Re: Filter behaviour

2015-06-26 Thread André Warnier
Leo Donahue wrote: public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException Assuming you have only a single Filter configured in web.xml Assuming you have logic in a doFilter that checks the value of a boolean. If the

Forcing SSL Renotiation

2015-06-26 Thread Steffen Heil (Mailinglisten)
Hi My tomcat installation offers pages through https only. So when accessing these pages, an ssl connection is established. Later on, a user may decide to log in, hence hitting a page, that requires client certificates, and the browser pops up a selection dialog for a certificate. Once

Re: Forcing SSL Renotiation

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 George, On 6/26/15 10:04 AM, George Stanchev wrote: You didn't specify your Tomcat version. In Tomcat 7 or 8 or 9 we use the following code. Not sure if it will work on 6. For a long time until very recently we were stuck on 5.5 and the

Re: Forcing SSL Renotiation

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 George, On 6/26/15 12:34 PM, George Stanchev wrote: Agree on point 2 3. Since we are in control of the application server, we have the luxury of managing the SSL engine and the Security Manager settings. I guess I should've provided a link to

Re: Filter behaviour

2015-06-26 Thread Konstantin Kolinko
2015-06-25 23:11 GMT+03:00 Leo Donahue donahu...@gmail.com: public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException Assuming you have only a single Filter configured in web.xml Assuming you have logic in a doFilter that

Re: Filter behaviour

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Leo, On 6/26/15 10:38 AM, Leo Donahue wrote: On Fri, Jun 26, 2015 at 1:42 AM, André Warnier a...@ice-sa.com wrote: I must admit that your question above was a bit difficult to follow, in terms of if/then/else/unless, particularly late at

Re: Tomcat 7.0.63 release date known?

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Maarten, On 6/10/15 7:43 AM, Maarten van Hulsentop wrote: Dear Tomcat users, We are using Apache Tomcat 7 to run our product on, using a number of features of the Tomcat product, such as the SPNego mechanism. For security reasons we keep up

Re: Tomcat - OOM Perm gen

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Kiran, On 6/25/15 6:32 PM, Kiran Badi wrote: I have 2 web apps sitting on single tomcat instance, App A( Classic JSP/Servlet/jstl/velocity App) and App B (Struts2 based app). Now I have added S2 to App A and trying to fix some bad code in it

RE: Forcing SSL Renotiation

2015-06-26 Thread George Stanchev
Hi Chris, Agree on point 2 3. Since we are in control of the application server, we have the luxury of managing the SSL engine and the Security Manager settings. I guess I should've provided a link to the ssl-howto doc [1] that describes that solution. I went the reflection way to avoid

Re: Filter behaviour

2015-06-26 Thread Leo Donahue
On Fri, Jun 26, 2015 at 1:42 AM, André Warnier a...@ice-sa.com wrote: I must admit that your question above was a bit difficult to follow, in terms of if/then/else/unless, particularly late at night. Yes, you are right. Sorry about that. I was trying to walk the line between saying too

RE: Forcing SSL Renotiation

2015-06-26 Thread George Stanchev
Hi Steffen You didn't specify your Tomcat version. In Tomcat 7 or 8 or 9 we use the following code. Not sure if it will work on 6. For a long time until very recently we were stuck on 5.5 and the attribute below is not available. So I had to write a reflection introspection to drill down to

Re: SSL configuration using PFX as keystore

2015-06-26 Thread Mark Thomas
On 22/06/2015 11:56, Mark Thomas wrote: On 22/06/2015 09:39, Mark Thomas wrote: snip/ Prompting for authentication in response to an untrusted certificate is bizarre to say the least. Microsoft generously provide MSDN subscriptions for Apache committers which is why I have the various

Re: Filter behaviour

2015-06-26 Thread Leo Donahue
On Fri, Jun 26, 2015 at 11:09 AM, Christopher Schultz ch...@christopherschultz.net wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Leo, If I use a return statement to break out of a filter, what should happen? Will the next filter run? No. The Filter is responsible for