This is an automated email from the ASF dual-hosted git repository.
markt pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new ac4c0515ef Filter "Authorization" rather than "WWW-Authenticate"
ac4c0515ef is described below
commit ac4c0515efed1cf1a6015fef6c28f95e52938474
Author: Mark Thomas <[email protected]>
AuthorDate: Mon Aug 1 19:45:08 2022 +0100
Filter "Authorization" rather than "WWW-Authenticate"
---
java/jakarta/servlet/http/HttpServlet.java | 2 +-
test/jakarta/servlet/http/TestHttpServlet.java | 4 ++--
webapps/docs/config/ajp.xml | 6 +++---
webapps/docs/config/http.xml | 6 +++---
4 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/java/jakarta/servlet/http/HttpServlet.java
b/java/jakarta/servlet/http/HttpServlet.java
index 16007586ed..cf384b85fb 100644
--- a/java/jakarta/servlet/http/HttpServlet.java
+++ b/java/jakarta/servlet/http/HttpServlet.java
@@ -123,7 +123,7 @@ public abstract class HttpServlet extends GenericServlet {
static {
SENSITIVE_HTTP_HEADERS.add("cookie");
- SENSITIVE_HTTP_HEADERS.add("www-authenticate");
+ SENSITIVE_HTTP_HEADERS.add("authorization");
}
diff --git a/test/jakarta/servlet/http/TestHttpServlet.java
b/test/jakarta/servlet/http/TestHttpServlet.java
index 44174e009a..e12bcd54be 100644
--- a/test/jakarta/servlet/http/TestHttpServlet.java
+++ b/test/jakarta/servlet/http/TestHttpServlet.java
@@ -317,7 +317,7 @@ public class TestHttpServlet extends TomcatBaseTest {
"X-aaa: a1, a2" + SimpleHttpClient.CRLF +
"X-aaa: a3" + SimpleHttpClient.CRLF +
"Cookie: c1-v1" + SimpleHttpClient.CRLF +
- "WWW-Authenticate: not-a-real-credential" +
SimpleHttpClient.CRLF +
+ "Authorization: not-a-real-credential" + SimpleHttpClient.CRLF
+
SimpleHttpClient.CRLF});
client.setUseContentLength(true);
@@ -338,7 +338,7 @@ public class TestHttpServlet extends TomcatBaseTest {
// Sensitive headers (cookies, WWW-Authenticate) must not be reflected
// (since RFC 7231)
Assert.assertFalse(body.contains("cookie"));
- Assert.assertFalse(body.contains("www-authenticate"));
+ Assert.assertFalse(body.contains("authorization"));
client.disconnect();
}
diff --git a/webapps/docs/config/ajp.xml b/webapps/docs/config/ajp.xml
index 9b8962af9d..7f132a0ad8 100644
--- a/webapps/docs/config/ajp.xml
+++ b/webapps/docs/config/ajp.xml
@@ -90,9 +90,9 @@
<attribute name="allowTrace" required="false">
<p>A boolean value which can be used to enable or disable the TRACE
HTTP method. If not specified, this attribute is set to false. As per RFC
- 7231 section 4.3.8, cookie and www-authenticate headers will be excluded
- from the response to the TRACE request. If you wish to include these, you
- can implement the <code>doTrace()</code> method for the target Servlet
and
+ 7231 section 4.3.8, cookie and authorization headers will be excluded
from
+ the response to the TRACE request. If you wish to include these, you can
+ implement the <code>doTrace()</code> method for the target Servlet and
gain full control over the reponse.</p>
</attribute>
diff --git a/webapps/docs/config/http.xml b/webapps/docs/config/http.xml
index ee7e92da7a..06afa4b09c 100644
--- a/webapps/docs/config/http.xml
+++ b/webapps/docs/config/http.xml
@@ -86,9 +86,9 @@
<attribute name="allowTrace" required="false">
<p>A boolean value which can be used to enable or disable the TRACE
HTTP method. If not specified, this attribute is set to false. As per RFC
- 7231 section 4.3.8, cookie and www-authenticate headers will be excluded
- from the response to the TRACE request. If you wish to include these, you
- can implement the <code>doTrace()</code> method for the target Servlet
and
+ 7231 section 4.3.8, cookie and authorization headers will be excluded
from
+ the response to the TRACE request. If you wish to include these, you can
+ implement the <code>doTrace()</code> method for the target Servlet and
gain full control over the reponse.</p>
</attribute>
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
