Re: Disabling OPTIONS HTTP method with * path

2024-05-01 Thread Mark Thomas
On 30/04/2024 19:56, Oleg Frenkel wrote: This issue exists in 9.0.88 and 10.1.23. I am looking to disable the following HTTP request (note 'OPTIONS *' in the request): Why? Please confirm if this is a bug in Tomcat or if I am missing something in Tomcat configuration. Neither. Tomcat is

Re: [EXTERNAL] Disabling OPTIONS HTTP method with * path

2024-04-30 Thread Joey Cochran
From: Oleg Frenkel Sent: Tuesday, April 30, 2024 1:56 PM To: users@tomcat.apache.org Subject: [EXTERNAL] Disabling OPTIONS HTTP method with * path This issue exists in 9.0.88 and 10.1.23. I am looking to disable the following HTTP request (note 'OPTIONS *' in the request): $ curl -v

Disabling OPTIONS HTTP method with * path

2024-04-30 Thread Oleg Frenkel
configuration doesn't work either: Available HTTP methods /* GET POST The above section properly disables OPTIONS request to '/' path, but not to '*' path. In fact, the Tomcat respon

Re: java.lang.IllegalStateException: Unable to find match between the canonical context path

2023-04-10 Thread Mark Thomas
error . java.lang.IllegalStateException: Unable to find match between the canonical context path [/servicename] and the URI presented by the user agent [_visitor=...] at org.apache.catalina.connector.Request.getContextPath(Request.java:2152) at org.apache.catalina.connector.RequestFacade.getContextPath(RequestFacad

java.lang.IllegalStateException: Unable to find match between the canonical context path

2023-04-09 Thread Chandru Mariraj
etween the canonical context path [/servicename] and the URI presented by the user agent [_visitor=...] at org.apache.catalina.connector.Request.getContextPath(Request.java:2152) at org.apache.catalina.connector.RequestFacade.getContextPath(RequestFacade.ja

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-26 Thread Nils Breunese
Christopher Schultz wrote: >> Well yeah, it’s not like Envoy is a super niche proxy. We also found >> the exact same issue in two other proxies in our network by the way. >> Any proxy that does not consider path parameters when doing >> path-based access control w

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Christopher Schultz
t;>>>> - Envoy allows the request based on the /v1/* rule, because it >>>>> does not support path parameters, because they are not part of >>>>> any recent standard (RFC 2396 dropped them in 1998 [1]) >>>> >>>> Envoy does support path par

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Christopher Schultz
Mark, On 9/24/20 12:41, Mark Thomas wrote: > On 24/09/2020 17:28, Christopher Schultz wrote: > > > >> Tomcat will only use path parameters in the final segment of a URL e.g. >> https://www.example.com/app/servlet;jsessionid=ABCD1234?q=search > > No

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Nils Breunese
Christopher Schultz wrote: > On 9/24/20 07:46, Nils Breunese wrote: >> Mark Thomas wrote: >> >>> On 24/09/2020 11:02, Nils Breunese wrote: >>> >>> >>> >>>> - Envoy allows the request based on the /v1/* rule, because it &

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Mark Thomas
On 24/09/2020 17:28, Christopher Schultz wrote: > Tomcat will only use path parameters in the final segment of a URL e.g. > https://www.example.com/app/servlet;jsessionid=ABCD1234?q=search Not quite. Tomcat will only *add* the jsessionid at the end but it will accept it on any s

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Christopher Schultz
Nils, On 9/24/20 07:46, Nils Breunese wrote: > Mark Thomas wrote: > >> On 24/09/2020 11:02, Nils Breunese wrote: >> >> >> >>> - Envoy allows the request based on the /v1/* rule, because it >>> does not support path parameters, because they a

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Nils Breunese
Mark Thomas wrote: > On 24/09/2020 11:02, Nils Breunese wrote: > > > >> - Envoy allows the request based on the /v1/* rule, because it does not >> support path parameters, because they are not part of any recent standard >> (RFC 2396 dropped them in 1998 [1]

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Nils Breunese
do whatever is necessary in your application. We have hundreds of applications running on Tomcat and path-based access control is currently handled outside Tomcat by Istio’s RBAC in the cloud. It appears that this is not a great match then. > Please use secur...@tomcat.apache.org for reporting (pos

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Nils Breunese
Julian Reschke wrote: > Am 24.09.2020 um 12:02 schrieb Nils Breunese: >> Hello, >> >> I recently learned that when a server that supports path parameters [0] — >> like Tomcat (I found Jetty also does) — is run behind a reverse proxy that >> does path-bas

