Am 13.10.2017 um 09:01 schrieb Mark Thomas: > From memory, # isn't one of the allowed exceptions. > > The full list of invalid characters in the request line that Tomcat > started to check for is: > ' ', '\"', '#', '<', '>', '\\', '^', '`', '{', '|', '}' > > The allowed exceptions are (currently) '{', '|', '}' > > Mark By the way:
While fully agreeing, that the '#' character should not be sent by a client to the server, it still would be desirable to have those three by optional configuration allowed characters, also be made a configurable exception in Tomcat 9. As fas as I know, this option has been allowed up to and including Tomcat 8.5 only. While it is a good thing to save the world, real world scenarios may differ. Thanks for considering. Markus --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org