date:20150429

[Bug 57872] Do not auto-switch session cookie to version=1 due to '/' in Path when running in "strict compliance" mode (Internet Explorer and rfc6265)

2015-04-29 Thread bugzilla

https://bz.apache.org/bugzilla/show_bug.cgi?id=57872

Konstantin Kolinko  changed:

   What|Removed |Added

 OS||All

--- Comment #1 from Konstantin Kolinko  ---
> For a reference, an old report

I meant to link to bug 45272 there. Just for information.

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 57871] New: LegacyCookieProcessor.setAllowHttpSepsInV0(false) affects all characters, not just separators

2015-04-29 Thread bugzilla

https://bz.apache.org/bugzilla/show_bug.cgi?id=57871

Bug ID: 57871
   Summary: LegacyCookieProcessor.setAllowHttpSepsInV0(false)
affects all characters, not just separators
   Product: Tomcat 8
   Version: 8.0.21
  Hardware: PC
Status: NEW
  Severity: normal
  Priority: P2
 Component: Catalina
  Assignee: dev@tomcat.apache.org
  Reporter: knst.koli...@gmail.com

Reviewing code of LegacyCookieProcessor.setAllowHttpSepsInV0(boolean) of
current Tomcat 8.

There is the following code:

char[] seps = "()<>@:\\\"[]?={}\t".toCharArray();
for (char sep : seps) {
if (allowHttpSepsInV0) {
allowedWithoutQuotes.set(sep);
} else {
allowedWithoutQuotes.clear();
}
}
if (getForwardSlashIsSeparator() && !allowHttpSepsInV0) {
allowedWithoutQuotes.set('/');
} else {
allowedWithoutQuotes.clear('/');
}

Apparently it was supposed to do "clear(sep)" instead of just clear().

-- 
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

[Bug 57872] New: Do not auto-switch session cookie to version=1 due to '/' in Path when running in "strict compliance" mode (Internet Explorer and rfc6265)

2015-04-29 Thread bugzilla

https://bz.apache.org/bugzilla/show_bug.cgi?id=57872

Bug ID: 57872
Summary: Do not auto-switch session cookie to version=1 due to
'/' in Path when running in "strict compliance" mode
(Internet Explorer and rfc6265)
Product: Tomcat 7
Version: 7.0.61
Hardware: PC
Status: NEW
Severity: enhancement
Priority: P2
Component: Catalina
Assignee: dev@tomcat.apache.org
Reporter: knst.koli...@gmail.com

Encountered this when migrating a legacy web application from old Tomcat 6 to
current Tomcat 7(.0.61). Reproducible with current Tomcat 8 as well.
Essential is that both Tomcat 6 and Tomcat 7 were configured with

org.apache.catalina.STRICT_SERVLET_COMPLIANCE=true

User-visible symptoms:

The count of active sessions (as shown in Manager application) increases
rapidly. This does not occur when the same application is deployed on Tomcat 6.

Debugging:

1) Configured AccessLogValve to log incoming "cookie" headers and outgoing
"set-cookie" headers and the current session.Id by adding the following text to
its pattern:

SessionId:%S [Cookie received: %{cookie}i] [Set-Cookie sent: %{set-cookie}o]

2) Disabled HttpOnly -- to bring Tomcat 7 configuration more closely to Tomcat
6 one. This is done by setting in context file of
the web application.

Cause:

In year 2009 a new feature was implemented in Tomcat 7 that a cookie is
automatically switched from "version 0" cookie (Netscape cookie) to "version 1"
cookie (RFC2109 cookie) when value/path/domain properties of the cookie contain
a character that need to be quoted.

When "STRICT_SERVLET_COMPLIANCE" is true, one of characters that triggers
"version 1" is '/'. As every session cookie contains a Path that starts with
'/' this causes all session cookies to become "version 1" ones.

The problem is when client is Internet Explorer.

If I look into access log, the set-cookie header sent by an old Tomcat 6 looks
like the following:

JSESSIONID=E8776ACC0C787BBAD5C7EEC4770877E1; Path=/foo

The set-cookie header sent by Tomcat 7 looks like the following:

JSESSIONID=A7A0CBBF5813DF4DEADFFFD3475E09AD; Version=1; Path="/foo/"

The problem is quoted value of Path. It is not understood by Internet Explorer
and subsequent HTTP and Ajax requests do not include a "cookie" header. This is
observed both with IE 8 and with current IE 11.

