Re: Tomcat 1.1 - release date

2007-11-06 Thread Ronald Klop

On Wed Oct 31 18:13:30 CET 2007 Tomcat Users List users@tomcat.apache.org 
wrote:

This may sound corny but I am just wondering. It looks like I am going
to be supporting a web app that is installed under Tomcat 1.1

Does anyone know what the release date of the Tomcat 1.1 was or the most
recent release date of Tomcat 1.1.x. 


Thanks!

Nick


I think they mean 'Apache-Coyote/1.1', which is the HTTP Server header sent by 
the Tomcat HTTP connector. This is not the same as the version number of Tomcat.

Ronald.

Re: Tomcat 3.3.1a problem

2007-11-06 Thread Pid
Mark Thomas wrote:
 Pid wrote:
 Marko Krejic wrote:
 Hi,
  
 We are running Tomcat 3.3.1a on a Windows Server 2003. A apache server is 
 also installed on the machine as a proxy and it is connected with the 
 tomcat through AJP12. Tomcat is running on JDK1.4.2_13.
 The silence you experienced is people being dumbfounded that you're
 running Tomcat 3 (versions up to and including 5.0 are now no longer
 supported) 
 
 This is not the case. Whilst 5.0.x is unsupported, 4.1.x is still supported
 (and will be for some time) and technically so is 3.3.x although 3.3.x is
 next on my list of things to ask the dev list if we want to de-support.

Lordy. I had no idea...

p

 and AJP12.  Tomcat 3 is ancient.
 
 Indeed ;)
 
 Mark
 
 
 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



cant make tomcat accept https

2007-11-06 Thread Yavuz Kavus
hi, everbody.

i am working newspaper daily view project.
we will make our costumers member of site.
so we want to take their information with https protocol.

i have been trying to make tomcat accept https request on 8443,
but i have failed so far.

step by step what i do are:
1 )
C:\Documents and Settings\Yavuzkeytool -genkey -alias tomcat -keyalg RSA
Enter keystore password:  changeit
What is your first and last name?
  [Unknown]:  yavuz
What is the name of your organizational unit?
  [Unknown]:  kavus
What is the name of your organization?
  [Unknown]:
What is the name of your City or Locality?
  [Unknown]:
What is the name of your State or Province?
  [Unknown]:
What is the two-letter country code for this unit?
  [Unknown]:
Is CN=localhost, OU=localdomain, O=Unknown, L=Unknown, ST=Unknown, C=Unknown
cor
rect?
  [no]:  yes

Enter key password for tomcat
(RETURN if same as keystore password):

C:\Documents and Settings\Yavuz

2) and i uncommented the part related to https as:
Connector port=8443 maxHttpHeaderSize=8192
   maxThreads=150 minSpareThreads=25 maxSpareThreads=75
   enableLookups=true disableUploadTimeout=true
   acceptCount=100 scheme=https secure=true
   clientAuth=false sslProtocol=TLS /

3) restarted tomcat and tried https://localhost:8443/   i got  :
The connection was interrupted
The connection to localhost:8443 was interrupted while the page was loading.


when i try http://localhost:8443/ (http instead of https), everything is ok.

i wonder where i made mistake(s).
can any body see where is my mistake(s)?

thanks for any help.


Re:Out of Office

2007-11-06 Thread mitesh . shah
I'll be out of office from 11/05/07, returning back on 11/14/07. Please contact 
ASP team if you need any assistance. 



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Tomcat causing high CPU load

2007-11-06 Thread Leon Rosenberg
On 11/6/07, Peng Tuck Kwok [EMAIL PROTECTED] wrote:
 Is there a link for Moskito?

http://moskito.anotheria.net
http://moskito.dev.java.net

the site is on the move (moving to something better desgined) so just ask :-)

Leon


 On Nov 6, 2007 6:21 AM, Leon Rosenberg [EMAIL PROTECTED] wrote:
  Moskito can display monitoring traces instantly (path through
  monitoring points) and measure time in each call and sub-calls, but it
  requires some source code adoption.
 
  regards
  Leon
 
 
  On 11/5/07, Caldarale, Charles R [EMAIL PROTECTED] wrote:
From: Caldarale, Charles R
Subject: RE: Tomcat causing high CPU load
   
There are also some 3rd-party tools to take thread dumps of
services (I think JProbe does, for example).
  
   Also, Lambda Probe (www.lambdaprobe.org) can display stack traces, but
   only one thread at a time.
  
- Chuck
  
  
   THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
   MATERIAL and is thus for use only by the intended recipient. If you
   received this in error, please contact the sender and delete the e-mail
   and its attachments from all computers.
  
   -
   To start a new topic, e-mail: users@tomcat.apache.org
   To unsubscribe, e-mail: [EMAIL PROTECTED]
   For additional commands, e-mail: [EMAIL PROTECTED]
  
  
 
  -
  To start a new topic, e-mail: users@tomcat.apache.org
  To unsubscribe, e-mail: [EMAIL PROTECTED]
  For additional commands, e-mail: [EMAIL PROTECTED]
 
 

 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Problems with a web application running a PHP script

2007-11-06 Thread Johnny Kewl


---
HARBOR: http://coolharbor.100free.com/index.htm
Now Tomcat is also a cool pojo application server
---
- Original Message - 
From: Rocco Scappatura [EMAIL PROTECTED]

To: Tomcat Users List users@tomcat.apache.org
Sent: Tuesday, November 06, 2007 9:17 AM
Subject: Re: Problems with a web application running a PHP script




Thanks for you hints. I will disinstall all JDK/JRE versions from my PC.
I'm dowloading JDK 6 Update 3 and I will install it.


