Re: Filter behaviour

2015-06-26 Thread Leo Donahue
On Fri, Jun 26, 2015 at 11:09 AM, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Leo, > > > > > If I use a return statement to break out of a filter, what should > > happen? Will the next filter run? > > No. The Filter is responsi

Re: SSL configuration using PFX as keystore

2015-06-26 Thread Mark Thomas
On 22/06/2015 11:56, Mark Thomas wrote: > On 22/06/2015 09:39, Mark Thomas wrote: > Prompting for authentication in response to an untrusted certificate is > bizarre to say the least. > > Microsoft generously provide MSDN subscriptions for Apache committers > which is why I have the various OS'

Re: Tomcat 7.0.63 release date known?

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Maarten, On 6/10/15 7:43 AM, Maarten van Hulsentop wrote: > Dear Tomcat users, > > We are using Apache Tomcat 7 to run our product on, using a number > of features of the Tomcat product, such as the SPNego mechanism. > For security reasons we keep

Re: Forcing SSL Renotiation

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 George, On 6/26/15 12:34 PM, George Stanchev wrote: > Agree on point 2 & 3. Since we are in control of the application > server, we have the luxury of managing the SSL engine and the > Security Manager settings. I guess I should've provided a link

RE: Forcing SSL Renotiation

2015-06-26 Thread George Stanchev
Hi Chris, Agree on point 2 & 3. Since we are in control of the application server, we have the luxury of managing the SSL engine and the Security Manager settings. I guess I should've provided a link to the ssl-howto doc [1] that describes that solution. I went the reflection way to avoid havin

Re: Filter behaviour

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Leo, On 6/26/15 10:38 AM, Leo Donahue wrote: > On Fri, Jun 26, 2015 at 1:42 AM, André Warnier > wrote: > >> >> I must admit that your question above was a bit difficult to >> follow, in terms of if/then/else/unless, particularly late at >> night.

Re: Forcing SSL Renotiation

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 George, On 6/26/15 10:04 AM, George Stanchev wrote: > You didn't specify your Tomcat version. In Tomcat 7 or 8 or 9 we > use the following code. Not sure if it will work on 6. For a long > time until very recently we were stuck on 5.5 and the attrib

Re: Tomcat - OOM Perm gen

2015-06-26 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Kiran, On 6/25/15 6:32 PM, Kiran Badi wrote: > I have 2 web apps sitting on single tomcat instance, App A( > Classic JSP/Servlet/jstl/velocity App) and App B (Struts2 based > app). > > Now I have added S2 to App A and trying to fix some bad code i

Re: Filter behaviour

2015-06-26 Thread Konstantin Kolinko
2015-06-25 23:11 GMT+03:00 Leo Donahue : > public void doFilter(ServletRequest request, ServletResponse response, > FilterChain chain) throws IOException, ServletException > > Assuming you have only a single Filter configured in web.xml > > Assuming you have logic in a doFilter that checks the valu

Re: Filter behaviour

2015-06-26 Thread Leo Donahue
On Fri, Jun 26, 2015 at 1:42 AM, André Warnier wrote: > > I must admit that your question above was a bit difficult to follow, in > terms of if/then/else/unless, particularly late at night. Yes, you are right. Sorry about that. I was trying to walk the line between saying too much and not eno

RE: Forcing SSL Renotiation

2015-06-26 Thread George Stanchev
Hi Steffen You didn't specify your Tomcat version. In Tomcat 7 or 8 or 9 we use the following code. Not sure if it will work on 6. For a long time until very recently we were stuck on 5.5 and the attribute below is not available. So I had to write a reflection introspection to drill down to the

Forcing SSL Renotiation

2015-06-26 Thread Steffen Heil (Mailinglisten)
Hi My tomcat installation offers pages through https only. So when accessing these pages, an ssl connection is established. Later on, a user may decide to "log in", hence hitting a page, that requires client certificates, and the browser pops up a selection dialog for a certificate. Once chose