Re: Receiving HTTP 505 on Expect: 100-continue
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Michael, On 12/4/14 4:27 AM, Osipov, Michael wrote: Hi folks, we are experiencing a popular issue with MS .NET clients sending Expect: 100-continue and Tomcat failing with HTTP 505. We use Apache Tomcat 6.0.41 with APR connector on a corporate network. The request look like this in Wireshark: 1. Client sends empty request with one TCP packet What do you mean empty? Is there a request line? Headers? Is there a \r\n\r\n indicating the end of the headers? Is the Expect header in this packet? 2. Tomcat responds with 401 within 20 to 30 ms 3. Client sends another TCP packet with the request body now (401 has been ignored) So the client sends Expect: 100 and then ignores the non-100 response? Sounds like the .NET client is braindead. 4. While debugging the APR Connector I see that request.getProtocol is invoked and the message bytes contain the chomped XML with a trailing GET request. This leads to a 505. I read several resources as well as bug reports in HTTPd, Tomcat and JBoss spread over the last couple of years. The RFC 7231 [1] says: Requirements for clients: o A client that sends a 100-continue expectation is not required to wait for any specific length of time; such a client MAY proceed to send the message body even if it has not yet received a response. Furthermore, since 100 (Continue) responses cannot be sent through an HTTP/1.0 intermediary, such a client SHOULD NOT wait for an indefinite period before sending the message body. The statement sheds some light on the issue but does not fully answer the question. As far as I understand the client has received the final status (401) from the server but did not evaluate this. In my opinion, the client seems to be broken. The resources suggested to disable the header which we did and it did work indeed, the strange thing is that the client in .NET should wait for 350 ms before it fires the body which it doesn't. Can somebody tell me who is misbehaving against the RFC? Is disabling Expect: 100-continue the way to go? I am pretty fine with that if Tomcat's behavior is RFC-compliant. Using Expect:100 is appropriate if you have a large-bodied request and you only want to use the network resources to push that body if the server is going to accept it. So, you send the 100-continue header along with things like the Content-Type and Content-Length and see if the server says yeah, I'll accept that or no way, buddy. IF the server says yes, then you can push the actual request, which may be GiBs in size. If the server says no, you can avoid all that data transfer and tell the user Sorry, computer says 'no'. PS: If someone of the project members is interested in the Wirshark pcap file, I'll be happy to send you that to your @apache.org email address. Pastebin the hex/text dump? - -chris -BEGIN PGP SIGNATURE- Version: GnuPG v1 Comment: GPGTools - http://gpgtools.org iQIcBAEBCAAGBQJUg090AAoJEBzwKT+lPKRYIOcQAJnXpQ8Y6lsbzr44ZsuyIDA8 2AnKRSPgwgsdE3qu5QvKP/A8V+ASJOxkYTlYEr/GlWj3KCUqhXvbDbH4oMuGiaq2 HowUwxr69HciISx5EEnls5UVNDd2bAusw/lvY01JmGGltTSNubiyofCSaSyb55F8 XLs6CXGdTR4nBiau37Y326K7X8dCS8BnWQEROtu1IJsh1Yzz7wTQyRfcJhsPixW1 xKJMMDlJTjmBOT3XStYJbFbwabkQWoBLwf1h9qTBGM+0IC7CzjcyvQbO4sUU6YqH nQ9mBw2KDW3tKy3T2iGYpsm/do5tJ03JsXsYS14BcTsFM7IKJddua13h9mnNKVzH tABP/tp2iTIW99V+CzFcFHAQXb6Sf4ovlk0Mea4fdypwVzXG9W0NvAMLRccNWm3L tv+xhVwTSsyM/inuNKhmaME+Y9Wv0j15d00FBmtbtX1sr9NbZjlx+RGlgWcvm31U VOp0CeRad3/CNDfZx3xCxIUoEfAffW0Z4NQMns7P8lEF0CUY7S9p6GLrdH0k019i ACiYmzQ/yUp5CGjtHc3fHZZVCpAZBohs/y9pZqE44TRLz02uogZLuzaqc05VQjjz X2GWjJRG4NCTeIqIsrmxlUdJhtbufIsrLf9kLNzFo5ioA4/l7DO0gUken5DKGuAV N+fxh4lt2DlEoqxBmvk0 =o6qk -END PGP SIGNATURE- - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: Receiving HTTP 505 on Expect: 100-continue
On 06/12/2014 18:48, Christopher Schultz wrote: Michael, On 12/4/14 4:27 AM, Osipov, Michael wrote: Hi folks, we are experiencing a popular issue with MS .NET clients sending Expect: 100-continue and Tomcat failing with HTTP 505. We use Apache Tomcat 6.0.41 with APR connector on a corporate network. The request look like this in Wireshark: 1. Client sends empty request with one TCP packet What do you mean empty? Is there a request line? Headers? Is there a \r\n\r\n indicating the end of the headers? Is the Expect header in this packet? 2. Tomcat responds with 401 within 20 to 30 ms 3. Client sends another TCP packet with the request body now (401 has been ignored) So the client sends Expect: 100 and then ignores the non-100 response? Sounds like the .NET client is braindead. To be fair, it could be a timing issue. The client has to guess how long to wait before sending the body if it doesn't get a response. Given the timing issues, the only thing the server can safely do for non-200 responses is send the response, close the connection and optionally swallow any request body (some clients don't even try to read the response until the body has been sent). Mark - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
My problem: I cannot successfully get or set a session attribute from a JSP file.