No problem, you got me curious about scripting...
I Tested with this
==
   protected void processRequest(HttpServletRequest request, 
HttpServletResponse response)

   throws ServletException, IOException {
   response.setContentType(text/html;charset=UTF-8);
   PrintWriter out = response.getWriter();


   out.println(html);
   out.println(head);
   out.println(titleServlet NewServlet/title);
   out.println(/head);
   out.println(body);
   out.println();
   out.println(pStand Back... Script running/p);

 ScriptEngineManager scriptMgr = new ScriptEngineManager();
 ScriptEngine jsEngine = scriptMgr.getEngineByName(JavaScript);
 try {
   jsEngine.eval(var meJavaScript = 'Me-Java Script!';);
   out.println(p + jsEngine.get(meJavaScript) + /p);
 }
 catch (ScriptException ex) {
   out.println(pOh Damn! Script Crashed  + ex.getMessage() + 
/p);

   ex.printStackTrace();
 }

   out.println(/body);
   out.println(/html);
   out.close();
   }

===

Hey it works
But in the process I discovered a few things

+ Even if TC is installed on 1.5. if NB is using 1.6 and its run from 
the DEV enviroment... it will make TC use 1.6

So... thats probably whats happening to you.
Its easy to check because in NB system out it tells you which JRE is used.
And  when you start TC from the BAT it will tell you... as well... in your 
case probably 1.5


+ The Source level makes no difference in a servlet ie if the JRE is 
1.6, you cant bring it down, this is different to normal Java Programs that 
will do things like tell you it now doesnt understand a template... but in 
servlets it seems to ignore that.


Anyway it works
Quite neat the scripting thing
May even be the beginning of a new chapter in TC there are always guys 
saying... can TC run PHP, I see one can even run stuff like JavaFX

Thank u



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Tomcat 3.3.1a problem

2007-11-06 Thread Pid
Bill Barker wrote:
 I don't recognize the problem, but AJP12 was deprecated even for 3.3.1a 
 (which, for Pid's benifit, was a single security issue bugfix release from 
 3.3.1).  

Hat duly tipped.

p

 
 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
 
 


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Tomcat causing high CPU load

2007-11-06 Thread Andrew Miehs

Hi Bob,

Kill -3 TOMCAT PID

Will produce a stack trace in catalina.out

This problem is VERY most probably your code, and not tomcat, but a
stacktrace should show this.

ps auxwh

will also give you an indication, its probably just 1 thread pushing
you to such a high load.

As for walking through the code - don't forget this stuff is
multithreaded so its not so easy to walk through...

My bets are on an  unsynchronized HashMap.


Cheers

Andrew

On 05/11/2007, at 10:44 PM, Sai Bobba wrote:

Many thanks. We've had several developers walk through the code to  
try to

catch the possibity that the app may be sitting in a loop in some
situations. The code seems ok, and, as I indicated, we've never been  
able to
reproduce the situation. I've searched the web for taking thread  
dumps, as I
don't know how to do that, butg haven't been able to find anything.  
Perhaps

you could give me a pointer if you have the time.
Thanks again for your attention.

Bob




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Tricky remote JMX port problem

2007-11-06 Thread Michael Böckling
Hi!

I try using the org.apache.catalina.mbeans.JMXAdaptorLifecycleListener to 
connect to the JMX service using pre-defined ports. I added the following entry 
to my server.xml, and tomcat boots up ok:

Listener className=org.apache.catalina.mbeans.JMXAdaptorLifecycleListener 
namingPort=8616 port=8617 host=localhost/

I'm using putty to connect to the target machine to tunnel the required ports. 
And... it nearly works! The ports 8616 and 8617 on my machine are forwarded to 
the remote host, so the JMX URL looks like this: 

service:jmx:rmi://127.0.0.1:8617/jndi/rmi://127.0.0.1:8616/server

The log output of jconsole using this url is this:


06.11.2007 14:23:15 RMIConnector connect
FEINER: [javax.management.remote.rmi.RMIConnector: 
jmxServiceURL=service:jmx:rmi://127.0.0.1:8617/jndi/rmi://127.0.0.1:8616/server]
 connecting...
06.11.2007 14:23:15 RMIConnector connect
FEINER: [javax.management.remote.rmi.RMIConnector: 
jmxServiceURL=service:jmx:rmi://127.0.0.1:8617/jndi/rmi://127.0.0.1:8616/server]
 finding stub...
06.11.2007 14:23:36 RMIConnector connect
FEINER: [javax.management.remote.rmi.RMIConnector: 
jmxServiceURL=service:jmx:rmi://127.0.0.1:8617/jndi/rmi://127.0.0.1:8616/server]
 connecting stub...
06.11.2007 14:23:36 RMIConnector connect
FEINER: [javax.management.remote.rmi.RMIConnector: 
jmxServiceURL=service:jmx:rmi://127.0.0.1:8617/jndi/rmi://127.0.0.1:8616/server]
 getting connection...
06.11.2007 14:23:58 RMIConnector connect
FEINER: [javax.management.remote.rmi.RMIConnector: 
jmxServiceURL=service:jmx:rmi://127.0.0.1:8617/jndi/rmi://127.0.0.1:8616/server]
 failed to connect: java.rmi.ConnectException: Connection refused to host: 
10.151.232.24; nested exception is: 
java.net.ConnectException: Connection timed out: connect


Obviously, jconsole tries to connect using the wrong IP, 10.151.232.24 instead 
of 127.0.0.1 in this case. What can I do to prevent this? Is there any 
workaround? 

