Tomcat Manager 403's with LDAP Realm

2024-02-17 Thread Dan McLaughlin
We've had the same LDAP realm configured for probably 10 years, and the same roles in our LDAP for probably the same. We have 4 roles configured in LDAP manager-gui, manager-jmx, manager-script, and manager-status. My user only has the manager-gui role. Everything has worked fine up until about

Re: Session Cookie Logging

2024-02-01 Thread Dan McLaughlin
a chance to look at the logic in the Apache code, but this would be a helpful addition and would have saved a lot of time trying to debug where the value came from. -- Thanks, Dan On Thu, Feb 1, 2024 at 10:31 AM Mark Thomas wrote: > > > On 27/01/2024 14:38, Dan McLaughlin wrote: >

Re: Session Cookie Logging

2024-01-27 Thread Dan McLaughlin
require a // path of '/' but the servlet spec uses an empty string if (contextPath.length() == 0) { contextPath = "/"; } } -- Thanks, Dan On Sat, Jan 27, 2024 at 12:12 AM Mark Thomas wrote: > On 26/01/2024 22:22, Dan McLaughlin wrote: > > Hey Konstan

Re: Session Cookie Logging

2024-01-26 Thread Dan McLaughlin
ri, Jan 26, 2024 at 2:36 AM Konstantin Kolinko wrote: > пт, 26 янв. 2024 г. в 04:01, Dan McLaughlin : > > > > Does anyone know what class we would crank the log level up to see why > > Tomcat would ignore cookie-config in our web.xml? > > > > We are using Tomcat 1

Re: Session Cookie Logging

2024-01-25 Thread Dan McLaughlin
25, 2024 at 9:42 PM Dan McLaughlin wrote: > To give more context we originally moved to use __Host-JSESSIONID but were > seeing issues with the cookie getting overwritten when switching between > application contexts on the same host. I thought the routeid would play a > par

Re: Session Cookie Logging

2024-01-25 Thread Dan McLaughlin
don't care. So we are moving to using __Secure- instead. -- Thanks, Dan On Thu, Jan 25, 2024 at 9:29 PM Dan McLaughlin wrote: > I think I just figured it out. __Host- doesn't allow for setting a path to > anything other than /. > > It would have been nice if Tomcat would have log

Re: Session Cookie Logging

2024-01-25 Thread Dan McLaughlin
On Thu, Jan 25, 2024 at 7:27 PM Dan McLaughlin wrote: > Which one wins the catalina-base/conf/web.xml or the > Webapp/WEB-INF/web.xml. > > I just noticed that the one under catalina base contains: > > > 30 > > > Or do they get merged? > > Thanks, > > D

Re: Session Cookie Logging

2024-01-25 Thread Dan McLaughlin
Which one wins the catalina-base/conf/web.xml or the Webapp/WEB-INF/web.xml. I just noticed that the one under catalina base contains: 30 Or do they get merged? Thanks, Dan On Thu, Jan 25, 2024 at 7:00 PM Dan McLaughlin wrote: > Does anyone know what class we would crank the log le

Session Cookie Logging

2024-01-25 Thread Dan McLaughlin
Does anyone know what class we would crank the log level up to see why Tomcat would ignore cookie-config in our web.xml? We are using Tomcat 10.1.18. Our app WAR is named secure#Foo.war. We've always depended on the name of the WAR to name the Context Path/Name. The only reason I'm messing with

Re: Is the HTTP/2 Rapid Reset Exploit still possible on 2.4.58?

2023-11-13 Thread Dan McLaughlin
Yep, wrong list. Sorry. On Mon, Nov 13, 2023 at 4:37 PM Chuck Caldarale wrote: > You may have the wrong mailing list - this one is for Tomcat, but your > query seems to be solely about Apache httpd. > > - Chuck > > > > > On Nov 13, 2023, at 16:

Is the HTTP/2 Rapid Reset Exploit still possible on 2.4.58?

