyHeader("X-TAFFY-RELOADED", true) />
 	</cffunction>
 
 	<cffunction name="parseRequest" access="private" output="false" returnType="struct">
@@ -1538,4 +1541,13 @@
 
 	</cffunction>
 
+	<cffunction name="addTaffyHeader">
+		<cfargument name="name" type="string" required="true" />
+		<cfargument name="value" type="string" required="true" />
+
+		<cfif application._taffy.settings.exposeTaffyHeaders>
+			<cfheader name="#arguments.name#" value="#arguments.value#" />
+		</cfif>
+	</cffunction>
+
 </cfcomponent>
diff --git a/docs/@next.md b/docs/@next.md
index c46b1e04..23d69649 100644
--- a/docs/@next.md
+++ b/docs/@next.md
@@ -396,6 +396,7 @@ variables.framework = {
 
 	unhandledPaths = "/flex2gateway",
 	allowCrossDomain = false,
+	exposeTaffyHeaders = true,
 	globalHeaders = structNew(),
 	debugKey = "debug",
 
@@ -575,6 +576,27 @@ variables.framework.allowCrossDomain =
   "http://example.com; http://foo.bar, http://google.com";
 ```
 
+#### exposeTaffyHeaders
+
+**Available in:** Taffy 3.8+<br/>
+**Type:** Boolean<br/>
+**Default:** true<br/>
+**Description:** Determines if the standard Taffy debug HTTP response headers should be included with each request. The Taffy debug headers are:
+
+* `X-TAFFY-RELOADED` — Determines if the Taffy configuration was reloaded on the request.
+* `X-TIME-TO-RELOAD` — The time it took for Taffy to initialize.
+* `X-TIME-IN-PARSE` — The time it took to parse the response.
+* `X-TIME-IN-ONTAFFYREQUEST` — The time spent in the `onTaffyRequest` method.
+* `X-TIME-IN-RESOURCE` — The time spent executing the requested resource.
+* `X-TIME-IN-CACHE-CHECK` — The time spent checking for a cached response. 
+* `X-TIME-IN-CACHE-GET` — The time spent to retrieve a cached response.
+* `X-TIME-IN-CACHE-SAVE` — The time spent to save a cached response.
+* `X-TIME-IN-SERIALIZE` — The time spent serializing the response.
+* `X-TIME-IN-TAFFY` — The time spent executing the Taffy internals.
+* `X-TIME-IN-ONTAFFYREQUESTEND` — The time spent in the `onTaffyRequestEnd` method.
+
+Setting this to `false` will prevent these response headers from being written to the HTTP stream.
+
 #### globalHeaders
 
 **Available in:** Taffy 1.2+<br/>
diff --git a/package.json b/package.json
index 9fabc4d6..1add0b95 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
 	"name": "cfml-taffy",
-	"version": "3.7.0",
+	"version": "3.8.0",
 	"author": "Adam Tuttle <adamtuttlecodes@gmail.com>",
 	"license": "MIT",
 	"homepage": "https://taffy.io",
diff --git a/tests/Application.cfc b/tests/Application.cfc
index 3d493d87..33785dd8 100644
--- a/tests/Application.cfc
+++ b/tests/Application.cfc
@@ -29,6 +29,7 @@
 		variables.framework.globalHeaders = {};
 		variables.framework.globalHeaders["x-foo-globalheader"] = "snafu";
 		variables.framework.exposeHeaders = true;
+		variables.framework.exposeTaffyHeaders = true;
 
 		variables.framework.environments = {};
 		variables.framework.environments.test = {};

From 34088325efe32cb54ad3c868212734d724d9adf6 Mon Sep 17 00:00:00 2001
From: "Dan G. Switzer, II" <dswitzer@pengoworks.com>
Date: Fri, 29 Aug 2025 10:40:52 -0400
Subject: [PATCH 2/2] Fixed "response" to "request"

---
 docs/@next.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/@next.md b/docs/@next.md
index 23d69649..926ab35d 100644
--- a/docs/@next.md
+++ b/docs/@next.md
@@ -585,7 +585,7 @@ variables.framework.allowCrossDomain =
 
 * `X-TAFFY-RELOADED` — Determines if the Taffy configuration was reloaded on the request.
 * `X-TIME-TO-RELOAD` — The time it took for Taffy to initialize.
-* `X-TIME-IN-PARSE` — The time it took to parse the response.
+* `X-TIME-IN-PARSE` — The time it took to parse the request.
 * `X-TIME-IN-ONTAFFYREQUEST` — The time spent in the `onTaffyRequest` method.
 * `X-TIME-IN-RESOURCE` — The time spent executing the requested resource.
 * `X-TIME-IN-CACHE-CHECK` — The time spent checking for a cached response.