Re: QUESTION: How do I change JSESSIONID to something else?

2008-02-06 Thread Gregory Gerard
that fits with what I saw as well. A follow up question for 100: why does the spec define this at all and why does Tomcat not let me work around it when it happily lets me violate other parts of the spec? greg Len Popp wrote: I'm not sure whether you mean the cookie or the URL parameter, bu

catalina.out is not reloading

2008-02-06 Thread persistence k
Hi, whenever I restart the tomcat in linux, the file ' catalina.out ' is not automatically reloading just like the file ' std.out ' does in windows. ' catalina.out ' file containing all the 'System.out ' statements printed from the day tomcat was installed in my linux system. Please tell me a so

Re: proxy trouble

2008-02-06 Thread fan0o
Konstantin Kolinko wrote: > > It is browser configuration issue. > > You should add "172.168.0.15" or "172.168.0.*" to the list of > not-proxied servers in your browser. > > In Internet Explorer look where the proxy is configured (on the > Connections tab), and there is "Advanced..." button.

RE: Custom 404 for non-existant contexts?

2008-02-06 Thread Caldarale, Charles R
> From: news [mailto:[EMAIL PROTECTED] On Behalf Of Eric B. > Subject: Re: Custom 404 for non-existant contexts? > > Would just modifying the ROOT/WEB-INF/web.xml work? It should, since any unmatched context paths are given to the default app for processing (and usually a 404). This is different

Re: Custom 404 for non-existant contexts?

2008-02-06 Thread Eric B.
> |>> > |>> Is there a way to create a custom 404 error page for Tomcat > |>> for non-existant context paths? > | > |> What happens if you declare a custom error page for the ROOT (default) > |> webapp? > | > | Yeah - that's pretty much the only thing I managed to figure out. I > updated > | the c

Re: QUESTION: How do I change JSESSIONID to something else?

2008-02-06 Thread Len Popp
I'm not sure whether you mean the cookie or the URL parameter, but the answer is the same in both cases: Change the constant in the code and re-compile Tomcat. There's no other way that I can see. -- Len On Feb 6, 2008 10:15 PM, Gregory Gerard <[EMAIL PROTECTED]> wrote: > thanks, > greg > > > --

Re: Custom 404 for non-existant contexts?

2008-02-06 Thread Filip Hanik - Dev Lists
you;d have to custom do it http://people.apache.org/~fhanik/covalent-error-report-valve.jar Filip Eric B. wrote: Is there a way to create a custom 404 error page for Tomcat for non-existant context paths? I know how to create a custom 404 error page within my application, but am running int

Re: Performace problem when invoking RMI call from Tomcat Servlet

2008-02-06 Thread Filip Hanik - Dev Lists
cause you probably start the JVM running junit with different start up params than the one running the servlet container filip Barak Yaish wrote: So why there is a difference in the latency when invoking the method from Junit and from the servlet? -Original Message- From: Filip Hanik

Re: Performace problem when invoking RMI call from Tomcat Servlet

2008-02-06 Thread Martin Gainty
check with pathping FQDNOrIPAddressOfServer HTH Martin - Original Message - From: "Filip Hanik - Dev Lists" <[EMAIL PROTECTED]> To: "Tomcat Users List" Sent: Wednesday, February 06, 2008 2:08 PM Subject: Re: Performace problem when invoking RMI call from Tomcat Servlet > could be either

QUESTION: How do I change JSESSIONID to something else?

2008-02-06 Thread Gregory Gerard
thanks, greg - To start a new topic, e-mail: users@tomcat.apache.org To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]

Re: proxy trouble

2008-02-06 Thread Konstantin Kolinko
It is browser configuration issue. You should add "172.168.0.15" or "172.168.0.*" to the list of not-proxied servers in your browser. In Internet Explorer look where the proxy is configured (on the Connections tab), and there is "Advanced..." button. Click it to open advanced proxies configuratio

Re: Custom 404 for non-existant contexts?

2008-02-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Eric, Eric B. wrote: | "Caldarale, Charles R" <[EMAIL PROTECTED]> wrote in message | news:[EMAIL PROTECTED] |>> Subject: Custom 404 for non-existant contexts? |>> |>> Is there a way to create a custom 404 error page for Tomcat |>> for non-existant co

Re: Custom 404 for non-existant contexts?

