I can't find how to stop TOMCAT during INITIALIZATION phase

Hello, I have searched inside TOMCAT (for the moment version 10.1.x but seems to be present in all versions) how to stop TOMCAT during INITIALIZATION phase and I can't find any method how to do it. Tomcat seems to have 3 ways to stop it: 1. Sending SHUTDOWN command over the control port socket

Issues of Ahead of Time compilation support

Hello all, Does anyone have experience of implementation of AOT/GraalVM by following official documentation as below? https://tomcat.apache.org/tomcat-9.0-doc/graal.html I created a simple spring framework application(deployed as a war file) which is working well under Tomcat10.x, GraalVM21 with

RE: [EXTERNAL] - Re: Partitioned cookies

> -Original Message- > From: Adam Warfield > Sent: woensdag 15 november 2023 16:49 > To: Tomcat Users List > Subject: Re: [EXTERNAL] - Re: Partitioned cookies > > That's strange. I was not aware the proposal had expired. I've been working > off of a few pages as it seemed Chrome/Edge wer

Re: 9.0.83 addSslHostConfig JMX Operation Regression (Sample Code Attached)

Christ, Thanks for the explanation. The XML-based registration - is that something I would do as a user, or something that would be changed on the Tomcat side as part of its release bundle? On Thu, Dec 14, 2023 at 10:17 AM Christopher Schultz < ch...@christopherschultz.net> wrote: > Daniel, > >

Re: security-constraint url-pattern question

Chris, I figured out how to make this work. It works in my dev dox but not in my prod box. Both have the same version of tomcat. Here is the web.xml entry. I any ideas would be great. securedapp /* CONFIDENTIAL

Re: Clarification on CVE-2023-46589

On 14/12/2023 16:13, Benny Prange wrote: Am Do., 14. Dez. 2023 um 16:51 Uhr schrieb Mark Thomas : On 14/12/2023 15:33, Benny Prange wrote: Hi all, I am having trouble understanding the description of CVE-2023-46589. Does this CVE affect scenarios where the Apache Tomcat is the reverse proxy,

Re: Clarification on CVE-2023-46589

Am Do., 14. Dez. 2023 um 16:51 Uhr schrieb Mark Thomas : > On 14/12/2023 15:33, Benny Prange wrote: > > Hi all, > > > > I am having trouble understanding the description of CVE-2023-46589. > > Does this CVE affect scenarios where the Apache Tomcat is the reverse > > proxy, or or when the Apache To

Re: security-constraint url-pattern question

Chris, Thanks for the response, but I think I explained myself wrong. The http redirect to https works when I use just this entry in my web.xml securedapp /* CONFIDENTIAL But if I want to force http to https and lock the second url pattern from

Re: Clarification on CVE-2023-46589

On 14/12/2023 15:33, Benny Prange wrote: Hi all, I am having trouble understanding the description of CVE-2023-46589. Does this CVE affect scenarios where the Apache Tomcat is the reverse proxy, or or when the Apache Tomcat is running behind a reverse proxy? Is the Tomcat vulnerable to request s

Clarification on CVE-2023-46589

Hi all, I am having trouble understanding the description of CVE-2023-46589. Does this CVE affect scenarios where the Apache Tomcat is the reverse proxy, or or when the Apache Tomcat is running behind a reverse proxy? Is the Tomcat vulnerable to request smuggling, or other applications running beh

Re: 9.0.83 addSslHostConfig JMX Operation Regression (Sample Code Attached)

Daniel, On 12/14/23 09:43, Daniel Skiles wrote: Do you have any pointers on how to do that using JMX? So far as I can tell from what little documentation I can find on the tomcat site, this is how it's done. I'm suspicious that there might be an issue in Tomcat's MbeansDescriptorsIntrospection

Re: 9.0.83 addSslHostConfig JMX Operation Regression (Sample Code Attached)

Daniel, On 12/13/23 15:42, Daniel Skiles wrote: The object and operation I'm trying to address is Catalina --> ProtocolHandler --> --> --> operations --> addSslHostConfig. The parameters are an SslHostConfig object and the boolean value "true". The operation is "addSslHostConfig". The code

Re: security-constraint url-pattern question

Kent, On 12/14/23 09:13, ResSoft wrote: I am currently forcing my app to use https. Here is what I have in my app web.xml file and it works as intended securedapp /* CONFIDENTIAL I also now want to restrict the browser from pulling up files in certain

Re: [EXT] Datadog _ JMX Integration facing connection issues.

Sai Vamsi, On 12/14/23 00:26, Bodavula, Sai Vamsi Mohan Krishna (TR Technology) wrote: Hai Chuck., Thanks for jumping in., thats what my concern is. as previously added by Chris, I have added my annotations in Catalina_opts ., Which is preferred by Java_Process for adding the annotations., But

Re: 9.0.83 addSslHostConfig JMX Operation Regression (Sample Code Attached)

Do you have any pointers on how to do that using JMX? So far as I can tell from what little documentation I can find on the tomcat site, this is how it's done. I'm suspicious that there might be an issue in Tomcat's MbeansDescriptorsIntrospectionSource.createManagedBean(...) method. I'm not fami

security-constraint url-pattern question

I am currently forcing my app to use https. Here is what I have in my = app web.xml file and it works as intended securedapp /* CONFIDENTIAL I also now want to restrict the browser from pulling up files in certain = directories. Search the web I see to use the

Re: 9.0.83 addSslHostConfig JMX Operation Regression (Sample Code Attached)

On Wed, Dec 13, 2023 at 9:43 PM Daniel Skiles wrote: > > The object and operation I'm trying to address is Catalina --> > ProtocolHandler --> --> --> operations --> addSslHostConfig. > > The parameters are an SslHostConfig object and the boolean value "true". > > The operation is "addSslHostConf