Re: Weird CSRF prevention behavior

2023-12-11 Thread Christopher Schultz
Cris, On 12/11/23 12:48, Berneburg, Cris J. - US wrote: Hi Chris Any ideas? About EITHER issue? Ping. Any ideas? Yeah, and hopefully you won't gag too much. :-P [SNIP] My application is using log4j2, but that library is only used by the application and the JAR file is in WEB-INF/lib/. I

Re: JAVA -tomcat- Request header is too large

2023-12-11 Thread Christopher Schultz
Amit, On 12/11/23 11:32, Amit Pande wrote: Mark, Chris, What request ID we're referring to here? Perhaps, I missed some documentation? How do we enable it? Request-id is available in Tomcat 11.0 and 10.1 at the moment. Are you using either of those? I'm not seeing any documentation in

RE: Weird CSRF prevention behavior

2023-12-11 Thread Berneburg, Cris J. - US
Hi Chris > Any ideas? About EITHER issue? > Ping. Any ideas? Yeah, and hopefully you won't gag too much. :-P [SNIP] > My application is using log4j2, but that library is only used by the > application > and the JAR file is in WEB-INF/lib/. I wouldn't expect that it would interfere > with

Re: Should allowHostHeaderMismatch be case sensitive

2023-12-11 Thread Mark Thomas
On 11/12/2023 17:08, David Cleary wrote: Just want to check if this is by design. The above property default was changed to better secure the default configuration. We started having some tests fail due to this. In our scenario ( as shown below ), the Host header value in the HTTP request is

Should allowHostHeaderMismatch be case sensitive

2023-12-11 Thread David Cleary
Just want to check if this is by design. The above property default was changed to better secure the default configuration. We started having some tests fail due to this. In our scenario ( as shown below ), the Host header value in the HTTP request is case-sensitive difference compared to the

RE: JAVA -tomcat- Request header is too large

2023-12-11 Thread Amit Pande
Mark, Chris, What request ID we're referring to here? Perhaps, I missed some documentation? How do we enable it? Thanks, Amit -Original Message- From: Mark Thomas Sent: Monday, December 11, 2023 3:06 AM To: users@tomcat.apache.org Subject: Re: JAVA -tomcat- Request header is too

Re: JAVA -tomcat- Request header is too large

2023-12-11 Thread Mark Thomas
On 08/12/2023 22:01, Christopher Schultz wrote: Are request-ids always allocated, or only if they are "enabled"? Always allocated. I think adding the request-id to this exception detail message might be helpful, even if the request-id hasn't been enabled in the access-log. WDYT? Good