2008-02-06 Thread Eric B.
"Caldarale, Charles R" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] >> Subject: Custom 404 for non-existant contexts? >> >> Is there a way to create a custom 404 error page for Tomcat >> for non-existant context paths? >What happens if you declare a custom error page for the ROOT (

Re: How to avoid session fixation? [securityfilter-specific response]

2008-02-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 All, Christopher Schultz wrote: | This is interesting for the securityfilter project, which DOES allow | drive-by logins. Hmm. I'll have to think about this one. Thanks! I checked, and a login attempt on an existing authenticated session results in

Re: How to avoid session fixation?

2008-02-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 David, david delbecq wrote: | Sorry Christopher, but i tried at work, it's very easy to force a user | to use a specific sessionid, and later use yourself that session id to | gain that user's credential, and for the whole session there is only one |

Re: How to avoid session fixation?

2008-02-06 Thread david delbecq
Sorry Christopher, but i tried at work, it's very easy to force a user to use a specific sessionid, and later use yourself that session id to gain that user's credential, and for the whole session there is only one login, the one from the user you attempt to hijack. As such, tomcat is vulnerabl

RE: Custom 404 for non-existant contexts?

2008-02-06 Thread Caldarale, Charles R
> From: news [mailto:[EMAIL PROTECTED] On Behalf Of Eric B. > Subject: Custom 404 for non-existant contexts? > > Is there a way to create a custom 404 error page for Tomcat > for non-existant context paths? What happens if you declare a custom error page for the ROOT (default) webapp? - Chuck

RE: Tomcat and Apache mod_jk For Failover

2008-02-06 Thread David Brown
Hello, webmin has the HA monitor module that helps with setup and config on Linux boxes. James Ellis wrote .. > > Rainer, > > Thanks for your feedback: > > > Also: if you do clustering, you might be concerned about availability. > The > load balancer itself is a single point of failure, unle

RE: Tomcat and Apache mod_jk For Failover

2008-02-06 Thread James Ellis
Rainer, Thanks for your feedback: > Also: if you do clustering, you might be concerned about availability. > The > load balancer itself is a single point of failure, unless you > implement > some redunfdancy in that layer to. That's another concern I have. I was thinking of Linux HA - alt

Custom 404 for non-existant contexts?

2008-02-06 Thread Eric B.
Is there a way to create a custom 404 error page for Tomcat for non-existant context paths? I know how to create a custom 404 error page within my application, but am running into an issue while I am redeploying my application. The users are able to access Tomcat, but since my application/cont

Re: Tomcat and Apache mod_jk For Failover

2008-02-06 Thread Rainer Jung
Hi James, James Ellis schrieb: I am trying to set up a cluster of Tomcat servers where they replicate session btwn the tomcat servers. My questions are: 1) For failover, if I am using apache/mod_jk as a load balancer, will it automatically detect if one of the members in the cluster is down and

Re: Disable low grade encryption

2008-02-06 Thread Max Sevenfold
Chris, I already posted solution. I had to set unlimited strength cryptography policy. Unlimited strength JCE is available from Sun on same download page as JDK. There are 2 jar files that must be copied in $JDK_HOME/jre/lib/secuirty It so simple. Regards, Max Christopher Schultz wrote: ---

Re: Disable low grade encryption

2008-02-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Max, Max Sevenfold wrote: | Chris, | | Thank You. I just got solution from colleague. I was going to post it here. Yes, please post your solution, including complete instructions. Post it under a new thread so folks who haven't been reading this on

Re: Disable low grade encryption

2008-02-06 Thread Max Sevenfold
Chris, Thank You. I just got solution from colleague. I was going to post it here. Installing unlimited strength cryptography policy fixed the problem. Cipher I posted is from Java6. I think all Tomcats with SSL must be running with such policy now. May be it is good to post it to tomcats ssl

Re: How to avoid session fixation?

2008-02-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Christoph, Christoph Lenggenhager wrote: | I'm currently trying to find a way to fight "Session Fixation" | (http://www.owasp.org/index.php/Session_Fixation) in tomcat when using | the built -in mechanisms to authenticate users of a servlet. I don't

Re: Disable low grade encryption

2008-02-06 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Max, Max Sevenfold wrote: | compression="on" | compressionMinSize="2048" | noCompressionUserAgents="gozilla, traviata" | compressableMimeType="text/html,text/xml,text/javascript,text/css,text/javascript,text/

RE: Performace problem when invoking RMI call from Tomcat Servlet

2008-02-06 Thread Barak Yaish
The first request takes much longer (~100 ms) the than the other requests (~25-30 ms), but still, the duration of the method running on H2 is only 5 ms. Again, invoking the method remotely by junit gives 10 ms. Is there something I'm doing wrong? In addition, when accessing the servlet more than