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Julian Reschke
Am 24.09.2020 um 12:02 schrieb Nils Breunese: Hello, I recently learned that when a server that supports path parameters [0] — like Tomcat (I found Jetty also does) — is run behind a reverse proxy that does path-based access control checks and does not support path parameters, your combined

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Mark Thomas
On 24/09/2020 11:02, Nils Breunese wrote: > - Envoy allows the request based on the /v1/* rule, because it does not > support path parameters, because they are not part of any recent standard > (RFC 2396 dropped them in 1998 [1]) Envoy does support path parameters and is correctly

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Martin Grigorov
On Thu, Sep 24, 2020 at 2:11 PM Martin Grigorov wrote: > Hi, > > On Thu, Sep 24, 2020 at 1:02 PM Nils Breunese wrote: > >> Hello, >> >> I recently learned that when a server that supports path parameters [0] — >> like Tomcat (I found Jetty also does) — is run

Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Martin Grigorov
Hi, On Thu, Sep 24, 2020 at 1:02 PM Nils Breunese wrote: > Hello, > > I recently learned that when a server that supports path parameters [0] — > like Tomcat (I found Jetty also does) — is run behind a reverse proxy that > does path-based access control checks and does n

Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Nils Breunese
Hello, I recently learned that when a server that supports path parameters [0] — like Tomcat (I found Jetty also does) — is run behind a reverse proxy that does path-based access control checks and does not support path parameters, your combined setup could be vulnerable. Consider this setup

Re: Manager save text command bug giving path parameter

2020-04-21 Thread Mark Thomas
On 20/04/2020 20:25, Mark Thomas wrote: > On 19/04/2020 18:34, Arnaud Yahoo wrote: >> Hello, >> >> following >> https://tomcat.apache.org/tomcat-8.5-doc/manager-howto.html#Save_Configuration >> documentation, >> >> calling save with path paramete

Re: Manager save text command bug giving path parameter

2020-04-20 Thread Mark Thomas
On 19/04/2020 18:34, Arnaud Yahoo wrote: > Hello, > > following > https://tomcat.apache.org/tomcat-8.5-doc/manager-howto.html#Save_Configuration > documentation, > > calling save with path parameter is failing giving following error: > *FAIL

Manager save text command bug giving path parameter

2020-04-19 Thread Arnaud Yahoo
Hello, following https://tomcat.apache.org/tomcat-8.5-doc/manager-howto.html#Save_Configuration documentation, calling save with path parameter is failing giving following error: *FAIL - Encountered exception [javax.management.MBeanException: Cannot find operation store] * looking

Re: Role/Path Based Access Valve?

2020-03-03 Thread Richard Monson-Haefel
ng, and > >>>> here is the reason: > >>>> > >>>> If I, as the Tomcat admin, want to manage access permissions > >>>> (authorization) I can use the /tomcat/conf/web.xml file. > >>>> However, this file is overridden by matching

Re: Role/Path Based Access Valve?

2020-03-03 Thread Christopher Schultz
e /tomcat/conf/web.xml file. >>>> However, this file is overridden by matching elements in an >>>> individual WAR. > > This will never work. If conf/web.xml is even allowed to set > (and I'm not sure either way), they would be > relative to every web appli

Re: Role/Path Based Access Valve?

2020-03-03 Thread Richard Monson-Haefel
Ok. That makes sense. Thanks again, Mark. On Tue, Mar 3, 2020 at 8:18 AM Mark Thomas wrote: > On 03/03/2020 13:50, Christopher Schultz wrote: > > Richard, > > > > On 3/3/20 08:26, Richard Monson-Haefel wrote: > >> Thank you, Mark. I was actually aware of how to do it using the > >> web.xml. >

Re: Role/Path Based Access Valve?

2020-03-03 Thread Mark Thomas
On 03/03/2020 13:50, Christopher Schultz wrote: > Richard, > > On 3/3/20 08:26, Richard Monson-Haefel wrote: >> Thank you, Mark. I was actually aware of how to do it using the >> web.xml. > >> I was looking for a valve that could do the same thing, and here is >> the reason: > >> If I, as the

Re: Role/Path Based Access Valve?

2020-03-03 Thread Richard Monson-Haefel
on and not relative to the server's > root. IT would be very difficult to manage this in the way you describe. > > > So If I say on the tomcat web.xml that only Bill and Ted have > > access to path A, but an individual WAR's web.xml says that > > Everyone has access to Path

Re: Role/Path Based Access Valve?