I'm thankful for any hints, I'm out of ideas... :(
Regards,


Michael


-- 
Michael Böckling
Java Engineer
dmc digital media center GmbH 
Rommelstraße 11 
70376 Stuttgart (Germany) 
Telefon: +49 711 601747-0
Telefax: +49 711 601747-141 
E-Mail: [EMAIL PROTECTED] 
Internet: www.dmc.de 

Handelsregister: AG Stuttgart HRB 18974 
Geschäftsführer: Andreas Magg, Daniel Rebhorn, Andreas Schwend  

-

Der beste B2B Online-Shop des Jahres 2007 heißt ratioform.de
Das Marketing-Konzept und die kreative Umsetzung kommen von dmc. 

Mehr Informationen: www.dmc.de


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Tomcat causing high CPU load

2007-11-06 Thread Charlie Wingate
There is a kill.exe (older version in resource kits) and a newer
taskkill.exe included with XP on; but neither of them will provide a
stack dump/trace.  Although they are very useful as tools and parts.
:)

~Charlie
 
 
The significant problems we have cannot be solved at the same level of
thinking with which we created them.
  - Albert Einstein

-Original Message-
From: Caldarale, Charles R [mailto:[EMAIL PROTECTED] 
Sent: Tuesday, November 06, 2007 9:28 AM
To: Tomcat Users List
Subject: RE: Tomcat causing high CPU load

 From: Andrew Miehs [mailto:[EMAIL PROTECTED] 
 Subject: Re: Tomcat causing high CPU load
 
 Kill -3 TOMCAT PID
 ps auxwh

The OP is running on Windows...

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]




 
 


This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals 
computer viruses.








---
This message is a CONFIDENTIAL communication.  If you are not the intended 
recipient, please do not read, copy, or use it, and do not disclose it to 
others.  Please notify the sender of the delivery error by replying to this 
message, and then delete it from your system.  Thank you.


This footnote confirms that this email message has been scanned by
PineApp Mail-SeCure for the presence of malicious code, vandals  computer 
viruses.





-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Tomcat causing high CPU load

2007-11-06 Thread Caldarale, Charles R
 From: Andrew Miehs [mailto:[EMAIL PROTECTED] 
 Subject: Re: Tomcat causing high CPU load
 
 Kill -3 TOMCAT PID
 ps auxwh

The OP is running on Windows...

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Environment variables

2007-11-06 Thread Andrew Hole
Hello!

how can I setup environment variables on tomcat windows service?
Tomcat cleans environment variables...

Thanks a lot

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: Environment variables

2007-11-06 Thread Caldarale, Charles R
 From: Andrew Hole [mailto:[EMAIL PROTECTED] 
 Subject: Environment variables
 
 how can I setup environment variables on tomcat windows service?
 Tomcat cleans environment variables...

You can't - services don't use environment variables.  Use the
tomcat?w.exe program to set Java system properties and heap values for
the service.

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you
received this in error, please contact the sender and delete the e-mail
and its attachments from all computers.

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Environment variables

2007-11-06 Thread Andrew Hole
I'm trying to execute a ssh command inside java code. SSH command must
know HOMEDRIVE environment variable to find know_hosts file... How can
I do that?

Thanks a lot

On Nov 6, 2007 3:14 PM, Caldarale, Charles R [EMAIL PROTECTED] wrote:
  From: Andrew Hole [mailto:[EMAIL PROTECTED]
  Subject: Environment variables
 
  how can I setup environment variables on tomcat windows service?
  Tomcat cleans environment variables...

 You can't - services don't use environment variables.  Use the
 tomcat?w.exe program to set Java system properties and heap values for
 the service.

  - Chuck


 THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
 MATERIAL and is thus for use only by the intended recipient. If you
 received this in error, please contact the sender and delete the e-mail
 and its attachments from all computers.

 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: [OT] Tomcat causing high CPU load

2007-11-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Charlie,

Charlie Wingate wrote:
 There is a kill.exe (older version in resource kits) and a newer
 taskkill.exe included with XP [onward]

Note that taskkill.exe and UNIX kill are completely different. taskkill
actually kills tasks, while the UNIX kill sends signals to processes.

 but neither of them will provide a
 stack dump/trace.

That is because of the lack of signaling ability of taskkill.exe.

 Although they are very useful as tools and parts.

Definitely. I had no idea this program existed. My experience with MS
Windows is that programs kill themselves frequently enough that I
probably will continue to never need this tool ;)

- -chris

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHMIZp9CaO5/Lv0PARApJmAJ4p55P3qwyLtMmLDVlc6jyPayhQ2wCgh//n
zSjOq8EFoYEqbQz9ZLqq0bE=
=poDw
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Environment variables

2007-11-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Andrew,

Andrew Hole wrote:
 I'm trying to execute a ssh command inside java code. SSH command must
 know HOMEDRIVE environment variable to find know_hosts file... How can
 I do that?

How are you invoking ssh? If you're doing a standard Runtime.exec, why
not just use the versions of that method which take environment
variables as parameters?

