https://issues.apache.org/bugzilla/show_bug.cgi?id=48157
Summary: describe how to disable X-Header trick to attack
client cert auth
Product: Tomcat 5
Version: Unknown
Platform: All
OS/Version: All
Status: NEW
Severity: critical
Priority: P2
Component: Connector:Coyote
AssignedTo: dev@tomcat.apache.org
ReportedBy: hau...@acm.org
as per http://extendedsubset.com/Renegotiating_TLS.pdf p. 4:
Is there a way to disable X-Headers with GET like paths in coyote - is so,
describe in http://tomcat.apache.org/tomcat-5.5-doc/ssl-howto.html
see also bug 3463 and http://forums.sun.com/thread.jspa?messageID=10857837
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