2023-11-13 Thread Dan McLaughlin
In the past several weeks, we've been dealing with what seems to be a denial of service attack against our site. We were seeing similar messages in our logs before Apache became unresponsive. I contributed it to the HTTP/2 Rapid Reset Exploit because we ran 2.4.57 then. Last week, I upgraded to

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-13 Thread Dan McLaughlin
to what's going on without me having to create a way to reproduce it for a bug report I'd be happy to do so, but for now, I have to get back to working on other things on my plate. -- Thanks, Dan On Wed, Jul 12, 2023 at 10:56 PM Dan McLaughlin wrote: > > Hey Mark, > > I found a wo

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-12 Thread Dan McLaughlin
-- Thanks, Dan On Wed, Jul 12, 2023 at 9:58 PM Dan McLaughlin wrote: > > Well, the deeper I get into the problem, the more complicated it gets. I > thought I was onto something, thinking the size of the JSON might have > something to do with it, so I created a Python scr

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-12 Thread Dan McLaughlin
war, then start a Tomcat and Apache docker image..and I can't reproduce the issue. My worst fear was that I was dealing with something potentially Windows-specific, back to the drawing board. -- Thanks, Dan On Wed, Jul 12, 2023 at 4:05 PM Dan McLaughlin wrote: > Mark, > > I'm working

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-12 Thread Dan McLaughlin
quite large, it fails. Before I spend more time on this test case, can you think of any setting in Tomcat or mod_proxy_http2 that might cause the POST of the larger JSON to fail? -- Thanks, Dan On Wed, Jul 12, 2023 at 2:36 PM Mark Thomas wrote: > > 12 Jul 2023 13:40:18 Dan McLaughlin :

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-12 Thread Dan McLaughlin
, Dan On Wed, Jul 12, 2023 at 6:00 AM Dan McLaughlin wrote: > > Hi Mark, > > I already provided the output from org.apache.coyote.http2.level = > FINE in the very first post to this thread. I didn't include > everything because all the header information includes things I don't

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-12 Thread Dan McLaughlin
it, I will. -- Thanks, Dan On Wed, Jul 12, 2023 at 3:34 AM Mark Thomas wrote: > > On 11/07/2023 19:10, Dan McLaughlin wrote: > > One other note, is I can switch to h2c, and it still fails, and a packet > > capture shows the entire JSON is delivered to Tomcat, and when I put

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-11 Thread Dan McLaughlin
e full contents of the JSON. Thanks, Dan On Tue, Jul 11, 2023 at 11:43 AM Dan McLaughlin wrote: > I was already using the latest Amazon Corretto 20, so I tried moving to > the latest OpenJDK 20, which made no difference. So I'm now using the > latest Apache HTTPD 2.4, Tomcat 10.1, an

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-11 Thread Dan McLaughlin
leased connection for (as01:18443) [Tue Jul 11 08:27:51.184357 2023] [proxy_http2:debug] [pid 14776:tid 5676] mod_proxy_http2.c(458): [remote x.x.x.x:63451] AH03377: leaving handler -- Thanks, Dan On Tue, Jul 11, 2023 at 11:00 AM Dan McLaughlin wrote: > I just upgraded to Tomcat 10.1.11, and it sti

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-11 Thread Dan McLaughlin
 AM Dan McLaughlin wrote: > @markt > > I was looking over the latest release notes for 10.1.11. Any chance either > of these changes could be related... > > >- [image: Fix:] Refactor blocking reads and writes for the NIO >connector to remove code paths that could a

Re: Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-11 Thread Dan McLaughlin
in a timeout rather than the expected read or write. (markt) - [image: Fix:] Refactor waiting for an HTTP/2 stream or connection window update to handle spurious wake-ups during the wait. (markt) -- Thanks, Dan On Tue, Jul 11, 2023 at 9:43 AM Dan McLaughlin wrote: > We have many Angu