- -chris

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHMIcT9CaO5/Lv0PARAmbgAJwLJiMu33Cs8qdsBoG2afUuVFvJ0wCgmDmD
tuvpCb2Wc21yYuc1w+q8GJA=
=fG1R
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Environment variables

2007-11-06 Thread Andrew Hole
I will try!!! Thanks a lot

On Nov 6, 2007 3:24 PM, Christopher Schultz
[EMAIL PROTECTED] wrote:
 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA1

 Andrew,

 Andrew Hole wrote:
  I'm trying to execute a ssh command inside java code. SSH command must
  know HOMEDRIVE environment variable to find know_hosts file... How can
  I do that?

 How are you invoking ssh? If you're doing a standard Runtime.exec, why
 not just use the versions of that method which take environment
 variables as parameters?

 - -chris

 -BEGIN PGP SIGNATURE-
 Version: GnuPG v1.4.7 (MingW32)
 Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

 iD8DBQFHMIcT9CaO5/Lv0PARAmbgAJwLJiMu33Cs8qdsBoG2afUuVFvJ0wCgmDmD
 tuvpCb2Wc21yYuc1w+q8GJA=
 =fG1R
 -END PGP SIGNATURE-


 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]



-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Environment variables

2007-11-06 Thread Gabe Wong


Andrew Hole wrote:

I'm trying to execute a ssh command inside java code. SSH command must
know HOMEDRIVE environment variable to find know_hosts file... How can
I do that?
  

Hi Andrew,
You can pass the value as a Java Option. Click the Tomcat Service 
Manager icon (usually lower right of the Windows Taskbar).

Click the Java Tab. Then append to the bottom of Java Options.




--
Regards

Gabe Wong
NGASI AppServer Manager
Application server installation and configuration AUTOMATION
http://www.ngasi.com


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



tomcat 4 history

2007-11-06 Thread Petr Sumbera

Hi All,

I'm lost between various versions of Tomcat and relations between them. 
Can you please help me to answer some questions?


1. What happened to Jakarta Tomcat 4.0 (last version I can see is 4.0.6)

2. What is relation between Jakarta Tomcat 4.0 and Apache Tomcat 4.1? 
Are they compatible?


3. Is Apache Tomcat 4.1 supported and all security problems are fixed there?

Thanks.

Petr


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Difference between org.apacha.catalina.Session and javax.servlet.http.HttpSession

2007-11-06 Thread Bárbara Vieira
Hi there!

This question is about Tomcat’s Architecture and CoyoteConnectors.

 

I would like to know the difference between
Session(org.apacha.catalina.Session) and
HttSession(javax.servlet.http.HttpSession) objects. 

In Request(org.apache.catalina.connector.Request) object  I get HttpSession
– request.getSession()  and Session – request.getSessionInternal() objects,
but I don’t know the difference between this objects on Tomcat’s
Architecture.  I suppose that this objects represents different sessions in
my Web Application, but this doesn’t make sense, because each Web
Application just have one session scope. 

I know that HttpSession is available from Session object –
session.getSession().

Another question about it is that, when I invalidate the HttpSession, am I
invalidating Session object too?

 

Thanks for help me,

Regards from Braga, Portugal

Bárbara Vieira



Would it made any sense to use an in memory session.JDBCStore . . .

2007-11-06 Thread Albretch Mueller
~
 or simply set a negative maxInactiveInterval?
~
 IMHO it is best to put lots of RAM in your box and set a high or
negative maxInactiveInterval, but I may be missing some basic issues
and I don't know the details of tomcats inner working
~
 Another question that has been floating in my mind; in case you use
multiple virtual hosts, can we be absolutely sure sessions belonging
to different virtual host aren't going to interfere with each other,
even if we use inmem DBs in the same JVM and loaded within the same
class loader/TC's?
~
 Thanks
 lbrtchx

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: tomcat 4 history

2007-11-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Petr,

Petr Sumbera wrote:
 1. What happened to Jakarta Tomcat 4.0 (last version I can see is 4.0.6)
 
 2. What is relation between Jakarta Tomcat 4.0 and Apache Tomcat 4.1?
 Are they compatible?

 3. Is Apache Tomcat 4.1 supported and all security problems are fixed
 there?

See http://tomcat.apache.org/whichversion.html#Apache Tomcat 4.x

All Tomcat 4.x versions are compatible in that they implement the 2.3
version of the servlet API and the 1.2 version of the JSP specification.

Tomcat 4.1 would be a better choice than 4.0 due to its refactoring and
other improvements. Tomcat 4.1 has been updated with some of the more
recent appropriate security updates, and it is still officially
supported (for now).

If you have the opportunity, you should upgrade to 5.5 or 6.0, but
Tomcat 4.1 is still supported.

- -chris

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHMJbt9CaO5/Lv0PARApHIAJ9iN1E5+DiFrqtMTnn5JLdW8ViQyACgqowD
/dra2J11RdpQCB0lg9eSS18=
=1iy+
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



RE: tomcat 4 history

2007-11-06 Thread Propes, Barry L
I had to upgrade from TC 4.0 to 4.1.31 (the version I have) to get database 
connection pooling working.

Just FYI.

Still wrestling with the JSTL of it...had some slight issues there, but it 
should work.

-Original Message-
From: Christopher Schultz [mailto:[EMAIL PROTECTED]
Sent: Tuesday, November 06, 2007 10:32 AM
To: Tomcat Users List
Subject: Re: tomcat 4 history


-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Petr,

Petr Sumbera wrote:
 1. What happened to Jakarta Tomcat 4.0 (last version I can see is 4.0.6)
 
 2. What is relation between Jakarta Tomcat 4.0 and Apache Tomcat 4.1?
 Are they compatible?

 3. Is Apache Tomcat 4.1 supported and all security problems are fixed
 there?

See http://tomcat.apache.org/whichversion.html#Apache Tomcat 4.x

All Tomcat 4.x versions are compatible in that they implement the 2.3
version of the servlet API and the 1.2 version of the JSP specification.

