How to Prevent Dynamic Code manipulation via Java Attach API for Tomcat

Hello Tomcat Users and Development Team, I recently came to know that with Java Attach API, anyone with access can attach to a local process and manipulate Java Byte code. For example, password harvesting is attached to the Filter Chain. https://github.com/rebeyond/memShell What I found is to ru

Re: OCSP Stapling Configuration and Tomcat 9

CA'sintermediate and root certs?* Thanks, Bhavesh On Fri, Jan 5, 2024 at 11:07 AM Christopher Schultz < ch...@christopherschultz.net> wrote: > Bhavesh, > > On 1/5/24 12:57, Bhavesh Mistry wrote: > > Hi All, > > > > According to Tomcat 9 Official documen

OCSP Stapling Configuration and Tomcat 9

Hi All, According to Tomcat 9 Official documentation, only Tomcat NATIVE Connector supports it. https://tomcat.apache.org/tomcat-9.0-doc/ssl-howto.html#Using_OCSP_Certificates But this site claims https://community.progress.com/s/article/PASOE-OCSP-Stapling-does-not-work that it works with non-na

Re: Tomcat 9 Connector config allowHostHeaderMismatch not working as expected

29, 2023 at 2:07 PM Mark Thomas wrote: > On 29/08/2023 21:51, Bhavesh Mistry wrote: > > Hi Mark, > > > >> curl - -k "https://www.mydomain.com/login"; -H 'Host: > >> attackerHostHeaderInjection.com' > > > > *Why? What pro

Re: Tomcat 9 Connector config allowHostHeaderMismatch not working as expected

virtual-host-to-prevent-improper-input-handling-attack Thanks for your help so far. Thanks, Bhavesh On Tue, Aug 29, 2023 at 1:16 PM Mark Thomas wrote: > On 29/08/2023 08:00, Bhavesh Mistry wrote: > > Hi Mark, > > > > I am sorry for delayed response. > > > > Ba

Re: Tomcat 9 Connector config allowHostHeaderMismatch not working as expected

oblem are you trying to solve here? > > Tomcat rejects requests with mis-matched host headers by default and can > be configured to allow them in 8.5.x, 9.0.x and 10.1.x. You shouldn't > need to write any extra code for this. > > Mark > > > On 21/08/2023 12:59, Bhavesh Mist

Re: Tomcat 9 Connector config allowHostHeaderMismatch not working as expected

> > > Hi Mark and Thomas, > > > > I understood now that Tomcat does not have information other than HOST > (HTTP 1.1) and :authority: (HTTP2). So there is no way to check what URL > used to connect and headers. > > > > I was wondering if TLS Handshake can provide *SNI can be used for this > purpos

Re: Tomcat 9 Connector config allowHostHeaderMismatch not working as expected

g/springframework/security/web/firewall/StrictHttpFirewall.java#L549 On Sat, Aug 19, 2023 at 2:10 PM Mark Thomas wrote: > > 19 Aug 2023 19:46:56 Bhavesh Mistry : > > > Hi, Tomcat Dev team and Users, > > > > > > I am trying to block the request and give 404

Tomcat 9 Connector config allowHostHeaderMismatch not working as expected

Hi, Tomcat Dev team and Users, I am trying to block the request and give 404 bad requests or 403 when the HOST header does not match the requested server name. My goal is to block whenever there is a mismatch in the host header and URL server name. I would appreciate your help. curl - -k "

Re: Tomcat 9.0.72 Firefox issue with 204 response (Empty Body)

hat with Firefox. > > Also, the CSP doesn't look quite right. > > "...form-action 'self'; https:;..." > > should probably be: > > "...form-action 'self' https:;..." > > Mark > > > On 17/03/2023 23:34, Bhavesh Mistry wro

Re: Tomcat 9.0.72 Firefox issue with 204 response (Empty Body)

f:6080 data: https://maps.googleapis.com https://*.tile.openstreetmap.org/ https://ipapi.co https://oauth2.googleapis.com/token https://dialogflow.googleapis.com";; public void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { resp