RE: Performace problem when invoking RMI call from Tomcat Servlet

2008-02-06 Thread Barak Yaish
So why there is a difference in the latency when invoking the method from Junit and from the servlet? -Original Message- From: Filip Hanik - Dev Lists [mailto:[EMAIL PROTECTED] Sent: Wednesday, February 06, 2008 9:08 PM To: Tomcat Users List Subject: Re: Performace problem when invoking

Re: Performace problem when invoking RMI call from Tomcat Servlet

2008-02-06 Thread Leon Rosenberg
is it only the first request that lasts longer, or each request? regards leon On Feb 6, 2008 7:01 PM, Barak Yaish <[EMAIL PROTECTED]> wrote: > Hello all, > > > > I'm running a Servlet under Tomcat 5.5.23 (CentOS 5), reside on host H1. > This servlet invokes a RMI method ( f() ) on an object found

Re: Performace problem when invoking RMI call from Tomcat Servlet

2008-02-06 Thread Filip Hanik - Dev Lists
could be either a DNS lookup timeout, or some other network latency. Filip Barak Yaish wrote: Hello all, I'm running a Servlet under Tomcat 5.5.23 (CentOS 5), reside on host H1. This servlet invokes a RMI method ( f() ) on an object found on remote host (H2). The duration of f() when runni

Re: Inter-context communication

2008-02-06 Thread Filip Hanik - Dev Lists
Klaus Reimer wrote: Filip Hanik - Dev Lists wrote: not sure why you would need to go down the route of putting everything into a single jar and copy it to lib. as you have it is just fine, except one would question why TestServiceImpl is not in the lib as well, do you need to hot deploy test

Tomcat and Apache mod_jk For Failover

2008-02-06 Thread James Ellis
I am trying to set up a cluster of Tomcat servers where they replicate session btwn the tomcat servers. My questions are: 1) For failover, if I am using apache/mod_jk as a load balancer, will it automatically detect if one of the members in the cluster is down and not route requests to it?

RE: Status report

2008-02-06 Thread Caldarale, Charles R
> From: Raghavan_sat [mailto:[EMAIL PROTECTED] > Subject: Status report > > > for example when i execute helloworld the processingtime, > threadcount and things like these are shown. > will these be written to an log file I'm not aware of anything to do that within Tomcat itself, but this

Re: Inter-context communication

2008-02-06 Thread Klaus Reimer
Filip Hanik - Dev Lists wrote: > not sure why you would need to go down the route of putting everything > into a single jar and copy it to lib. > as you have it is just fine, except one would question why > TestServiceImpl is not in the lib as well, do you need to hot deploy > test service impl? Y

Status report

2008-02-06 Thread Raghavan_sat
I am new to tomcat and would like to know a thing. am having tomcat 6. it has a status manager that gives reports on the inbuilt examples within tomcat when executed. for example when i execute helloworld the processingtime,threadcount and things like these are shown. will these be written to an l

RE: Tomcat Freez

2008-02-06 Thread Chris Hut
> once you know the PID number. On Windows, use Task Manager or netstat -ao to find that. Another handy way to get it is to run JAVA_HOME/bin/jps - which prints out the PID's of all java procs running on the machine (Tomcat's will be the one that says Bootstrap next to it) Chris -Original

Re: Inter-context communication

2008-02-06 Thread Filip Hanik - Dev Lists
Klaus Reimer wrote: Filip Hanik - Dev Lists wrote: why don't you just create a singleton object, and stuff it in common/lib(5.5) or lib(6.0) and any web app can access it That's fine if it's just a "connector"-like object (as I've described in my mail). But having the WHOLE stuff which

Performace problem when invoking RMI call from Tomcat Servlet

2008-02-06 Thread Barak Yaish
Hello all, I'm running a Servlet under Tomcat 5.5.23 (CentOS 5), reside on host H1. This servlet invokes a RMI method ( f() ) on an object found on remote host (H2). The duration of f() when running on H1 is about 5 ms. Somehow, the duration of the invocation in the servlet is about 30ms. Inv

[OT] Re: URL rewriting and mod_jk

2008-02-06 Thread Rainer Jung
Hi lars, you can match against QUERY_STRING in RewriteCond and then use the match via %N in the replacement part of the RewriteRule. See "QUERY_STRING" and "%N" in the docs page of mod_rewrite. For more special mod_rewrite questions not directly related to mod_jk or Tomcat interoperability,