2020-03-03 Thread Christopher Schultz
would be relative to every web application and not relative to the server's root. IT would be very difficult to manage this in the way you describe. > So If I say on the tomcat web.xml that only Bill and Ted have > access to path A, but an individual WAR's web.xml says that > Everyon

Re: Role/Path Based Access Valve?

2020-03-03 Thread Richard Monson-Haefel
is overridden by matching elements in an individual WAR. So If I say on the tomcat web.xml that only Bill and Ted have access to path A, but an individual WAR's web.xml says that Everyone has access to Path A, then the WAR web.xml wins, right? If I use a valve I can short-circuit the process before

Re: Role/Path Based Access Valve?

2020-03-03 Thread Mark Thomas
On 03/03/2020 12:27, Richard Monson-Haefel wrote: > I've tried to find this but keep running into the three remote address > valves (address, IP, and CIDR) what I'm looking for is an access valve that > uses roles from a realm that checks roles to either path or web application >

Role/Path Based Access Valve?

2020-03-03 Thread Richard Monson-Haefel
I've tried to find this but keep running into the three remote address valves (address, IP, and CIDR) what I'm looking for is an access valve that uses roles from a realm that checks roles to either path or web application identifiers - not remote address. This is classic authorization - role

Re: HSTS not apply to some request URI path on tomcat 8.5.9 Centos 7

2020-01-05 Thread Pattavee Sanchol
Dear Chris, Thank you so much for your suggestion. Now I can solve this problem, cause is the request url path with special characters were handled by web application framework. But my application framework's configuration not apply for special characters in url. So it return default page without

Re: HSTS not apply to some request URI path on tomcat 8.5.9 Centos 7

2020-01-02 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Pattavee, On 1/1/20 22:55, Pattavee Sanchol wrote: > Dear Chris, > > I follow your suggestion, change my app to ROOT but request with > special characters on url path still response with no HSTS header. > detail on e.g. below

Re: HSTS not apply to some request URI path on tomcat 8.5.9 Centos 7

2020-01-01 Thread Pattavee Sanchol
Dear Chris, I follow your suggestion, change my app to ROOT but request with special characters on url path still response with no HSTS header. detail on e.g. below [sys01@webgateway ~]$ curl -I -k "https://192.168.136.3:8443; HTTP/1.1 200 Strict-Transport-Security: max-age=315

Re: HSTS not apply to some request URI path on tomcat 8.5.9 Centos 7

2019-12-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Pattavee, On 12/26/19 05:22, Pattavee Sanchol wrote: > Dear support team > > I config tomcat server to enabled HSTS some request URI path not > response with Secure heading > > The configuration illustrated below > >

Re: HSTS not apply to some request URI path on tomcat 8.5.9 Centos 7

2019-12-26 Thread Pattavee Sanchol
der on some request such as http://192.168.1.1/%20 or http://192.168.1.1/%3e I think url pattern /* is not apply to request with special characters on path. httpHeaderSecurity /* REQUEST Regards. *ปฐวี สรรค์ชลPattavee SANCHOL* * <http://www.thaidigitalid.com>

Re: HSTS not apply to some request URI path on tomcat 8.5.9 Centos 7

2019-12-26 Thread Olaf Kock
On 26.12.19 11:22, Pattavee Sanchol wrote: > Dear support team > > I config tomcat server to enabled HSTS some request URI path not > response with Secure heading > > ... > > > I some request URI such as http://192.168.1.1/%20 is not response with > security

HSTS not apply to some request URI path on tomcat 8.5.9 Centos 7

2019-12-26 Thread Pattavee Sanchol
Dear support team I config tomcat server to enabled HSTS some request URI path not response with Secure heading The configuration illustrated below httpHeaderSecurity org.apache.catalina.filters.HttpHeaderSecurityFilter true hstsEnabled true

Re: override context path for manager application

2019-12-04 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Konstantin, On 12/4/19 17:32, Konstantin Kolinko wrote: > чт, 5 дек. 2019 г. в 01:20, Guild, Jason A (DOT) > : >> >> Hi all: >> >> The context path of the Tomcat manager application is "/manager"

Re: override context path for manager application

2019-12-04 Thread Guild, Jason A (DOT)
Konstantin: Thank you for your point #1 below! When I remove "path" attribute entirely from my override configuration and save it as "dev9#manager.xml" then I get exactly the result I want. However, I did not need to move the manager application from the "${catalina