Re: Tomcat 9.0.72 Firefox issue with 204 response (Empty Body)

der to the response that is all. I remove them still same issue. Any theory or clue you have further to debug this notorious issue? Thanks, Bhavesh On Thu, Mar 9, 2023 at 11:54 AM Mark Thomas wrote: > On 09/03/2023 18:19, Bhavesh Mistry wrote: > > Hi Mark, > > > > You

Re: Tomcat 9.0.72 Firefox issue with 204 response (Empty Body)

this application bug or a tomcat platform bug? Thank you so far for your excellent support and quick responses. Thanks, Bhavesh On Thu, Mar 9, 2023 at 1:14 AM Mark Thomas wrote: > On 08/03/2023 21:32, Bhavesh Mistry wrote: > > Hi Mark, > > > > We have a NAT rule that

Re: Tomcat 9.0.72 Firefox issue with 204 response (Empty Body)

dpt:https to:127.0.0.1:8443 <http://127.0.0.1:8443>// this rule Fowards it to the 8443.* admin@SDWAN-VOAE1:~$ On Wed, Mar 8, 2023 at 12:29 PM Mark Thomas wrote: > On 08/03/2023 19:52, Bhavesh Mistry wrote: > > Hi Mark, > > > > It is a *direct connection* with no proxy or

Re: Tomcat 9.0.72 Firefox issue with 204 response (Empty Body)

at 11:43 AM Mark Thomas wrote: > On 08/03/2023 19:38, Bhavesh Mistry wrote: > > I will see if I can give a sample. But after removing JUST ONE LINE ( > > streamOutputBuffer.closed = true;) Everything seems to work. Somehow, > > firefox does not like an active stream being

Re: Tomcat 9.0.72 Firefox issue with 204 response (Empty Body)

can give you some clue as to where the issue is. Thanks, Bhavesh On Wed, Mar 8, 2023 at 11:21 AM Mark Thomas wrote: > On 08/03/2023 19:05, Bhavesh Mistry wrote: > > > > > *Then, *I build 9.0.72 src code *without HTTP2 no Content commit, and > > firefox worked ( I just r

Re: Tomcat 9.0.72 Firefox issue with 204 response (Empty Body)

Bhavesh On Wed, Mar 8, 2023 at 8:28 AM Christopher Schultz < ch...@christopherschultz.net> wrote: > Bhavesh, > > On 3/7/23 22:07, Bhavesh Mistry wrote: > > Hi Mark Thomas and Tomcat Team, > > > > We have a strange issue with Tomcat 9.0.72. All 204 response do

Tomcat 9.0.72 Firefox issue with 204 response (Empty Body)

Hi Mark Thomas and Tomcat Team, We have a strange issue with Tomcat 9.0.72. All 204 response does not complete in firefox. It works in the Chrome browser. If we downgrade the tomcat version is less than .72. Everything works on all browsers. https://github.com/apache/tomcat/commit/b7a21f2d6fa

Re: Tomcat Redirect Port 80 to 443 and Block OPTIONS HTTP Method

dback. Thanks, Bhavesh On Mon, Oct 10, 2022 at 7:59 PM Christopher Schultz < ch...@christopherschultz.net> wrote: > Bhavesh, > > On 10/10/22 22:05, Bhavesh Mistry wrote: > > I figured out the issue by default *mapperContextRootRedirectEnabled is > > true* hence it wa

Re: Tomcat Redirect Port 80 to 443 and Block OPTIONS HTTP Method

advance for your help. > > Thanks, > > Bhavesh > > > > > On Fri, Oct 7, 2022 at 12:06 PM Mark Thomas wrote: > >> On 07/10/2022 19:47, Bhavesh Mistry wrote: >> > Hi Mark, >> > >> > Thank you for your quick response. Your proposed solut