Re: Inter-context communication

2008-02-06 Thread Klaus Reimer
Filip Hanik - Dev Lists wrote: > why don't you just create a singleton object, and stuff it in > common/lib(5.5) or lib(6.0) > and any web app can access it That's fine if it's just a "connector"-like object (as I've described in my mail). But having the WHOLE stuff which is going to be in context

Re: Inter-context communication

2008-02-06 Thread Filip Hanik - Dev Lists
why don't you just create a singleton object, and stuff it in common/lib(5.5) or lib(6.0) and any web app can access it Filip Klaus Reimer wrote: Hello, For a special application setup I need fast inter-context communication. This means in web context A I need to call methods in web context

Re: URL rewriting and mod_jk

2008-02-06 Thread Lars Nielsen Lind
Hi Rainer, and thanks for your reply. The [PT] at the end of the line seems to be the 'trick'. I have another question: If the user enters: http://www.domainname.dk/news/news.jsp?id=5, is there then any way to force the url to change to: http://www.domainname.dk/news/news/5/ ? thanks, Lars

Inter-context communication

2008-02-06 Thread Klaus Reimer
Hello, For a special application setup I need fast inter-context communication. This means in web context A I need to call methods in web context B and I must be able to retrieve objects from there and send objects to it. It could be done using a remoting protocol like the Spring HttpInvoker stuf

RE: servlet spec, taglibs, java sdk - which ones?

2008-02-06 Thread Leo Donahue - PLANDEVX
That's pretty funny Chuck. I'm glad to see the security of our nation rests in your illogical nonsense. Chuck, I'm imagining something, can you make it done for me? Leo Donahue -Original Message- From: Caldarale, Charles R [mailto:[EMAIL PROTECTED] Sent: Wednesday, February 06, 2008 9:

RE: servlet spec, taglibs, java sdk - which ones?

2008-02-06 Thread Caldarale, Charles R
> From: Leo Donahue - PLANDEVX [mailto:[EMAIL PROTECTED] > Subject: RE: servlet spec, taglibs, java sdk - which ones? > > That table doesn't mention what spec Tomcat 5.0.x uses. Let's see if we can do the math: "Servlet/JSP Spec Apache Tomcat version "2.4/2.0 5.5.x" "[5.5] supports

RE: servlet spec, taglibs, java sdk - which ones?

2008-02-06 Thread Leo Donahue - PLANDEVX
Yes I saw that, and like I mentioned in my email, I don't run Tomcat 5.5.x, I'm stuck using Tomcat 5.0.28 That table doesn't mention what spec Tomcat 5.0.x uses. Does it mean any version from 4.1.36 to 5.5.25 uses servlet spec 2.3 ? Leo Donahue -Original Message- From: David Smith [mailt

RE: servlet spec, taglibs, java sdk - which ones?

2008-02-06 Thread Caldarale, Charles R
> From: Leo Donahue - PLANDEVX [mailto:[EMAIL PROTECTED] > Subject: servlet spec, taglibs, java sdk - which ones? > > > Apache Tomcat 5.5.x. It supports the same Servlet and JSP > Specification > versions as Apache Tomcat 5.0.x, > > > Which is what servlet spec version? The one boldly displ

Re: servlet spec, taglibs, java sdk - which ones?

2008-02-06 Thread David Smith
There's a very nice table right on the home page for tomcat letting you know what tomcat version supports what spec -- http://tomcat.apache.org/ --David Leo Donahue - PLANDEVX wrote: Looking here: http://tomcat.apache.org/whichversion.html - no problems, except we run Tomcat 5.0.28 and readin

servlet spec, taglibs, java sdk - which ones?

2008-02-06 Thread Leo Donahue - PLANDEVX
Looking here: http://tomcat.apache.org/whichversion.html - no problems, except we run Tomcat 5.0.28 and reading below in the site it says Apache Tomcat 5.5.x. It supports the same Servlet and JSP Specification versions as Apache Tomcat 5.0.x, Which is what servlet spec version? I've figure

Re: URL rewriting and mod_jk

2008-02-06 Thread Rainer Jung
Hi Lars, most liekly you need to set the pass through flag "PT" for the rewrite rules. See also "pass through" in http://httpd.apache.org/docs/2.2/mod/mod_rewrite.html Also: if you are using VirtualHosts, you need to put the JkMount into the VirtualHosts. Let us know, if that works. Rega