Tomcat 4.1 would be a better choice than 4.0 due to its refactoring and
other improvements. Tomcat 4.1 has been updated with some of the more
recent appropriate security updates, and it is still officially
supported (for now).

If you have the opportunity, you should upgrade to 5.5 or 6.0, but
Tomcat 4.1 is still supported.

- -chris

-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHMJbt9CaO5/Lv0PARApHIAJ9iN1E5+DiFrqtMTnn5JLdW8ViQyACgqowD
/dra2J11RdpQCB0lg9eSS18=
=1iy+
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: cant make tomcat accept https

2007-11-06 Thread Gabe Wong

Yavuz Kavus wrote:

2) and i uncommented the part related to https as:
Connector port=8443 maxHttpHeaderSize=8192
   maxThreads=150 minSpareThreads=25 maxSpareThreads=75
   enableLookups=true disableUploadTimeout=true
   acceptCount=100 scheme=https secure=true
   clientAuth=false sslProtocol=TLS /

3) restarted tomcat and tried https://localhost:8443/   i got  :
The connection was interrupted
The connection to localhost:8443 was interrupted while the page was loading.


when i try http://localhost:8443/ (http instead of https), everything is ok.

i wonder where i made mistake(s).
can any body see where is my mistake(s)?

thanks for any help.

  


You need to include the keystore path in the SSL confiiguration like so:
   Connector port=8443 maxHttpHeaderSize=8192
  maxThreads=150 minSpareThreads=25 maxSpareThreads=75
  enableLookups=false disableUploadTimeout=true
  acceptCount=100 scheme=https secure=true
  clientAuth=false sslProtocol=TLS 
keystoreFile=./conf/keystore/


--
Regards

Gabe Wong
NGASI AppServer Manager
Application server installation and configuration AUTOMATION
http://www.ngasi.com


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Arbitrary headers

2007-11-06 Thread Gustavo Noronha
Hello,

I want to have the HTTP server of Tomcat add arbitrary headers to every
response. As an example, I'd like every request to have in its response, for
instance:

X-MyOwnHeader = lala

Something like Apache HTTPD's mod_headers. Is there a way to do that?

Thanks,

-- 
Gustavo Noronha Silva
Coordenação de Segurança e Sustentação
Ministério do Desenvolvimento Social - Brasil


Re: Arbitrary headers

2007-11-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1

Gustavo,

Gustavo Noronha wrote:
 I want to have the HTTP server of Tomcat add arbitrary headers to every
 response. As an example, I'd like every request to have in its response, for
 instance:
 
 X-MyOwnHeader = lala
 
 Something like Apache HTTPD's mod_headers. Is there a way to do that?

Write a servlet filter and attach the headers to all responses.

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHMK179CaO5/Lv0PARAhVLAJ91G8PS2cnf1nwzlGDBfgeBlOmJZACfWR/2
fJULsbht1Xw7Q5iCKCo/EI8=
=q9os
-END PGP SIGNATURE-

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Problems with a web application running a PHP script

2007-11-06 Thread Rocco Scappatura
 Thanks for you hints. I will disinstall all JDK/JRE versions from my PC.
 I'm dowloading JDK 6 Update 3 and I will install it.

 No problem, you got me curious about scripting...
 I Tested with this
 ==
 protected void processRequest(HttpServletRequest request,
 HttpServletResponse response)
 throws ServletException, IOException {
 response.setContentType(text/html;charset=UTF-8);
 PrintWriter out = response.getWriter();


 out.println(html);
 out.println(head);
 out.println(titleServlet NewServlet/title);
 out.println(/head);
 out.println(body);
 out.println();
 out.println(pStand Back... Script running/p);

   ScriptEngineManager scriptMgr = new ScriptEngineManager();
   ScriptEngine jsEngine = scriptMgr.getEngineByName(JavaScript);
   try {
 jsEngine.eval(var meJavaScript = 'Me-Java Script!';);
 out.println(p + jsEngine.get(meJavaScript) + /p);
   }
   catch (ScriptException ex) {
 out.println(pOh Damn! Script Crashed  + ex.getMessage() +
 /p);
 ex.printStackTrace();
   }

 out.println(/body);
 out.println(/html);
 out.close();
 }

 ===

 Hey it works
 But in the process I discovered a few things

 + Even if TC http://webmail.sttspa.it/src/webmail.php
Mail for rscappatis installed on 1.5. if NB is using 1.6 and its run from
 the DEV enviroment... it will make TC use 1.6
 So... thats probably whats happening to you.
 Its easy to check because in NB system out it tells you which JRE is used.
 And  when you start TC from the BAT it will tell you... as well... in your
 case probably 1.5

 + The Source level makes no difference in a servlet ie if the JRE is
 1.6, you cant bring it down, this is different to normal Java Programs
 that
 will do things like tell you it now doesnt understand a template... but in
 servlets it seems to ignore that.

 Anyway it works

OK. I ve tried toaccomplish all the steps I sayd in my previous email. It
is a war! Before report you the output at TC starting, I would like to
best depict my environment:

- Two services:

   1) Catalina. With a connector listening on port 8080, with manager and
admin bundle application deploied)
   2) Rocsca. With a connector listening on port 80, with other two
application one of which I have developed (in part) and which I would
like to debug and to continue to develop. Moreover I would liketo setup
the other application and to setup both so that they can interact.

