patrickl 02/01/31 09:47:45
Modified: catalina/src/share/org/apache/catalina/authenticator Tag:
tomcat_40_branch AuthenticatorBase.java
Log:
Ported security patch from HEAD branch to fix Bugzilla bug 6151. Fixed security hole
where resources that are protected by a security constraint could be cached by web
proxies and browsers. By allowing caching, protected resources can be retrieved by
unauthorized clients since web proxies and browsers are may serve a protected resource
without ever passing the request to the Tomcat server where authorization would be
validated.
Revision Changes Path
No revision
No revision
1.23.2.4 +14 -4
jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java
Index: AuthenticatorBase.java
===================================================================
RCS file:
/home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java,v
retrieving revision 1.23.2.3
retrieving revision 1.23.2.4
diff -u -r1.23.2.3 -r1.23.2.4
--- AuthenticatorBase.java 10 Dec 2001 01:26:48 -0000 1.23.2.3
+++ AuthenticatorBase.java 31 Jan 2002 17:47:45 -0000 1.23.2.4
@@ -1,7 +1,10 @@
/*
- * $Header:
/home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java,v
1.23.2.3 2001/12/10 01:26:48 craigmcc Exp $
- * $Revision: 1.23.2.3 $
- * $Date: 2001/12/10 01:26:48 $
+ * $Header:
/home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java,v
1.23.2.4 2002/01/31 17:47:45 patrickl Exp $
+ * $Revision: 1.23.2.4 $
+ * $Date: 2002/01/31 17:47:45 $
+ * $Header:
/home/cvs/jakarta-tomcat-4.0/catalina/src/share/org/apache/catalina/authenticator/AuthenticatorBase.java,v
1.23.2.4 2002/01/31 17:47:45 patrickl Exp $
+ * $Revision: 1.23.2.4 $
+ * $Date: 2002/01/31 17:47:45 $
*
* ====================================================================
*
@@ -121,7 +124,7 @@
* requests. Requests of any other type will simply be passed through.
*
* @author Craig R. McClanahan
- * @version $Revision: 1.23.2.3 $ $Date: 2001/12/10 01:26:48 $
+ * @version $Revision: 1.23.2.4 $ $Date: 2002/01/31 17:47:45 $
*/
@@ -474,6 +477,13 @@
}
if ((debug >= 1) && (constraint != null))
log(" Subject to constraint " + constraint);
+
+ // Make sure that constrained resources are not cached by web proxies
+ // or browsers as caching can provide a security hole
+ HttpServletResponse sresponse = (HttpServletResponse)response.getResponse();
+ sresponse.setHeader("Pragma", "No-cache");
+ sresponse.setHeader("Cache-Control", "no-cache");
+ sresponse.setDateHeader("Expires", 1);
// Enforce any user data constraint for this security constraint
if (debug >= 1)
--
To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]>
For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
