Re: Tomcat's support for path parameters can expose resources despite reverse proxy access restrictions

2020-09-24 Thread Julian Reschke
Am 24.09.2020 um 12:02 schrieb Nils Breunese: Hello, I recently learned that when a server that supports path parameters [0] — like Tomcat (I found Jetty also does) — is run behind a reverse proxy that does path-based access control checks and does not support path parameters, your combined

Re: Tomcat 9 and response.setTrailerFields

2020-06-25 Thread Julian Reschke
On 24.06.2020 17:35, Julian Reschke wrote: ... > So it does set "Trailer" (so the response was not committed yet), but it doesn't switch to chunked encoding. There must be something that I'm doing wrong... ... Found the issue. I was using a HttpServletResponse object th

Re: Tomcat 9 and response.setTrailerFields

2020-06-24 Thread Julian Reschke
On 24.06.2020 17:13, Mark Thomas wrote: On 24/06/2020 15:59, Julian Reschke wrote: Hi, I just tried to figure out whether Tomcat 9 will let be send trailer fields in a chunked HTTP/1.1 response, using https://tomcat.apache.org/tomcat-9.0-doc/servletapi/javax/servlet/http

Tomcat 9 and response.setTrailerFields

2020-06-24 Thread Julian Reschke
Hi, I just tried to figure out whether Tomcat 9 will let be send trailer fields in a chunked HTTP/1.1 response, using https://tomcat.apache.org/tomcat-9.0-doc/servletapi/javax/servlet/http/HttpServletResponse.html#setTrailerFields-java.util.function.Supplier- I couldn't get it to work yet,