I get get a long series of errors at TC startup, some of which are obvious
(but I report as well because I'ld like to correct my trivial errors in
setting up my devel environment..):

Using CATALINA_BASE:   C:\Tomcat
Using CATALINA_HOME:   C:\Tomcat
Using CATALINA_TMPDIR: C:\Tomcat\temp
Using JRE_HOME:C:\Programmi\Java\jdk1.6.0_03
6-nov-2007 20.14.23 org.apache.catalina.core.AprLifecycleListener
lifecycleEvent
INFO: The Apache Tomcat Native library which allows optimal performance in
production environments was not found on the java.library.path:
C:\Programmi\Java\jdk1.6.0_03\bin;.;C:\WINDOWS\Sun\Java\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\Perl\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\Programmi\PC-Doctor
for Windows\services;C:\Programmi\QuickTime\QTSystem\;C:\Programmi\IDM
Computer
Solutions\UltraEdit-32;C:\Programmi\WinSCP\;C:\Programmi\ZipGenius
6\;C:\php5;C:\Programmi\MySQL\MySQL Server
5.0\bin;C:\Programmi\Java\jdk1.5.0_13\bin
6-nov-2007 20.14.23 org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-80
6-nov-2007 20.14.23 org.apache.coyote.http11.Http11BaseProtocol init
GRAVE: Error initializing endpoint
java.net.BindException: Address already in use: JVM_Bind:80
at
org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(PoolTcpEndpoint.java:298)
at
org.apache.coyote.http11.Http11BaseProtocol.init(Http11BaseProtocol.java:139)
at
org.apache.catalina.connector.Connector.initialize(Connector.java:1017)
at
org.apache.catalina.core.StandardService.initialize(StandardService.java:578)
at
org.apache.catalina.core.StandardServer.initialize(StandardServer.java:782)
at org.apache.catalina.startup.Catalina.load(Catalina.java:504)
at org.apache.catalina.startup.Catalina.load(Catalina.java:524)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:267)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:432)
6-nov-2007 20.14.23 org.apache.catalina.startup.Catalina load

Stop Caching Flash files

2007-11-06 Thread MyTest Email
I need to set tomcat to allways send a new copy of the flash file on the
server and not send a cached copy, not have proxy servers cache the file,
etc.

I know that there are client, server and proxy issues but I'm looking to see
what tomcat configuration can do to assit me to have proxy servers and
tomcat not cache the flash files.

With Apache's mod_expire you can set specific file types to not be cached.
This is claimed to be great for proxy servers.



e.g.



ExpiresActive On

ExpiresByType image/gif A2592000

ExpiresByType image/png A2592000

ExpiresByType image/jpg A2592000

ExpiresByType image/jpeg A2592000

ExpiresByType application/x-javascript A2592000

ExpiresByType application/x-Shockwave-Flash A2592000


is there an equivalent method for tomcat?

Thanks in advance
-Steve


Re: Difference between org.apacha.catalina.Session and javax.servlet.http.HttpSession

2007-11-06 Thread Bill Barker

Bárbara Vieira [EMAIL PROTECTED] wrote in message 
news:[EMAIL PROTECTED]
Hi there!

This question is about Tomcat's Architecture and CoyoteConnectors.



I would like to know the difference between
Session(org.apacha.catalina.Session) and
HttSession(javax.servlet.http.HttpSession) objects.


The Session is Tomcat's internal representation of the data that the webapp 
will see in the HttpSession.  It more or less acts as the storage for the 
information in the HttpSession.  In particular, if the session is 
passivated, it is the Session object that is written out.  What happens is 
that the HttpSession instance has a reference to the Session and for the 
most part calls methods on the Session to implement it's own methods.  In 
most configurations, the concrete class implementing the Session interface 
is o.a.c.session.StandardSession, and the concrete class implementing 
HttpSession is o.a.c.session.StandardSessionFacade.  Looking at those 
classes should clear up the relationship between the two interfaces.

In Request(org.apache.catalina.connector.Request) object  I get HttpSession
- request.getSession()  and Session - request.getSessionInternal() objects,
but I don't know the difference between this objects on Tomcat's
Architecture.  I suppose that this objects represents different sessions in
my Web Application, but this doesn't make sense, because each Web
Application just have one session scope.


This represents the session that is particular to this particular Request. 
However, if you have access to the Session, you can poke around at other 
people's sessions as well.

I know that HttpSession is available from Session object -
session.getSession().


This is what the Request calls to get the HttpSession that it returns to the 
calling webapp.

Another question about it is that, when I invalidate the HttpSession, am I
invalidating Session object too?


Yes you are.



Thanks for help me,

Regards from Braga, Portugal

Bárbara Vieira





-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: tomcat 4 history

2007-11-06 Thread Bill Barker

Petr Sumbera [EMAIL PROTECTED] wrote in message 
news:[EMAIL PROTECTED]
 Hi All,

 I'm lost between various versions of Tomcat and relations between them. 
 Can you please help me to answer some questions?

 1. What happened to Jakarta Tomcat 4.0 (last version I can see is 4.0.6)


It was superceded by 4.1.x :).