Re: Servlet Openning as file download

2008-02-06 Thread Juha Laiho
Natasha Wright wrote: From: [EMAIL PROTECTED]: [EMAIL PROTECTED]: Date: Wed, 6 Feb 2008 10:00:53 + HiI am running tomcat 5.5 on windows XP; I am attempting to run a servletas a html form action:When I click on the submit button a file download box appears where Ican 'save' the file "Bee

RE: Tomcat Freez

2008-02-06 Thread Caldarale, Charles R
> From: David Delbecq [mailto:[EMAIL PROTECTED] > Subject: Re: Tomcat Freez > > Getting Threaddump on windows requires you, if i remember > well, to type ctrl-z in the tomcat console. It's ctrl-break, not ctrl-z. Also, you can use the JDK jstack utility to get a thread dump of any JVM running

URL rewriting and mod_jk

2008-02-06 Thread lanili
Hi, when I use the following: Options +FollowSymLinks RewriteEngine on RewriteRule ^/news/([0-9]+)$ /news/$1/ [R] RewriteRule ^/news/([0-9]+)/$ /news.jsp?id=$1 and I use this URL: http://localhost/news/1 apache-tomcat displays the jsp-page - with source code (html and jsp code). I am us

Re: Out of Memory Errors when upgrading from 5.0.27 to 6.0.14

2008-02-06 Thread prakash shanmugam
hai dan, If I am not wrong, try to close all the connection string and make the user defined variables as null. (Eg) 1) (Statement object)--à st.close(); 2) (String)às=null; Hope it will solve your problem to some extend, even then if your problem is not solved. Then you have to ch

How to avoid session fixation?

2008-02-06 Thread Christoph Lenggenhager
Dear all, I'm currently trying to find a way to fight "Session Fixation" (http://www.owasp.org/index.php/Session_Fixation) in tomcat when using the built -in mechanisms to authenticate users of a servlet. In the environment in question, an own realm implementation is in place and we use the Single

RE: Install Tomcat 5.5 & Tomcat 6.0 in the same machine

2008-02-06 Thread Peter Crowther
> From: Juan Jesús Cremades Monserrat [mailto:[EMAIL PROTECTED] > Hi! I'm Triying install two differens versions of Tomcat in the same > machine. It's necessay for two projects that I'm developing. > > I've installed successfully the Tomcat 5.5 with Java > 1.5.0_14, but when I'm > try install Tomc

Servlet Openning as file download

2008-02-06 Thread Natasha Wright
From: [EMAIL PROTECTED]: [EMAIL PROTECTED]: Date: Wed, 6 Feb 2008 10:00:53 + HiI am running tomcat 5.5 on windows XP; I am attempting to run a servletas a html form action:When I click on the submit button a file download box appears where Ican 'save' the file "BeerSelect" as opposed to

Re: Tomcat Freez

2008-02-06 Thread David Delbecq
When it freezes, get a stack trace of all Thread in tomcat, by analysing those stacks, you can get an idea where it freeze and why. Getting Threaddump on windows requires you, if i remember well, to type ctrl-z in the tomcat console. En l'instant précis du 06/02/08 05:18, Suren s'exprimait en

RE: Facing problem in integration of PHP and tomcat

2008-02-06 Thread YogeshArora
Hi Barry, Thanks a lot for the reply ! I am getting the following error: <> Could you please tell me from where I can get the shared objects? I need the follwoing Shared objects for PHP 5.2.5 on Linux version 4: 1. mbstring.so 2. mcrypt.so 3. mysql.so Please help me in the same ! Thanks, Yo

Install Tomcat 5.5 & Tomcat 6.0 in the same machine

2008-02-06 Thread Juan Jesús Cremades Monserrat
Hi! I'm Triying install two differens versions of Tomcat in the same machine. It's necessay for two projects that I'm developing. I've installed successfully the Tomcat 5.5 with Java 1.5.0_14, but when I'm try install Tomcat 6.0, the Windows Installer give me an error related with the JVM. The me

Install Tomcat 5.5 & Tomcat 6.0 in the same machine

2008-02-06 Thread Juan Jesús Cremades Monserrat
Hi! I'm Triying install two differens versions of Tomcat in the same machine. It's necessay for two projects that I'm developing. I've installed successfully the Tomcat 5.5 with Java 1.5.0_14, but when I'm try install Tomcat 6.0, the Windows Installer give me an error related with the JVM. The me