Re: override context path for manager application

2019-12-04 Thread Konstantin Kolinko
чт, 5 дек. 2019 г. в 01:20, Guild, Jason A (DOT) : > > Hi all: > > The context path of the Tomcat manager application is "/manager" by default > [0]. > I am trying to change this context path from the default using an override > configuration. > > I am doin

override context path for manager application

2019-12-04 Thread Guild, Jason A (DOT)
Hi all: The context path of the Tomcat manager application is "/manager" by default [0]. I am trying to change this context path from the default using an override configuration. I am doing the typical creation of a container using makebase.sh and setting CATALINA_BASE befor

Re: Tomcat Loader putting my modules to module-path as unnamed module

2019-11-12 Thread Nedim Kulovac
ss loading done modular > or > > old style, he recommended putting > > System.out.println(SomeClass.class.getModule()); somewhere in code in the > > module. I did it and as a result, I got printed out 'unnamed module > > @595b34e5'. So the big question is: why is this happ

Re: Tomcat Loader putting my modules to module-path as unnamed module

2019-11-12 Thread Mark Thomas
t and as a result, I got printed out 'unnamed module > @595b34e5'. So the big question is: why is this happening and how can I > resolve this? I want Tomcat to put my modules to module path normally, not > as an unnamed module. You can't. The Servlet API (nor any part of Java EE / Jakar

Tomcat Loader putting my modules to module-path as unnamed module

2019-11-12 Thread Nedim Kulovac
is this happening and how can I resolve this? I want Tomcat to put my modules to module path normally, not as an unnamed module.

Re: Use relative path in Java code hosted in tomcat server.

2019-09-20 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Kaushal, On 9/19/19 13:06, Kaushal Shriyan wrote: > I am adding the below absolute path in java code and compiled in a > war file and uploaded in tomcat 9.0.24 servlet/jsp container. > > file=createPDF("/opt/tomcat9/weba

Re: Path parameters with RewriteValve

2019-09-19 Thread Mark Thomas
> For curiosity, what is the non-spec API to obtain path parameters? It only gets a value for a name. It doesn't provide access to which segment, it doesn't handle multiple instances of the same parameter, etc. http://tomcat.apache.org/tomcat-9.0-doc/api/org/apache/coyote/Request.html#getPathPa

Use relative path in Java code hosted in tomcat server.

2019-09-19 Thread Kaushal Shriyan
Hi, I am adding the below absolute path in java code and compiled in a war file and uploaded in tomcat 9.0.24 servlet/jsp container. file=createPDF("/opt/tomcat9/webapps/statementspdf/"+accountId+statementId+".pdf", > statementsEntityATOS); Is there a way to us

Re: Path parameters with RewriteValve

2019-09-17 Thread Alain Sellerin
On Mon, Sep 16, 2019 at 1:49 PM Mark Thomas wrote: > > > Alain, > > On 9/13/19 13:37, Alain Sellerin wrote: > >>>> Tomcat version: 8.5 OS: Win10, Linux > > > > >>>> I'm facing an issue with an application that is using pat

Re: Path parameters with RewriteValve

2019-09-16 Thread Mark Thomas
> Alain, > On 9/13/19 13:37, Alain Sellerin wrote: >>>> Tomcat version: 8.5 OS: Win10, Linux >>>> I'm facing an issue with an application that is using path >>>> parameters in conjunction with a RewriteValve. >>>> If the request is :

Re: Path parameters with RewriteValve

2019-09-14 Thread Alain Sellerin
On Sat, Sep 14, 2019 at 5:42 PM Christopher Schultz wrote: > > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Alain, > > On 9/13/19 13:37, Alain Sellerin wrote: > > Tomcat version: 8.5 OS: Win10, Linux > > > > Hi, > > > > I'm fac

Re: Path parameters with RewriteValve

2019-09-14 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Alain, On 9/13/19 13:37, Alain Sellerin wrote: > Tomcat version: 8.5 OS: Win10, Linux > > Hi, > > I'm facing an issue with an application that is using path > parameters in conjunction with a RewriteValve. > > I n

Path parameters with RewriteValve

2019-09-13 Thread Alain Sellerin
Tomcat version: 8.5 OS: Win10, Linux Hi, I'm facing an issue with an application that is using path parameters in conjunction with a RewriteValve. I narrowed down the problem by using the sample application available here: https://tomcat.apache.org/tomcat-8.5-doc/appdev/sample/ Context

