TLS 1.0 and "HTTP Security Header Not Detected" on Tomcat 7, running under Java 7

2019-02-05 Thread James H. H. Lampert
We've just received word from a customer that they had two vulnerabilities flagged on a security scan of the box their Tomcat server is running on. 38628 - TLS 1.0 still supported. Ok, assuming that the box and the JVM can go up to a more current TLS level, and a more current cipher, what do I

Re: Number of tomcat downloads

2019-02-05 Thread Igal Sapir
On Tue, Feb 5, 2019 at 6:35 AM Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Leon, > > On 2/5/19 05:35, Leon Rosenberg wrote: > > A little background on the original question: we have some legal > > issues with a client, among ot

Re: Number of tomcat downloads

2019-02-05 Thread Igal Sapir
Chris, On Tue, Feb 5, 2019 at 6:32 AM Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Igal, > > On 2/4/19 23:52, Igal Sapir wrote: > > > > On that note, should we add Google Analytics to the new site? > > Hard pass, thank you ver

Re: Tomcat gives 404 for file that exists

2019-02-05 Thread Joel Griffith
On Tue, Feb 5, 2019 at 9:49 AM Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Joel, > > On 2/5/19 08:56, Joel Griffith wrote: > > On Mon, Feb 4, 2019 at 4:50 PM Christopher Schultz < > > ch...@christopherschultz.net> wrote: > > >

Re: latest situation with escaped path delimiters in URI

2019-02-05 Thread Garret Wilson
On 2/5/2019 1:15 PM, Mark Thomas wrote: … Migratation to git has been in planning for a while. We are pretty much ready to pull the trigger. It is largely waiting for someone to have the time to do it when there aren't other more urgent things to be dealt with. I'd expect it to happen in the next

Re: latest situation with escaped path delimiters in URI

2019-02-05 Thread Mark Thomas
On 05/02/2019 14:51, Garret Wilson wrote: > On 2/3/2019 9:34 PM, Mark Thomas wrote: >> >>>   * If this setting is still needed in some cases, is there any way to >>>     control it without resorting to a system property? (System >>>     properties are not very flexible, and Tomcat has many layers o

Re: latest situation with escaped path delimiters in URI

2019-02-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Garret, On 2/4/19 17:22, Garret Wilson wrote: > On 2/4/2019 7:31 PM, Christopher Schultz wrote: >> -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 >> >> Garret, >> >> On 2/3/19 16:20, Garret Wilson wrote: >>> If we want to look up the thing identi

Re: latest situation with escaped path delimiters in URI

2019-02-05 Thread Garret Wilson
On 2/3/2019 9:34 PM, Mark Thomas wrote:  * If this setting is still needed in some cases, is there any way to    control it without resorting to a system property? (System    properties are not very flexible, and Tomcat has many layers of more    manipulable settings, as you all would know

Re: Tomcat gives 404 for file that exists

2019-02-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Joel, On 2/5/19 08:56, Joel Griffith wrote: > On Mon, Feb 4, 2019 at 4:50 PM Christopher Schultz < > ch...@christopherschultz.net> wrote: > > Joel, > > On 2/4/19 16:35, Joel Griffith wrote: I've installed Tomcat 8.0.32 a local Ubuntu 16.04 V

Re: request.getContextPath() behind a proxy (apache/nginx)

2019-02-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Guido, On 2/5/19 05:33, Jäkel, Guido wrote: >> On 05/02/2019 08:23, Johan Compagner wrote: >>> problem is that our customers are doing this. also they can >>> have 1 tomcat with a few webapps that they want to map under >>> different domains >>> >

Re: Number of tomcat downloads

2019-02-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Leon, On 2/5/19 05:35, Leon Rosenberg wrote: > A little background on the original question: we have some legal > issues with a client, among other things, he claims that our code > isn't documented well, because he run checkstyle on it, and it > sh

Re: Number of tomcat downloads

2019-02-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 2/5/19 04:46, Mark Thomas wrote: > On 05/02/2019 04:52, Igal Sapir wrote: >> On that note, should we add Google Analytics to the new site? >> Obviously it will only give us information moving forward, but it >> can be interesting. > > No.