For a reference, an old report

Known solution:

Tomcat 7 and 8: Set the following system property:
org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR=false

Tomcat 8 (better solution): configure a to be
"org.apache.tomcat.util.http.Rfc6265CookieProcessor" instead of default
LegacyCookieProcessor.

See
http://tomcat.apache.org/tomcat-8.0-doc/config/cookie-processor.html

Proposal:
1) '/' alone should not trigger conversion from version 0 cookie to version 1
cookie. Netscape specification (as linked from rfc6265) uses unquoted '/' in
Path in its examples, so it is explicitly OK to use '/' in the Path.

Generally, there may be other safe characters, as RFC6265 allows in path-value, but '/' is such a blatant example. Every
path starts with a '/'.

2) Processing of a cookie that has "version=1" (set explicitly, or converted
due to other reasons) is unchanged. The path will be quoted here. RFC2109
quotes Path in its examples.

The FWD_SLASH_IS_SEPARATOR flag is left to control quoting in version 1
cookies. (This is why I do not propose changing the default value of
FWD_SLASH_IS_SEPARATOR).

--
You are receiving this mail because:
You are the assignee for the bug.

-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

svn commit: r1676686 - in /tomcat/site/trunk: docs/migration-7.html xdocs/migration-7.xml

2015-04-29 Thread kkolinko

Author: kkolinko
Date: Wed Apr 29 08:19:47 2015
New Revision: 1676686

URL: http://svn.apache.org/r1676686
Log:
Mention autoconversion of cookies and link to
https://bz.apache.org/bugzilla/show_bug.cgi?id=57872

Modified:
tomcat/site/trunk/docs/migration-7.html
tomcat/site/trunk/xdocs/migration-7.xml

Modified: tomcat/site/trunk/docs/migration-7.html
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/docs/migration-7.html?rev=1676686&r1=1676685&r2=1676686&view=diff
==
--- tomcat/site/trunk/docs/migration-7.html (original)
+++ tomcat/site/trunk/docs/migration-7.html Wed Apr 29 08:19:47 2015
@@ -692,6 +692,18 @@ of Apache Tomcat.
 org.apache.tomcat.util.http.ServerCookie.ALLOW_NAME_ONLY, that
 can be used to accept name-only cookies.
 
+
+If a cookie value or path contain characters that have to be quoted
+(per RFC2109 specification), the cookie will be automatically converted
+from "version 0" cookie into "version 1" cookie before sending it to
+the client and those values will be surrounded by double quotes. What
+characters need quoting is controlled by several System properties
+such as
+
org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR.
+It is known that Internet Explorer has problem processing "version 1"
+cookies. (Bug https://bz.apache.org/bugzilla/show_bug.cgi?id=57872";>57872).
+
+
   
 
 

Modified: tomcat/site/trunk/xdocs/migration-7.xml
URL: 
http://svn.apache.org/viewvc/tomcat/site/trunk/xdocs/migration-7.xml?rev=1676686&r1=1676685&r2=1676686&view=diff
==
--- tomcat/site/trunk/xdocs/migration-7.xml (original)
+++ tomcat/site/trunk/xdocs/migration-7.xml Wed Apr 29 08:19:47 2015
@@ -280,6 +280,18 @@ of Apache Tomcat.
 org.apache.tomcat.util.http.ServerCookie.ALLOW_NAME_ONLY, that
 can be used to accept name-only cookies.
 
+If a cookie value or path contain characters that have to be quoted
+(per RFC2109 specification), the cookie will be automatically converted
+from "version 0" cookie into "version 1" cookie before sending it to
+the client and those values will be surrounded by double quotes. What
+characters need quoting is controlled by several System properties
+such as
+
org.apache.tomcat.util.http.ServerCookie.FWD_SLASH_IS_SEPARATOR.
+It is known that Internet Explorer has problem processing "version 1"
+cookies. (Bug 57872).
+
+
   
 
   



-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org

45 matches

Mail list logo