Re: latest situation with escaped path delimiters in URI

2019-02-05 Thread Garret Wilson
On 2/5/2019 1:15 PM, Mark Thomas wrote: … Migratation to git has been in planning for a while. We are pretty much ready to pull the trigger. It is largely waiting for someone to have the time to do it when there aren't other more urgent things to be dealt with. I'd expect it to happen in the

Re: latest situation with escaped path delimiters in URI

2019-02-05 Thread Mark Thomas
On 05/02/2019 14:51, Garret Wilson wrote: > On 2/3/2019 9:34 PM, Mark Thomas wrote: >> >>>   * If this setting is still needed in some cases, is there any way to >>>     control it without resorting to a system property? (System >>>     properties are not very flexible, and Tomcat has many layers

Re: latest situation with escaped path delimiters in URI

2019-02-05 Thread Christopher Schultz
like them.) So you're > saying that to request information for the resource > https://example.info/foobar, I would send a GET request to: > > https://example.com/https%3A//example.info/foobar/description > > That raises all sorts of questions, such as > > * The double sla

Re: latest situation with escaped path delimiters in URI

2019-02-05 Thread Garret Wilson
On 2/3/2019 9:34 PM, Mark Thomas wrote:  * If this setting is still needed in some cases, is there any way to    control it without resorting to a system property? (System    properties are not very flexible, and Tomcat has many layers of more    manipulable settings, as you all would know

Re: latest situation with escaped path delimiters in URI

2019-02-04 Thread Garret Wilson
is OK? Really!?? * Is there any RESTful API framework on the planet that would realize the URI path "/https%3A//example.info/foobar/description" matched "{thingURI}/description"? So if I'm using JAX-RS with a @Path("{thingURI}/description") with a string @PathP

Re: latest situation with escaped path delimiters in URI

2019-02-04 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Garret, On 2/3/19 16:20, Garret Wilson wrote: > If we want to look up the thing identified by > https://example.info/foobar, we would need to issue a request to > https://example.com/https%3A%2F%2Fexample.info%2Ffoobar/description Why > are you

Re: latest situation with escaped path delimiters in URI

2019-02-04 Thread Rainer Jung
Am 03.02.2019 um 22:20 schrieb Garret Wilson: Hi, all. I've stumbled on a situation I need some clarity on. As is typical, there's all sorts of information floating around, most of it more than a decade old, with no indication of what the current status is. Our team is creating a RESTful API

Re: latest situation with escaped path delimiters in URI

2019-02-04 Thread Mark Thomas
ether decoded or "raw" APIs should be returned from > the various API methods. But I guess the issue here is /not/ whether > JAX-RS should interpret a path segment as decoded or encoded. The issue > is whether Tomcat has already fiddled with the URI itself to /change > what consti

Re: latest situation with escaped path delimiters in URI

2019-02-03 Thread Garret Wilson
methods. But I guess the issue here is /not/ whether JAX-RS should interpret a path segment as decoded or encoded. The issue is whether Tomcat has already fiddled with the URI itself to /change what constitutes the path segment/. Unless an EE specification says to muck around with the URI lik

Re: latest situation with escaped path delimiters in URI

2019-02-03 Thread Mark Thomas
On 03/02/2019 21:20, Garret Wilson wrote: > Hi, all. I've stumbled on a situation I need some clarity on. As is > typical, there's all sorts of information floating around, most of it > more than a decade old, with no indication of what the current status is. > > Our team is creating a RESTful

latest situation with escaped path delimiters in URI

2019-02-03 Thread Garret Wilson
Hi, all. I've stumbled on a situation I need some clarity on. As is typical, there's all sorts of information floating around, most of it more than a decade old, with no indication of what the current status is. Our team is creating a RESTful API (using JAX-RS implemented by RESTEasy) to a

[SECURITY] CVE-2018-11759 Apache Tomcat JK (mod_jk) Connector path traversal

2018-10-31 Thread Mark Thomas
CVE-2018-11759 Apache Tomcat JK (mod_jk) Connector path traversal Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat JK mod_jk Connector 1.2.0 to 1.2.44 Description: The Apache Web Server (httpd) specific code that normalised the requested path

Re: tomcat-embed-core-8.5.29 Http11NioProtocol stopped accepting protocol as part of keystore file path