Re: Number of tomcat downloads

2019-02-05 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Igal, On 2/4/19 23:52, Igal Sapir wrote: > On Mon, Feb 4, 2019 at 3:58 PM Leon Rosenberg > wrote: > >> Hi, >> >> I vaguely remember Marc naming some figures for number of tomcat >> downloads sofar, but I couldn't find anything in the state of the

Re: request.getContextPath() behind a proxy (apache/nginx)

2019-02-05 Thread John Dale
I've encountered something similar in the past, but it was around access logging. It all depends on what the load balancer can forward to tomcat in headers. Port forwarding and resolving internally to the same domain externally seems to be how Tomcat wants to handle your issue. JMX M-Beans can o

Re: Tomcat gives 404 for file that exists

2019-02-05 Thread Joel Griffith
On Mon, Feb 4, 2019 at 4:50 PM Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Joel, > > On 2/4/19 16:35, Joel Griffith wrote: > > I've installed Tomcat 8.0.32 a local Ubuntu 16.04 VM (Oracle > > VirtualBox) and I'm using it to acc

Re: request.getContextPath() behind a proxy (apache/nginx)

2019-02-05 Thread Johan Compagner
On Tue, 5 Feb 2019 at 11:34, Jäkel, Guido wrote: > >On 05/02/2019 08:23, Johan Compagner wrote: > >> problem is that our customers are doing this. > >> also they can have 1 tomcat with a few webapps that they want to map > under > >> different domains > >> > >> so that would mean for them startin

Re: Number of tomcat downloads

2019-02-05 Thread Leon Rosenberg
A little background on the original question: we have some legal issues with a client, among other things, he claims that our code isn't documented well, because he run checkstyle on it, and it showed 6000 errors. My argumentation was that default checkstyle settings aren't telling anything about c

RE: request.getContextPath() behind a proxy (apache/nginx)

2019-02-05 Thread Jäkel , Guido
>On 05/02/2019 08:23, Johan Compagner wrote: >> problem is that our customers are doing this. >> also they can have 1 tomcat with a few webapps that they want to map under >> different domains >> >> so that would mean for them starting 3 different tomcats under 3 different >> ports and configure al

Re: Number of tomcat downloads

2019-02-05 Thread Leon Rosenberg
Thank you very much Igal, Marc and Emmanuel. regards Leon On Tue, Feb 5, 2019 at 11:23 AM Emmanuel Bourg wrote: > Le 05/02/2019 à 00:48, Leon Rosenberg a écrit : > > > I vaguely remember Marc naming some figures for number of tomcat > downloads > > sofar, but I couldn't find anything in the sta

Re: Number of tomcat downloads

2019-02-05 Thread Emmanuel Bourg
Le 05/02/2019 à 00:48, Leon Rosenberg a écrit : > I vaguely remember Marc naming some figures for number of tomcat downloads > sofar, but I couldn't find anything in the state of the cat slides. > I checked on the website, but all I found was this: > > " Tomcat has been downloaded more than 10 mi

Re: request.getContextPath() behind a proxy (apache/nginx)

2019-02-05 Thread Mark Thomas
On 05/02/2019 08:23, Johan Compagner wrote: > problem is that our customers are doing this. > also they can have 1 tomcat with a few webapps that they want to map under > different domains > > so that would mean for them starting 3 different tomcats under 3 different > ports and configure all that

Re: Number of tomcat downloads

2019-02-05 Thread Mark Thomas
On 05/02/2019 04:52, Igal Sapir wrote: > On Mon, Feb 4, 2019 at 3:58 PM Leon Rosenberg > wrote: > >> Hi, >> >> I vaguely remember Marc naming some figures for number of tomcat downloads >> sofar, but I couldn't find anything in the state of the cat slides. >> I checked on the website, but all I f

Re: request.getContextPath() behind a proxy (apache/nginx)

2019-02-05 Thread Johan Compagner
problem is that our customers are doing this. also they can have 1 tomcat with a few webapps that they want to map under different domains so that would mean for them starting 3 different tomcats under 3 different ports and configure all that thats not always something they want to do. So i guess