Angular -> Apache 2.4.57 -> Tomcat 10.1.10 over HTTP2

2023-07-11 Thread Dan McLaughlin
We have many Angular applications, and we currently use Angular 15. I'm using Apache 2.4.57 and Tomcat 10.1.10/JDK20 on Windows 2019 (don't ask). For several years now, I've used the following configuration without issues. Angular <-H2-> Apache <-MOD_JK/AJP 1.3--> Tomcat This week I've been

Re: Tomcat Clustering, Mod_JK, Fail_on_Status, Stopped Application

2023-06-20 Thread Dan McLaughlin
ng the request URI was found, log a fine message // and pass the request to the next Valve log.info("Application is available, passing to next valve"); getNext().invoke(request, response); } } } -- Thanks, Dan On Tue, Jun 20, 2023 at 12:15 PM Dan McLaughlin wrote: > > One thi

Re: Tomcat Clustering, Mod_JK, Fail_on_Status, Stopped Application

2023-06-20 Thread Dan McLaughlin
. Thoughts? -- Thanks, Dan -- Thanks, Dan McLaughlin Robert Clay Vineyards Proprietor/Vigneron d...@robertclayvineyards.com mobile: 512.633.8086 main: 325.261.0075 https://robertclayvineyards.com Facebook | Instagram On Tue, Jun 20, 2023 at 10:28 AM Mark

Re: Tomcat Clustering, Mod_JK, Fail_on_Status, Stopped Application

2023-06-20 Thread Dan McLaughlin
2023 at 10:28 AM Mark Thomas wrote: >> >> On 20/06/2023 15:41, Dan McLaughlin wrote: >> > So I tried to create a Valve to check to see if the application is stopped >> > and convert the 404 response to a 503, but I haven't had any luck getting >> > it to work.

Re: Tomcat Clustering, Mod_JK, Fail_on_Status, Stopped Application

2023-06-20 Thread Dan McLaughlin
s > > IOException, ServletException > > { > > Context context = request.getContext(); > > if (!context.getState().isAvailable()) { > > log.info("Application is not available, sending 503"); > > response.sendError(503); > > } else { > > log.fine(&quo

Re: Tomcat Clustering, Mod_JK, Fail_on_Status, Stopped Application

2023-06-20 Thread Dan McLaughlin
is passed on. Why would request.getContext(); return ROOT if that wasn't the requested context? Is this a bug? -- Thanks, Dan -- Thanks, Dan McLaughlin DJAB Enterprises, LLC d...@djabenterprises.com mobile: 512.633.8086 NOTICE: This e-mail message and all attachments transmitted

Re: Tomcat Clustering, Mod_JK, Fail_on_Status, Stopped Application

2023-06-20 Thread Dan McLaughlin
vailable, passing to next valve"); getNext().invoke(request, response); } } } -- Thanks, Dan On Wed, Jun 14, 2023 at 2:32 PM Mark Thomas wrote: > On 14/06/2023 19:49, Dan McLaughlin wrote: > > Hello, > > > > This is probably a question that would be better suited

Words of Wisdom re: Context Versioning - Parallel Deployment

2023-06-16 Thread Dan McLaughlin
Does anyone have any advice on implementing Context Versioning (parallel deployment) in Tomcat? It seems to have been a feature for quite some time. Is it stable? What are the typical issues people run into? JMX issues? Classloader issues? I've tried to do a parallel deployment with our

Re: Tomcat Clustering, Mod_JK, Fail_on_Status, Stopped Application

2023-06-14 Thread Dan McLaughlin
ark Thomas wrote: > On 14/06/2023 19:49, Dan McLaughlin wrote: > > Hello, > > > > This is probably a question that would be better suited for the dev list, > > but I thought I'd start here first. > > That depends. It is generally better to start on the users list.

Tomcat Clustering, Mod_JK, Fail_on_Status, Stopped Application

2023-06-14 Thread Dan McLaughlin
Hello, This is probably a question that would be better suited for the dev list, but I thought I'd start here first. Does anyone understand the reasoning behind why Tomcat, when clustered, throws an HTTP status 404 and not a 503 when you have an application deployed but stopped or paused? What's