On 06/08/2026 07:50, Anushka sur wrote:
Hi Mark,
Thank you for your response, and I apologize for the delay.
We were in a change freeze period at the bank, so we were unable to make
any configuration changes during that time.
We have implemented the first recommendation by creating the required
virtual host for our application. However, we are currently struggling to
understand the second recommendation regarding configuring the default host
with a ROOT application that returns a 4xx response.
We are relatively new to Tomcat administration, and our application is an
Oracle APEX application.
Because of that, we are not sure how to create or configure the ROOT
application for the default host.
Do you know how to write a simple servlet that returns 4xx for
everything, add the servlet to a web application and deploy that web
application to Tomcat?
Could you please provide some guidance or point us to an example of how
this should be configured in a Tomcat + Oracle APEX environment?
There is nothing Oracle specific about this configuration. It is a
standard virtual host configuration with ORDS in one host (for the APEX
app) and a simple application in the default host that rejects everything.
This might help explain the previous sample configuration I provided:
https://nightlies.apache.org/tomcat/tomcat-11.0.x/docs/virtual-hosting-howto.html
Mark
We appreciate your patience and any assistance you can provide.
On Sun, 2 Aug, 2026, 12:13 GUSTAVO AVITABILE, <[email protected]> wrote:
________________________________________
From: GUSTAVO AVITABILE <[email protected]>
Sent: Friday, July 24, 2026 3:57 PM
To: Tomcat Users List
Subject: Re: Tomcat host header redirect issue
Hi Team,
________________________________________
From: Mark Thomas <[email protected]>
Sent: Thursday, July 23, 2026 3:14 PM
To: [email protected]
Subject: Re: Tomcat host header redirect issue
On 23/07/2026 09:15, Anushka sur wrote:
Hi Mark,
1.It is https
OK.
These is the settings for server.xml
No, those are part of the settings from server.xml. Since you are using
HTTPS then all of the Connector elements are relevant as well.
I did ask for the contents of server.xml, not part of it.
2.
I'm surprised that even started.
To repeat what I said previously:
Set up one virtual host for the correct host name(s) and deploy your
application to that host.
Set up the default host with a ROOT that returns a 4xx response to all
requests.
That means you need TWO host elements. You only have one. And a
reference to a default host that doesn't exist.
The basics are:
<Engine name="Catalina" defaultHost="other">
<Host name="other" appBase="webapps-other" />
<Host name="hblacsuat.hdfcbankuat.com" appBase="webapps" />
</Engine>
Deploy your web application(s) to webapps as usual.
Deploy a ROOT web application to webapps-other that rejects all requests
with a 4xx response of your choice. I'd do that with a servlet mapped to
"/". YMMV.
Additional configuration may be required for TLS but since you haven't
provided your connector information...
Mark
<!-- An Engine represents the entry point (within Catalina) that
processes
every request. The Engine implementation for Tomcat stand alone
analyzes the HTTP headers included with the request, and passes them
on to the appropriate Host (virtual host).
Documentation at /docs/config/engine.html -->
<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine name="Catalina" defaultHost="localhost">
<!--For clustering, please take a look at documentation at:
/docs/cluster-howto.html (simple how to)
/docs/config/cluster.html (reference documentation) -->
<!--
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-->
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
via a brute-force attack -->
<Realm className="org.apache.catalina.realm.LockOutRealm">
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
</Realm>
<Host name="hblacsuat.hdfcbankuat.com" appBase="webapps"
unpackWARs="true" autoDeploy="true">
<Valve className="org.apache.catalina.valves.RemoteIpValve"
remoteIpHeader="x-forwarded-for"
proxiesHeader="x-forwarded-by"
protocolHeader="x-forwarded-proto" />
<!-- SingleSignOn valve, share authentication between web applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common" -->
<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %u %t "%r" %s %b" />
</Host>
</Engine>
Thanks & Regards,
Anushka Sur
On Tue, 21 Jul, 2026, 19:27 Mark Thomas, <[email protected]> wrote:
On 21/07/2026 11:15, Anushka sur wrote:
Hi Mark,
As you suggested, we created a dedicated virtual host in the |
server.xml| file. However, even after adding the virtual host
configuration, the issue still persists.
For example, when we access the application using:
|https://sdcoradb5.hdfc.com:8083/ORDS <
https://sdcoradb5.hdfc.com:8083/
ORDS>|
and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083/
|
with |bing.com <http://bing.com/>|, the request is still being
redirected
instead of being rejected.
Which is it? http or https?
Could you please confirm whether our |server.xml| configuration is
correct, or if there are any additional settings or configurations that
need to be added to ensure only the intended host is accepted?
I could, if you had provided details of your settings. Screenshots will
get rejected by the mailing list. It would be better to simply paste the
contents of server.xml into a plain text email.
Mark
Any guidance would be greatly appreciated.
Thank you, Anushka Sur
In the screenshot..we have taken other instance for testing
Screenshot for your reference:--
On Thu, 16 Jul, 2026, 11:40 Anushka sur, <[email protected]
<mailto:[email protected]>> wrote:
Sorry for the confusion..We are using tomcat version 9.0.110
On Thu, 16 Jul, 2026, 11:26 Anushka sur, <[email protected]
<mailto:[email protected]>> wrote:
Hi everyone,
Thanks for the feedback. You are right — Tomcat 9.0.110 is
very
old, and we will treat the upgrade as the first remediation
step.
We will check the issue on a newer supported Tomcat release
and
verify whether the redirect problem is still reproducible
there.
If it is fixed by the upgrade, we will proceed with the newer
version
if not, as suggested by mark thomas we will create virtual
host.
Thanks for pointing this out.
Best regards,
Anushka Sur
On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
<[email protected]
<mailto:[email protected]>> wrote:
Mark,
On 7/15/26 9:56 AM, Mark Thomas wrote:
> 15 Jul 2026 11:10:41 Anushka sur <[email protected]
<mailto:[email protected]>>:
>
>> We have identified a VAPT issue in our Oracle APEX
application
>> deployed on
>> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>
> That is horribly out of date. You might want to check
the
list of
> published CVEs for 9.0.x
+1
The real VAPT issue should be "holy @#$%&* your Tomcat
version is *how*
old?"
-chris
I am [email protected]
I am non concerned with this thread at all, I'm reading just for
curiosi=
ty.
Then, why is my address [email protected] appearing in the
url'=
s you quote?
SOLVED
The URL's reported in tne message ar not the original URL's the sender
icluded.
They have been rewritten by Outlook mail.
I hate this, but I must complain with Microsoft. It is not a Tomcat issue.
Gustavo Avitabile
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