2018-04-24 Thread Mark Thomas
On 23/04/18 14:10, Maksym Mazur wrote: > HI everyone > > TL;DR > After upgrade from tomcat 8.5.23 to 8.5.29 Http11NioProtocol fails to > recognize "classpath" as protocol to load keystore file. > Using java 1.8.0_171, OS: Windows 10 Support for the classpath protocol is provided by Spring Boot.

tomcat-embed-core-8.5.29 Http11NioProtocol stopped accepting protocol as part of keystore file path

2018-04-23 Thread Maksym Mazur
HI everyone TL;DR After upgrade from tomcat 8.5.23 to 8.5.29 Http11NioProtocol fails to recognize "classpath" as protocol to load keystore file. Using java 1.8.0_171, OS: Windows 10 In my project I used Spring Boot 2.0.0.M7 which has tomcat-embed-core-8.5.23 dependency. I have code to read

[SECURITY] CVE-2018-1323 Apache Tomcat JK ISAPI Connector path traversal

2018-03-12 Thread Mark Thomas
CVE-2018-1323 Apache Tomcat JK ISAPI Connector path traversal Severity: Important Vendor: The Apache Software Foundation Versions Affected: - Apache Tomcat JK ISAPI Connector 1.2.0 to 1.2.42 Description The IIS/ISAPI specific code that normalised the requested path before matching

Re: jsessionid path parameter: Is this compliant with the Servlet 3.0 spec?

2018-02-05 Thread Mark Thomas
ard that it took some > time to figure out the connection. As I said, the Tomcat behaviour here is arguable. I can see a case for the path parameter being either JSESSIONID or jsessionid in this case. My only reason for leaning towards JSESSIONID is maintaining the status quo. Experience suggests

Re: jsessionid path parameter: Is this compliant with the Servlet 3.0 spec?

2018-02-04 Thread Dave Glasser
Thanks, that is pretty clear and unambiguous, as is "The name of the parameter must be jsessionid." When the spec is in conflict with itself, I'm happy to consider Tomcat the reference implementation. The reason a session cookie name had to be specified in the first place was because we

Re: jsessionid path parameter: Is this compliant with the Servlet 3.0 spec?

2018-02-04 Thread Mark Thomas
On 03/02/18 21:55, Dave Glasser wrote: > This text is based on a stackoverflow question I posted earlier today: > https://stackoverflow.com/questions/48600576/jsessionid-as-path-parameter-not-working-in-tomcat/48602272 > > > I'm using Tomcat 7.0.84, and my web app uses the Servlet

jsessionid path parameter: Is this compliant with the Servlet 3.0 spec?

2018-02-03 Thread Dave Glasser
This text is based on a stackoverflow question I posted earlier today: https://stackoverflow.com/questions/48600576/jsessionid-as-path-parameter-not-working-in-tomcat/48602272 I'm using Tomcat 7.0.84, and my web app uses the Servlet 3.0 deployment descriptor. The web.xml file contains

Re: Need Important Help in Context path

2017-11-27 Thread Sascha Monteiro
URL as > //localhost:8080/MyTest-1.00-SNAPSHOT1.0 > > but I need to set the context path MyTest eventhough deployed WAR name as > MyTest-1.00-SNAPSHOT1.0. I need the URL will be > //localhost:8080/MyTest > > This link should always same if I changed the war name from >

Re: Need Important Help in Context path

2017-11-27 Thread cyron
ill be MyTest-1.00-SNAPSHOT1.0 .If I deploy the same in > Tomcat I have use the URL as > //localhost:8080/MyTest-1.00-SNAPSHOT1.0 > > but I need to set the context path MyTest eventhough deployed WAR name as > MyTest-1.00-SNAPSHOT1.0. I need the URL will be > //localhost:8080/MyT

Need Important Help in Context path

2017-11-27 Thread Vivek Patil
Hello All, I am using Maven to build our application. So the war name will be MyTest-1.00-SNAPSHOT1.0 .If I deploy the same in Tomcat I have use the URL as //localhost:8080/MyTest-1.00-SNAPSHOT1.0 but I need to set the context path MyTest eventhough deployed WAR name as MyTest-1.00

RE: Skip resource path in TLD scanner?

2017-11-20 Thread Matt Cosentino
Thanks, but I'm talking about resource paths and not jar files. - Matt From: Ray Holme [mailto:rayho...@yahoo.com.INVALID] Sent: Friday, November 17, 2017 1:39 PM To: Tomcat Users List <users@tomcat.apache.org> Subject: Re: Skip resource path in TLD scanner? I use JSP and there are taglib

RE: Skip resource path in TLD scanner?

