PSA: Facebook App ColdFusion Showstopper

I am in the R&D stages of building a Facebook application for my employer (DealerPeak). I just spent hours trying to figure out why I couldn't get my tab page to show up when being loaded by Facebook. I was getting the following error:

FBML Error (line 20): illegal tag "body" under "fb:tab-position"

FBML Error (line 35): illegal tag "body" under "fb:tab-position"

URLExceptionInvalid scheme for url (javascript:history.back())

I was hitting my tab file directly and it was just one small string "Hello tab". It didn't make sense that it would have "body" in it at all. I searched the internets high and low for that error and all the results seemed to be about 404s or error pages. I didn't think that was my issue because I was logging every request to my tab page and I could see the log updated every time I clicked the tab. So, clearly Facebook was calling my ColdFusion page.

Finally, our CTO asked me what the errors in the Application log were. This is what I found:

So, finally I had something else to google. After googling "Form entries are incomplete or invalid", I found this post by Ray Camden. It explains exactly what is wrong. There is an ancient feature in ColdFusion that is on by default that does server side form validation based on a naming convention. Facebook calls your tab page as a POST with a field called "FB_SIG_TIME". And that "_TIME" causes ColdFusion Server to try and validate that field. Said validation fails and shows a rediculous validation error page and stops execution.

There are multiple solutions in Ray's article and the comments. But, if you are on CF9, the solution is to simply turn the useless validation feature off in your Application.cfm via the new "serverSideFormValidation" attribute.