Hi to all, I am currently developing some server side JSP code. By and large, things are progressing and working well. I have gotten half way decent at debugging my java/javascript/jquery/jsp/HTML source code, but I have run into a problem in JSP where the code does not work, but I have found no clues as to why it is not working. The environment that I am working in is Tomcat 7.0.54 and I am using java 1.8 and jquery 1.7.2. What I am trying to do: I have html code with an embedded javascript that runs jquery code. The jquery code being run makes an ajax call to a JSP file on the server side, which I will call s.jsp. This file is a very simple file whose sole function is to take a registration name and query an SQL database to see if the name has already been used at the web site. The registration name is passed with a method call that looks like this: regName = request.getParameter(registrationName);[item 1] This all works fine for me. So far so good. If the registration name is good, the state of my application logic changes. I guess there are multiple ways to store state, but I have chosen to store the state as a session variable. I searched the net and found an example of JSP code that uses the session object to store information as an attribute with a statement that looks something like: session.setAttribute(logicState,nameValidated); [item 2] I tried adding this line and when I now push the submit button of my HTML form, which calls s.jsp as an action, the application hangs (in firefox). I receive no error messages anywhere. Usually, when I add bad code in s.jsp I will get a stacktrace from firefox or error messages in the firefox debug console, or both. Or I will error message in my own homegrown debug code, but that does not happen. I know that my home grown code does not get called, so I can infer that the call to s.jsp is never made, but I cannot be 100% certain of this. I also checked my tomcat/logs directory and there was nothing in the log files that I would not expect. So my first question is: Can I simply add item 2, above, to my jsp file and expect that tomcat will recognize that I am referencing the session object? In s.jsp, item 1, above, references the request object and tomcat handles that and I am expecting that it will also hand my reference to the session object. My second question is more general. My code is not working and there are no error messages. Can anyone speculate why this would be the case? Is there any place else I should be looking for error messages? Jim A. - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: Receiving HTTP 505 on Expect: 100-continue
2014-12-06 21:53 GMT+03:00 Mark Thomas ma...@apache.org: On 06/12/2014 18:48, Christopher Schultz wrote: Michael, On 12/4/14 4:27 AM, Osipov, Michael wrote: Hi folks, we are experiencing a popular issue with MS .NET clients sending Expect: 100-continue and Tomcat failing with HTTP 505. We use Apache Tomcat 6.0.41 with APR connector on a corporate network. The request look like this in Wireshark: 1. Client sends empty request with one TCP packet What do you mean empty? Is there a request line? Headers? Is there a \r\n\r\n indicating the end of the headers? Is the Expect header in this packet? 2. Tomcat responds with 401 within 20 to 30 ms 3. Client sends another TCP packet with the request body now (401 has been ignored) So the client sends Expect: 100 and then ignores the non-100 response? Sounds like the .NET client is braindead. To be fair, it could be a timing issue. The client has to guess how long to wait before sending the body if it doesn't get a response. Given the timing issues, the only thing the server can safely do for non-200 responses is send the response, close the connection and optionally swallow any request body (some clients don't even try to read the response until the body has been sent). +1. The fix for Tomcat 7 was a year ago (7.0.48) in http://svn.apache.org/r1540689 I think that it can be backported to Tomcat 6. Best regards, Konstantin Kolinko - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: My problem: I cannot successfully get or set a session attribute from a JSP file.