Re: Tomcat Redirect Port 80 to 443 and Block OPTIONS HTTP Method

i, Oct 7, 2022 at 12:06 PM Mark Thomas wrote: > On 07/10/2022 19:47, Bhavesh Mistry wrote: > > Hi Mark, > > > > Thank you for your quick response. Your proposed solution works by > > removing the transport-guarantee element. Another quick question, I have > > Conn

Re: Tomcat Redirect Port 80 to 443 and Block OPTIONS HTTP Method

than having custom logic at the application level? Do you think it good idea to have Connector Config which method to allow and disallow? Thanks, Bhavesh On Fri, Oct 7, 2022 at 10:59 AM Mark Thomas wrote: > On 07/10/2022 18:09, Bhavesh Mistry wrote: > > Hi Tomcat Team, > > >

Tomcat Redirect Port 80 to 443 and Block OPTIONS HTTP Method

Hi Tomcat Team, We have a unique situation. We wanted to block ALL *OPTIONALS* HTTP method on port 80 and 443. We have connector definitions as follows: --> --> and we have an application filter to block and return 405. This works for HTTPS port 443. But req

Re: Tomcat Large Payload Truncated

Hi Mark, Thank you for responding. I have one more question. This is spring-boot 2 application REST API server and it does not accept Cookie or session (timeout is set to zero).Auth happens through Authorized header. We have set 10mb for maxPostSize. Does maxSavePostSize takes precedence ov

Tomcat Large Payload Truncated

Hi All, I am running embedded *tomcat*-embed-core-9.0.36.jar and large payload *179292* and HTTPS 1.1 traffic. When I use curl command with transfer encoding or without, both request JSON payload is truncated, and the application can not parse it. The smaller payload works fine. Both small pa

Tomcat 9.0.31 Invalid character found in the request target

Hi Tomcat Team, When there is invalid characters, it return error message with stacktrace as shown below. 1) is there any way to costmize error message ? if yes, please let me know. 2) Is there any way to spress stack-trace being shown on 400 bad request ? 3) Based on Accept header (application

Re: Tomcat 9.31 PUT/POST Request receiving Partial Data

The response get truncated after 16321 bytes. Please let me know what is best way to wait and in order to consume entire request payload. Thanks, Bhavesh On Wed, Feb 26, 2020 at 4:34 PM Bhavesh Mistry wrote: > Hi Tomcat Team, > > I have servlet filter for all requests to cache the e

Tomcat 9.31 PUT/POST Request receiving Partial Data

Hi Tomcat Team, I have servlet filter for all requests to cache the entire PUT/POST Payload. When content is large 4KB or more, I am getting partial content when I read from HttpServletRequest.getInputStream(). But I but 10 seconds wait before consuming the input stream, I am getting entire con

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

< chuck.caldar...@unisys.com> wrote: > > From: Bhavesh Mistry [mailto:mistry.p.bhav...@gmail.com] > > Subject: Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length > Corrupting > > Parsing logic for Subsequent Request > > > I am stating following when you h

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

look request/response model, how can tomcat read ahead on PUT call on a socket the data is not there? Thanks, Bhavesh On Thu, Feb 7, 2019 at 1:51 PM Mark Thomas wrote: > On 07/02/2019 20:05, Bhavesh Mistry wrote: > > Hi Mark, > > > > There is no way to validate the END

Re: Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

tty ---> Apache-Camel HTTP Proxy ---> tomcat (Spring boot). The failure on the SAME TCP occurs at tomcat, not at Jetty for the same TCP connection. Thanks, Bhavesh On Thu, Feb 7, 2019 at 11:25 AM Mark Thomas wrote: > On 07/02/2019 18:48, Bhavesh Mistry wrote: > > Hello Tomcat Developers

Fwd: Tomcat-embed-core-9.0.12.jar bug about Content-Length Corrupting Parsing logic for Subsequent Request

Hello Tomcat Developers, I have a unique situation about HTTP Protocol PAYLOAD parsing and Content-Length Header. When PUT/POST Content-Length is NOT correct (client send wrong Content-Lenght), the tomcat is able to parse the request and respond to request with 2xx but subsequent on SAME TCP conn