RE: Re: Tomcat Console - 401 Unauthorized
And the winner is: Chuck đ
I tried Chrome (instead of the Corporate mandated browser Edge) and I was right
away challenged for credentials.
Thanks for all those who responded.
From: Chuck Caldarale
Sent: Wednesday, May 22, 2024 4:36 PM
To: Tomcat Users List
Subject: {EXTERNAL} Re: Tomcat Console - 401 Unauthorized
> On May 22, 2024, at 13:â31, Garber, Frank com.âINVALID> wrote: > > Not knowing how itâs supposed to behave, hereâs
> another clue. When I click on the âServer Statusâ button, I never get prompted
> On May 22, 2024, at 13:31, Garber, Frank
> mailto:francis.gar...@elevancehealth.com.INVALID>>
> wrote:
>
> Not knowing how itâs supposed to behave, hereâs another clue. When I click on
> the âServer Statusâ button, I never get prompted for credentials.
This sounds like a browser configuration problem. On the first attempt to
access a protected resource, the server will return a 401 status with a
WWW-Authenticate header listing the acceptable authentication mechanisms; for
Tomcat, "Basic" is the default. The browser is then supposed to take the
specified action to determine the credentials - for Basic, thatâs the typical
dialog box prompt.
If youâre using Edge (my condolences if so), go to edge://policy and look at
the AuthSchemes entry; if it doesnât include âbasicâ, youâll never get the
prompt.
Can you correct the Edge config or try a different browser?
- Chuck
CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is
for the sole use of the intended recipient(s) and may contain confidential
and privileged information or may otherwise be protected by law. Any
unauthorized review, use, disclosure or distribution is prohibited. If you
are not the intended recipient, please contact the sender by reply e-mail
and destroy all copies of the original message and any attachment thereto.
Security Constraints and Session Timeout
I have some servlets that I can't put security constraints on at the web.xml level. However, deep down in the code there are some places that I need a user to be logged in. My overall UI ensures this all works by having certain JSPs with constraints that force the user to log in before getting to the servlet. But if the user spends too much time interacting with the servlet and not reloading one of the pages that require a login, the session will timeout, and the user is now buried in one of the servlets, and I've lost the session/userprincipal. It appears that interacting with a servlet that has no constraints does not reset the session timer. Is that correct, or am I seeing it wrong? I know the easy answer would be to add a constraint requiring login to access the servlet. But with the current design, that's not going to work. Is there something I can do in the servlet and/or servlet config in web.xml to force servlet access to keep resetting the session timer so it won't expire without having to put role constraints directly on the servlet? Thx Jerry - To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org For additional commands, e-mail: users-h...@tomcat.apache.org
PersistentManager and ClassNotFoundException
Hi, I'm working with Tomcat 10.1. When a user starts using the store in my web application, I save the ShopCart object on the "cart" session attribute. I want the "cart" attributes to return to the session after restarting the app. To enable session persistence I added to the Context. It loads the StandardManager. And this works fine - after reload / restart the object "ShopCart" is back in the session. I want to experiment with PersistentManager. Tomcat docs says: " The persistence across restarts provided by the *StandardManager* is a simpler implementation than that provided by the *PersistentManager*. If robust, production quality persistence across restarts is required then the *PersistentManager* should be used with an appropriate configuration. " I hope for a Listener of deserialization of the session attributes. The new Manager configuration looks like this: But it doesn't work. After restart I get this exception: java.lang.ClassNotFoundException: ShopCart at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1332) at org.apache.catalina.loader.WebappClassLoaderBase.loadClass(WebappClassLoaderBase.java:1144) at java.base/java.lang.Class.forName0(Native Method) at java.base/java.lang.Class.forName(Class.java:534) at java.base/java.lang.Class.forName(Class.java:513) at org.apache.catalina.util.CustomObjectInputStream.resolveClass(CustomObjectInputStream.java:158) at java.base/java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:2061) at java.base/java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1927) at java.base/java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2252) at java.base/java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1762) at java.base/java.io.ObjectInputStream.readObject(ObjectInputStream.java:540) at java.base/java.io.ObjectInputStream.readObject(ObjectInputStream.java:498) at org.apache.catalina.session.StandardSession.doReadObject(StandardSession.java:1198) at org.apache.catalina.session.StandardSession.readObjectData(StandardSession.java:831) at org.apache.catalina.session.FileStore.load(FileStore.java:203) at org.apache.catalina.session.StoreBase.processExpires(StoreBase.java:138) at org.apache.catalina.session.PersistentManagerBase.processExpires(PersistentManagerBase.java:409) at org.apache.catalina.session.ManagerBase.backgroundProcess(ManagerBase.java:587) at org.apache.catalina.core.StandardContext.backgroundProcess(StandardContext.java:4787) at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1172) at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1176) at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.processChildren(ContainerBase.java:1176) at org.apache.catalina.core.ContainerBase$ContainerBackgroundProcessor.run(ContainerBase.java:1154) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:572) at java.base/java.util.concurrent.FutureTask.runAndReset(FutureTask.java:358) at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63) at java.base/java.lang.Thread.run(Thread.java:1583) I guess this means that the two managers use ClassLoader differently. How to get the PersistentManager to work in this case? Best regards, -- Jakub KrĂłlikowski