 2. What is relation between Jakarta Tomcat 4.0 and Apache Tomcat 4.1? Are 
 they compatible?


While TC 4.0 started out as a Revolution, TC 4.1 is an Evolution over that. 
As Chris mentioned, they are compatible if you are only using the Servlet 
2.3/JSP 1.2 APIs.  However, I don't believe that they are compatible if you 
have custom Realms, Valves, etc.  But I think most of the time you just need 
to recompile your custom component against 4.1.  Also, the 4.0 Connectors 
are deprecated in 4.1 in favor of the Coyote Connectors.  So you shouldn't 
expect to just copy over your server.xml file and have it work well.

 3. Is Apache Tomcat 4.1 supported and all security problems are fixed 
 there?


Tomcat 4.1 is supported (hey, we just shocked people yesterday telling them 
that 3.3 is still supported :), mostly by Mark.  Since he also is mostly 
updating the Tomcat security pages, I'm guessing that all of the known 
security problems are fixed there, but I haven't done an audit (don't use it 
in my day job anymore).

 Thanks.

 Petr


 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]

 




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Stop Caching Flash files

2007-11-06 Thread Bill Barker

MyTest Email [EMAIL PROTECTED] wrote in message 
news:[EMAIL PROTECTED]
I need to set tomcat to allways send a new copy of the flash file on the
 server and not send a cached copy, not have proxy servers cache the file,
 etc.

 I know that there are client, server and proxy issues but I'm looking to 
 see
 what tomcat configuration can do to assit me to have proxy servers and
 tomcat not cache the flash files.


It is possible to set cachingAllowed=false on the Context / element to 
prevent Tomcat from caching, but except in extreme cases it is usually 
useless because of a short TTL (5sec by default).  See 
http://tomcat.apache.org/tomcat-5.5-doc/config/context.html for more details 
on Tomcat caching options.

Otherwise, you have to roll your own Filter that will set the caching 
headers (Expires, Cache-Control, Pragma, etc) to control proxy server 
caching.  Tomcat doesn't provide anything out-of-the-box to do this sort of 
thing.



 With Apache's mod_expire you can set specific file types to not be cached.
 This is claimed to be great for proxy servers.



 e.g.



 ExpiresActive On

 ExpiresByType image/gif A2592000

 ExpiresByType image/png A2592000

 ExpiresByType image/jpg A2592000

 ExpiresByType image/jpeg A2592000

 ExpiresByType application/x-javascript A2592000

 ExpiresByType application/x-Shockwave-Flash A2592000


 is there an equivalent method for tomcat?

 Thanks in advance
 -Steve
 




-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Stop Caching Flash files

2007-11-06 Thread MyTest Email
I will start on a filter now

Thanks Bill


On 11/6/07, Bill Barker [EMAIL PROTECTED] wrote:


 MyTest Email [EMAIL PROTECTED] wrote in message
 news:[EMAIL PROTECTED]
 I need to set tomcat to allways send a new copy of the flash file on the
  server and not send a cached copy, not have proxy servers cache the
 file,
  etc.
 
  I know that there are client, server and proxy issues but I'm looking to
  see
  what tomcat configuration can do to assit me to have proxy servers and
  tomcat not cache the flash files.
 

 It is possible to set cachingAllowed=false on the Context / element to
 prevent Tomcat from caching, but except in extreme cases it is usually
 useless because of a short TTL (5sec by default).  See
 http://tomcat.apache.org/tomcat-5.5-doc/config/context.html for more
 details
 on Tomcat caching options.

 Otherwise, you have to roll your own Filter that will set the caching
 headers (Expires, Cache-Control, Pragma, etc) to control proxy server
 caching.  Tomcat doesn't provide anything out-of-the-box to do this sort
 of
 thing.



  With Apache's mod_expire you can set specific file types to not be
 cached.
  This is claimed to be great for proxy servers.
 
 
 
  e.g.
 
 
 
  ExpiresActive On
 
  ExpiresByType image/gif A2592000
 
  ExpiresByType image/png A2592000
 
  ExpiresByType image/jpg A2592000
 
  ExpiresByType image/jpeg A2592000
 
  ExpiresByType application/x-javascript A2592000
 
  ExpiresByType application/x-Shockwave-Flash A2592000
 
 
  is there an equivalent method for tomcat?
 
  Thanks in advance
  -Steve
 




 -
 To start a new topic, e-mail: users@tomcat.apache.org
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]




serving files through SSL

2007-11-06 Thread Roger Parkinson
I am trying to deliver some PDFs to the browser using my tomcat 
application. It works, but not always under SSL and IE.
One file is a static PDF and it lives inside my war file. That works 
just fine. The file is accessed using a url like /myapp/web/myfile.pdf 
and that always delivers the file.
Other files are generated by the app and live in a configured directory. 
They are delivered through a servlet that looks like this:


   String mimeType = sc.getMimeType(filename);
   FileHelper helper = new FileHelper();
   InputStream in = helper.fetch(filename, m_dir);
   response.setContentType(mimeType);
 response.setContentLength(10115);
 response.addHeader(ETag,W/\963288-1194247031062);
   OutputStream out = response.getOutputStream();
   byte[] buf = new byte[1024];
   int count = 0;
   while ((count = in.read(buf)) = 0)
   {
   out.write(buf, 0, count);
   }
   in.close();
   out.close();

So apart from some minor fiddling with the contentType etc I don't do 
very much. This works fine outside of SSL and it also works fine with 
SSL and Firefox, but not SSL+IE.
Thinking it was a problem with headers I did some research and found a 
lot of stuff about setting no cache etc. Tried it and it nothing made 
any difference (except that I managed to break it). I have taken all 
those out because the static file, the one I mentioned at first, is 
delivering okay to IE over SSL so I don't believe there is a problem at 
the IE end, or not one that cannot be overcome by getting my response 
right at the server end.