2017-11-20 Thread Matt Cosentino
, 2017 12:26 PM To: users@tomcat.apache.org Subject: Re: Skip resource path in TLD scanner? -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Matt, On 11/16/17 12:11 PM, Matt Cosentino wrote: > This keeps getting worse, my site was down for over a minute while the > TLD scanner ran. Ther

Re: [OT] Skip resource path in TLD scanner?

2017-11-20 Thread Christopher Schultz
, JVM crashes, and -- as in your example here -- planned > maintenance. > > Running a single instance of your application in a production > environment where uptime matters is really not an appropriate > solution. If you had two servers, your application's restart time > would n

Re: Skip resource path in TLD scanner?

2017-11-18 Thread Alex O'Ree
ve been an issue. > > - -chris > > > -Original Message- From: Mark Thomas > > [mailto:ma...@apache.org] Sent: Saturday, April 29, 2017 5:02 AM > > To: Tomcat Users List <users@tomcat.apache.org> Subject: Re: Skip > > resource path in TLD scanner? >

Re: Skip resource path in TLD scanner?

2017-11-17 Thread Ray Holme
- -chris > -Original Message- From: Mark Thomas > [mailto:ma...@apache.org] Sent: Saturday, April 29, 2017 5:02 AM > To: Tomcat Users List <users@tomcat.apache.org> Subject: Re: Skip > resource path in TLD scanner? > > On 28/04/17 17:00, Matt Cosentino

Re: Skip resource path in TLD scanner?

2017-11-17 Thread Christopher Schultz
, your application's restart time would not have been an issue. - -chris > -Original Message- From: Mark Thomas > [mailto:ma...@apache.org] Sent: Saturday, April 29, 2017 5:02 AM > To: Tomcat Users List <users@tomcat.apache.org> Subject: Re: Skip > resource path in TLD scanner

RE: Skip resource path in TLD scanner?

2017-11-16 Thread Matt Cosentino
ubject: Re: Skip resource path in TLD scanner? On 28/04/17 17:00, Matt Cosentino wrote: > Yes, it's other folders within WEB-INF. I turned on the TldScanner > logging and it is definitely what is causing the delay. My situation > probably isn't very typical. The delay varies in

Re[2]: Tomcat 7/8/9 context path restrictions/validation

2017-09-26 Thread Konstantin Ryadov
>Четверг, 21 сентября 2017, 11:27 +03:00 от Mark Thomas <ma...@apache.org>: > >On 20/09/17 10:47, Konstantin Ryadov wrote: >> >> Hello! >> Could you explain context path (e.g. described on >> https://tomcat.apache.org/tomcat-7.0-doc/config/context.html )

Re: Tomcat 7/8/9 context path restrictions/validation

2017-09-21 Thread Mark Thomas
On 20/09/17 10:47, Konstantin Ryadov wrote: > > Hello! > Could you explain context path (e.g. described on > https://tomcat.apache.org/tomcat-7.0-doc/config/context.html ) value set in > server.xml limitations? > Does it exist any context path validation (unescaped sy

Re: Tomcat 7/8/9 context path restrictions/validation

2017-09-20 Thread Guang Chao
On Wed, Sep 20, 2017 at 5:47 PM, Konstantin Ryadov <krya...@mail.ru.invalid> wrote: > > Hello! > Could you explain context path (e.g. described on > https://tomcat.apache.org/tomcat-7.0-doc/config/context.html ) value set > in server.xml limitations? > Does it exist any

Tomcat 7/8/9 context path restrictions/validation

2017-09-20 Thread Konstantin Ryadov
Hello! Could you explain context path (e.g. described on https://tomcat.apache.org/tomcat-7.0-doc/config/context.html ) value set in server.xml limitations? Does it exist any context path validation (unescaped symbols, whitespaces and so on)? Is first “/” always required in context path value

Re: applicatio shared path is not working on tomcat8 version

2017-08-29 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Naga, On 8/29/17 1:21 PM, Naga Ramesh wrote: > At present application configured on one of app server and jars > located on different server. > > So we have shared the jars folder and given the shared path of > classpath on to

RE: applicatio shared path is not working on tomcat8 version

2017-08-29 Thread Naga Ramesh
Chris, At present application configured on one of app server and jars located on different server. So we have shared the jars folder and given the shared path of classpath on tomcat end. But in tomcat 7 version is working fine but same shared path of jars classpath it's not working

