Re: HTTP2 with WebSockets

2019-02-06 Thread Jesse Schulman
I could add a second port but then I’d have to change how the load balancer works to add even more magic there than I already have... not sure http2 is worth that effort. On Wed, Feb 6, 2019 at 6:54 PM John Larsen wrote: > I am interested in this too. Basically we've had to set another port in >

Re: HTTP2 with WebSockets

2019-02-06 Thread John Larsen
I am interested in this too. Basically we've had to set another port in which the app can access tomcat for websockets directly. We've not been able to get this to work over httpd. John On Wed, Feb 6, 2019 at 5:32 PM Jesse Schulman wrote: > Is it possible for tomcat to run with HTTP2 and

Re: Tomcat patch management and patching best practices

2019-02-06 Thread John Larsen
Thats a really good question. We've simply replaced the entire tomcat installation and then rerun auto config. Be nice if apache provided patches. John On Wed, Feb 6, 2019 at 7:39 PM Murtaza Doctor wrote: > Dear Support, > > We request your help/advice for the Tomcat Patch Management. We

Tomcat patch management and patching best practices

2019-02-06 Thread Murtaza Doctor
Dear Support, We request your help/advice for the Tomcat Patch Management. We have installed Tomcat server to host an application which is internally used in our organisation. We donot have any current process/procedure to patch Tomcat. So we are looking for your advice on this. Please address

HTTP2 with WebSockets

2019-02-06 Thread Jesse Schulman
Is it possible for tomcat to run with HTTP2 and WebSockets on the same connector? I have tried configuring it myself and looked for examples without success. Thanks! Jesse

Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-06 Thread Mark Thomas
On 06/02/2019 17:21, James H. H. Lampert wrote: > Thanks. I do have some follow up questions > > On 2/6/19, 1:04 AM, Mark Thomas wrote: >> On the TLS Connector: >> >> sslEnabledProtocols="TLSv1.1,TLSv1.2" > > Ok. So the active connector we currently have for this particular > installation (which

response sent before request

2019-02-06 Thread Giuseppe Sacco
Hello, I have a tomcat 8.5.20 installation that handle many applications. When calling one of the URLs of a specific application, sometimes I get a 500 http error. Please note that this it does not happens always. The connector uses SSL, so I setup wireshark and decrypted the traffic. Finally I

Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-06 Thread James H. H. Lampert
Thanks. I do have some follow up questions On 2/6/19, 1:04 AM, Mark Thomas wrote: On the TLS Connector: sslEnabledProtocols="TLSv1.1,TLSv1.2" Ok. So the active connector we currently have for this particular installation (which has multiple IP addresses, hence the "address" clause) is:

Re: Number of tomcat downloads

2019-02-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Igal, On 2/5/19 14:59, Igal Sapir wrote: > Chris, > > On Tue, Feb 5, 2019 at 6:32 AM Christopher Schultz < > ch...@christopherschultz.net> wrote: > >> -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 >> >> Igal, >> >> On 2/4/19 23:52, Igal

Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark and James, On 2/6/19 04:04, Mark Thomas wrote: > On 05/02/2019 23:49, James H. H. Lampert wrote: >> We've just received word from a customer that they had two >> vulnerabilities flagged on a security scan of the box their >> Tomcat server is

Re: Receiving 403 with Tomcat 9, works with Tomcat 8

2019-02-06 Thread Mark Thomas
On 06/02/2019 12:48, Jörg Schaible wrote: > Hi Mark, > > Am Mittwoch, 6. Februar 2019, 11:45:46 CET schrieb Mark Thomas: >> Exact Tomcat 8 version? >> Exact Tomcat 9 version? >> >> How is CORS configured in your application? > > the VersionLoggerListener entries from the catalina.log files: > >

Re: Invalid URL characters via AJP

2019-02-06 Thread Mark Thomas
On 06/02/2019 14:05, George Stanchev wrote: > In light of recent changes around allowing and subsequent relaxation of the > invalid characters handling in TC, I just noticed that TC behind IIS (via JK > connector/AJP) happily accepts ";<> etc while the HTTP connector rejects > them. Is this how

Invalid URL characters via AJP

2019-02-06 Thread George Stanchev
In light of recent changes around allowing and subsequent relaxation of the invalid characters handling in TC, I just noticed that TC behind IIS (via JK connector/AJP) happily accepts ";<> etc while the HTTP connector rejects them. Is this how the AJP connector it is supposed to work? Is the

RE: loss of connection with mod_jk(tomcat connector)

2019-02-06 Thread Rathore, Rajendra
Hi Rainer, I am not much aware about JkShmFile but it was working fine with tomcat connector 1.2.43, is anything I need to setup for more loggers because even I am also not getting the actual problem. Thanks and Regards, Rajendra Rathore 9922701491 -Original Message- From: Rainer Jung

Re: loss of connection with mod_jk(tomcat connector)

2019-02-06 Thread Rainer Jung
Hi Rajendra, Am 06.02.2019 um 12:36 schrieb Rathore, Rajendra: Hi Mark, I am stuck and due to below issue unable to update to latest tomcat connector, can you please share your finding, let me know if you need anything from my side, I also raise issue

Re: Receiving 403 with Tomcat 9, works with Tomcat 8

2019-02-06 Thread Jörg Schaible
Hi Mark, Am Mittwoch, 6. Februar 2019, 11:45:46 CET schrieb Mark Thomas: > Exact Tomcat 8 version? > Exact Tomcat 9 version? > > How is CORS configured in your application? the VersionLoggerListener entries from the catalina.log files: this is the machine with Tomcat 8: == %<

RE: loss of connection with mod_jk(tomcat connector)

2019-02-06 Thread Rathore, Rajendra
Hi Mark, I am stuck and due to below issue unable to update to latest tomcat connector, can you please share your finding, let me know if you need anything from my side, I also raise issue https://bz.apache.org/bugzilla/show_bug.cgi?id=63075 but there is no progress on it. Thanks and Regards,

Re: Receiving 403 with Tomcat 9, works with Tomcat 8

2019-02-06 Thread Mark Thomas
Exact Tomcat 8 version? Exact Tomcat 9 version? How is CORS configured in your application? Mark On 06/02/2019 10:36, Jörg Schaible wrote: > Hi, > > we have a strange symptom after an upgrade from Tomcat 8 to Tomcat 9, because > we get a 403 for a call that works flawlessly with the previous

Receiving 403 with Tomcat 9, works with Tomcat 8

2019-02-06 Thread Jörg Schaible
Hi, we have a strange symptom after an upgrade from Tomcat 8 to Tomcat 9, because we get a 403 for a call that works flawlessly with the previous version. Let's describe the scenario: We have a customer with a Wordpress application hosted on an Apache server. Some pages perform XMLHttpRequests

Re: TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-06 Thread Mark Thomas
On 05/02/2019 23:49, James H. H. Lampert wrote: > We've just received word from a customer that they had two > vulnerabilities flagged on a security scan of the box their Tomcat > server is running on. > > 38628 - TLS 1.0 still supported. > Ok, assuming that the box and the JVM can go up to a