On Sun, Dec 7, 2014 at 2:49 AM, Jim Anderson jim_ander...@centurylink.net wrote: Hi to all, I am currently developing some server side JSP code. By and large, things are progressing and working well. I have gotten half way decent at debugging my java/javascript/jquery/jsp/HTML source code, but I have run into a problem in JSP where the code does not work, but I have found no clues as to why it is not working. The environment that I am working in is Tomcat 7.0.54 and I am using java 1.8 and jquery 1.7.2. What I am trying to do: I have html code with an embedded javascript that runs jquery code. The jquery code being run makes an ajax call to a JSP file on the server side, which I will call s.jsp. This file is a very simple file whose sole function is to take a registration name and query an SQL database to see if the name has already been used at the web site. The registration name is passed with a method call that looks like this: regName = request.getParameter(registrationName);[item 1] This all works fine for me. So far so good. If the registration name is good, the state of my application logic changes. I guess there are multiple ways to store state, but I have chosen to store the state as a session variable. I searched the net and found an example of JSP code that uses the session object to store information as an attribute with a statement that looks something like: session.setAttribute(logicState,nameValidated); [item 2] I tried adding this line and when I now push the submit button of my HTML form, which calls s.jsp as an action, the application hangs (in firefox). I receive no error messages anywhere. Usually, when I add bad code in s.jsp I will get a stacktrace from firefox or error messages in the firefox debug console, or both. Or I will error message in my own homegrown debug code, but that does not happen. I know that my home grown code does not get called, so I can infer that the call to s.jsp is never made, but I cannot be 100% certain of this. I also checked my tomcat/logs directory and there was nothing in the log files that I would not expect. So my first question is: Can I simply add item 2, above, to my jsp file and expect that tomcat will recognize that I am referencing the session object? In s.jsp, item 1, above, references the request object and tomcat handles that and I am expecting that it will also hand my reference to the session object. This should work. Make sure, you don't have the session disable on your jsp i.e. your jsp don't have this directive: %@ page *session*=false % My second question is more general. My code is not working and there are no error messages. Can anyone speculate why this would be the case? Is there any place else I should be looking for error messages? There are many places to start debugging at. But first and foremost is your application logs. What does your application logs says? Any exception, corresponding stack-trace?? Jim A. - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
Re: My problem: I cannot successfully get or set a session attribute from a JSP file.
2014-12-07 0:19 GMT+03:00 Jim Anderson jim_ander...@centurylink.net: Hi to all, I am currently developing some server side JSP code. By and large, things are progressing and working well. I have gotten half way decent at debugging my java/javascript/jquery/jsp/HTML source code, but I have run into a problem in JSP where the code does not work, but I have found no clues as to why it is not working. The environment that I am working in is Tomcat 7.0.54 and I am using java 1.8 and jquery 1.7.2. What I am trying to do: I have html code with an embedded javascript that runs jquery code. The jquery code being run makes an ajax call to a JSP file on the server side, which I will call s.jsp. This file is a very simple file whose sole function is to take a registration name and query an SQL database to see if the name has already been used at the web site. The registration name is passed with a method call that looks like this: regName = request.getParameter(registrationName);[item 1] This all works fine for me. So far so good. If the registration name is good, the state of my application logic changes. I guess there are multiple ways to store state, but I have chosen to store the state as a session variable. I searched the net and found an example of JSP code that uses the session object to store information as an attribute with a statement that looks something like: session.setAttribute(logicState,nameValidated); [item 2] I tried adding this line and when I now push the submit button of my HTML form, which calls s.jsp as an action, the application hangs (in firefox). I receive no error messages anywhere. Usually, when I add bad code in s.jsp I will get a stacktrace from firefox or error messages in the firefox debug console, or both. Or I will error message in my own homegrown debug code, but that does not happen. I know that my home grown code does not get called, so I can infer that the call to s.jsp is never made, but I cannot be 100% certain of this. I also checked my tomcat/logs directory and there was nothing in the log files that I would not expect. So my first question is: Can I simply add item 2, above, to my jsp file and expect that tomcat will recognize that I am referencing the session object? In s.jsp, item 1, above, references the request object and tomcat handles that and I am expecting that it will also hand my reference to the session object. My second question is more general. My code is not working and there are no error messages. Can anyone speculate why this would be the case? Is there any place else I should be looking for error messages? 1. Is this reproducible if you restart Tomcat? 2. Is there anything in your access log? Was your request received by Tomcat? http://wiki.apache.org/tomcat/FAQ/Troubleshooting_and_Diagnostics Best regards, Konstantin Kolinko - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