Re: applicatio shared path is not working on tomcat8 version

2017-08-29 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Naga, On 8/28/17 12:38 PM, Naga Ramesh wrote: > Chris, We don’t have the context file on app/WEB-INF path You need to create a new one. > , that’s why we have done on /tomcat/conf/context.xml file. You have modified the defaults for the

RE: applicatio shared path is not working on tomcat8 version

2017-08-28 Thread Naga Ramesh
Chris, We don’t have the context file on app/WEB-INF path, that’s why we have done on /tomcat/conf/context.xml file. After that issue is resolved, but how do I resolve the issue, please guide me -Original Message- From: Christopher Schultz [mailto:ch...@christopherschultz.net] Sent

Re: applicatio shared path is not working on tomcat8 version

2017-08-28 Thread Christopher Schultz
ext.xml not $CATALINA_BASE/conf/context.xml - -chris > -Original Message- From: Christopher Schultz > [mailto:ch...@christopherschultz.net] Sent: Monday, August 28, 2017 > 8:11 PM To: users@tomcat.apache.org Subject: Re: applicatio shared > path is not working on tomcat8 version

RE: applicatio shared path is not working on tomcat8 version

2017-08-28 Thread Naga Ramesh
...@christopherschultz.net] Sent: Monday, August 28, 2017 8:11 PM To: users@tomcat.apache.org Subject: Re: applicatio shared path is not working on tomcat8 version -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Naga, On 8/27/17 12:24 PM, Naga Ramesh wrote: > Christopher, > > We have done

Re: applicatio shared path is not working on tomcat8 version

2017-08-28 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Naga, On 8/27/17 12:24 PM, Naga Ramesh wrote: > Christopher, > > We have done the load balancer configuration and one of the > properties file need to give the shared path and that shared path > need to give the tomcat end for som

RE: applicatio shared path is not working on tomcat8 version

2017-08-27 Thread Naga Ramesh
Christopher, We have done the load balancer configuration and one of the properties file need to give the shared path and that shared path need to give the tomcat end for some functionality purpose. So we have set the class path on tomcat7 and it's working fine but same thing we have tried

Re: applicatio shared path is not working on tomcat8 version

2017-08-27 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Naga, On 8/25/17 2:37 PM, Naga Ramesh wrote: > We have set the application shared class path on tomcat7 and it’s > working fine. > > But same thing we have set the tomcat8 version, it’s not working > and geting the below erro

applicatio shared path is not working on tomcat8 version

2017-08-25 Thread Naga Ramesh
Hi Team, We have set the application shared class path on tomcat7 and it's working fine. But same thing we have set the tomcat8 version, it's not working and geting the below errors please check and let me know the solution please. OS: windows: 25-Aug-2017 23:58:40.282 WARNING

Re: Source Package file path location in Tomcat

2017-05-30 Thread Simon De Uvarow
s, lo que siempre te ha hecho vivir." On Tue, May 30, 2017 at 4:40 AM, Shaik, Mohammad N. < mohammad.n.sh...@accenture.com> wrote: > Hello, > > Can you please help in sharing the Source Package file path location in > Tomcat 6 and 7 versions? > > We need to put the Sour

Source Package file path location in Tomcat

2017-05-30 Thread Shaik, Mohammad N.
Hello, Can you please help in sharing the Source Package file path location in Tomcat 6 and 7 versions? We need to put the Source Package of Tomcat 7 in Tomcat 6 so that we can use the security filters of Tomcat 7 in Tomcat 6. Regards, Mohammad Nayeem

Re: Skip resource path in TLD scanner?

2017-04-29 Thread Mark Thomas
.@apache.org] Sent: Friday, April 28, 2017 7:28 AM To: > Tomcat Users List <users@tomcat.apache.org> Subject: Re: Skip > resource path in TLD scanner? > > On 27/04/17 23:39, Matt Cosentino wrote: >> https://tomcat.apache.org/tomcat-8.0-doc/config/sy

RE: Skip resource path in TLD scanner?

2017-04-28 Thread Matt Cosentino
when our sites are down. - Matt -Original Message- From: Mark Thomas [mailto:ma...@apache.org] Sent: Friday, April 28, 2017 7:28 AM To: Tomcat Users List <users@tomcat.apache.org> Subject: Re: Skip resource path in TLD scanner? On 27/04/17 23:39, Matt Cosentino wrote: &

  1   2   3   4   5   6   7   8   9   10   >