I used TCPMonitor to sniff the headers using non-SSL and found that the 
static file has this response:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/963288-1194247031062
Last-Modified: Mon, 05 Nov 2007 07:17:11 GMT
Content-Type: application/pdf
Content-Length: 963288
Date: Wed, 07 Nov 2007 04:54:39 GMT
... pdf file follows

So there doesn't seem to be too much going on there.

When I respond to the request for the dynamic file it looks like this:
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 12:00:00 NZST
ETag: W/963288-1194247031062
Content-Type: application/pdf
Content-Length: 10115
Date: Wed, 07 Nov 2007 05:32:02 GMT

...pdf file follows.

I am getting some cache headers added for free otherwise there is no 
difference in the request.
Of course those headers may be making all the difference because IE's 
message is 'cannot write the file to cache' which is a bit odd because 
we've explicitly told it not to here.
Searching the web on this has a number of answers that suggest adding 
those no-cache headers anyway.


So, does anyone know what I need to do to make the two responses enough 
the same to stop IE complaining?
I am aware that I have faked the ETag and the length of the file and 
that I need to do something smarter there, but I'll do that when it 
starts working.


Version info: Tomcat 5.5, Java 1.5, WinXP SP2

Thanks for your help.
Roger

-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Tomcat 5.5.23 SingleSignOn Thread-safe?

2007-11-06 Thread Timothy Wonil Lee
Hi,

 

I'm using Tomcat 5.5.23 with SSO enabled. I also implemented a customer
Realm (extending RealmBase).

It's been working great but just recently I've noticed that some session
mix-up happening under high load.

I am at loss to find where/why this happened. I looked at my own Realm
implementation, but authenticate() method is called only once when user
first authenticates himself. Subsequent calls does not invoke authenticate()
method in my customer Realm, so it must be handled somewhere else in Tomcat
code.

 

Can anybody point me to a right direction, please?

 

 

 

 http://www.google.com/reader/shared/16849249410805339619 Timothy Wonil
Lee

 

Java Developer

 http://www.koorong.com/ Koorong Books

email:  mailto:[EMAIL PROTECTED] [EMAIL PROTECTED]

direct ph: (+612) 9857 4448

direct fax: (+612) 9857 6648

 



Re: serving files through SSL

2007-11-06 Thread Gabe Wong

Roger Parkinson wrote:
I am trying to deliver some PDFs to the browser using my tomcat 
application. It works, but not always under SSL and IE.
One file is a static PDF and it lives inside my war file. That works 
just fine. The file is accessed using a url like /myapp/web/myfile.pdf 
and that always delivers the file.
Other files are generated by the app and live in a configured 
directory. They are delivered through a servlet that looks like this:


   String mimeType = sc.getMimeType(filename);
   FileHelper helper = new FileHelper();
   InputStream in = helper.fetch(filename, m_dir);
   response.setContentType(mimeType);
 response.setContentLength(10115);
 response.addHeader(ETag,W/\963288-1194247031062);
   OutputStream out = response.getOutputStream();
   byte[] buf = new byte[1024];
   int count = 0;
   while ((count = in.read(buf)) = 0)
   {
   out.write(buf, 0, count);
   }
   in.close();
   out.close();

So apart from some minor fiddling with the contentType etc I don't do 
very much. This works fine outside of SSL and it also works fine with 
SSL and Firefox, but not SSL+IE.
Thinking it was a problem with headers I did some research and found a 
lot of stuff about setting no cache etc. Tried it and it nothing made 
any difference (except that I managed to break it). I have taken all 
those out because the static file, the one I mentioned at first, is 
delivering okay to IE over SSL so I don't believe there is a problem 
at the IE end, or not one that cannot be overcome by getting my 
response right at the server end.


I used TCPMonitor to sniff the headers using non-SSL and found that 
the static file has this response:

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
ETag: W/963288-1194247031062
Last-Modified: Mon, 05 Nov 2007 07:17:11 GMT
Content-Type: application/pdf
Content-Length: 963288
Date: Wed, 07 Nov 2007 04:54:39 GMT
... pdf file follows

So there doesn't seem to be too much going on there.

When I respond to the request for the dynamic file it looks like this:
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Pragma: No-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 12:00:00 NZST
ETag: W/963288-1194247031062
Content-Type: application/pdf
Content-Length: 10115
Date: Wed, 07 Nov 2007 05:32:02 GMT

...pdf file follows.

I am getting some cache headers added for free otherwise there is no 
difference in the request.
Of course those headers may be making all the difference because IE's 
message is 'cannot write the file to cache' which is a bit odd because 
we've explicitly told it not to here.
Searching the web on this has a number of answers that suggest adding 
those no-cache headers anyway.


So, does anyone know what I need to do to make the two responses 
enough the same to stop IE complaining?
I am aware that I have faked the ETag and the length of the file and 
that I need to do something smarter there, but I'll do that when it 
starts working.


Version info: Tomcat 5.5, Java 1.5, WinXP SP2

Are you calling the dynamic PDF URL directly? For instance typing in the 
URL directly in the browser?
The reason I am asking, is that for mixed responses from SSL requests, 
IE puts up a warning, whereas FF does not.




--
Regards

Gabe Wong
NGASI AppServer Manager
Application server installation and configuration AUTOMATION
http://www.ngasi.com


-
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]