Hi Christopher, Have pasted the whole server.xml file
<?xml version="1.0" encoding="UTF-8"?> <Server port="8005" shutdown="SHUTDOWN"> <Listener className="org.apache.catalina.startup.VersionLoggerListener" /> <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /> <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /> <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /> <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /> <!-- Application Context (sanitized path) --> <Context path="/app/context" docBase="app_folder" reloadable="true" /> <GlobalNamingResources> <Resource name="UserDatabase" auth="Container" type="org.apache.catalina.UserDatabase" description="User database" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" pathname="conf/tomcat-users.xml" /> </GlobalNamingResources> <Service name="Catalina"> <!-- SSL Connector (all sensitive info masked) --> <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="8083" connectionTimeout="20000" maxThreads="200" scheme="https" secure="true" SSLEnabled="true" keystoreFile="/***/***/sanitized_cert.pfx" keystorePass="********" keystoreType="PKCS12" clientAuth="false" sslProtocol="TLS" /> <Engine name="Catalina" defaultHost="localhost"> <Realm className="org.apache.catalina.realm.LockOutRealm"> <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" /> </Realm> <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true"> <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t "%r" %s %b" /> </Host> </Engine> </Service> </Server> On Wed, 29 Jul, 2026, 19:33 Christopher Schultz, < [email protected]> wrote: > Anushka, > > On 7/23/26 2:03 AM, Anushka sur wrote: > > We tested by intercepting the request to > > https://sdcoradb5.hdfc.com:8083/ORDS and modifying only the HTTP Host > > header to bing.com while sending the request to the same Tomcat server. > The > > application still processed the request instead of rejecting it with a > 4xx > > response. > > Please post your <Engine> element and *all* <Host> elements from your > server.xml file. Also, all <Connector> elements. > > In fact, post the whole file, redacting any specific values that contain > sensitive information. > > -chris > > > On Thu, 23 Jul, 2026, 00:47 Christopher Schultz, < > > [email protected]> wrote: > > > >> Anushka, > >> > >> On 7/21/26 6:15 AM, Anushka sur wrote: > >>> As you suggested, we created a dedicated virtual host in the | > >>> server.xml| file. However, even after adding the virtual host > >>> configuration, the issue still persists. > >>> > >>> For example, when we access the application using: > >>> > >>> |https://sdcoradb5.hdfc.com:8083/ORDS < > https://sdcoradb5.hdfc.com:8083/ > >>> ORDS>| > >> > >> Can you be very clear about what you mean, here? > >> > >> If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl, > >> presumably you will get a response from your application. > >> > >> If you make a request to bing.com using e.g. curl, then it will > >> obviously contact Bing and not go to your application at all. > >> > >> Where does the "redirect" come into the picture? Note that "redirect" > >> has a very specific meaning in the context of HTTP / web applications. > >> > >> -chris > >> > >> > >> --------------------------------------------------------------------- > >> To unsubscribe, e-mail: [email protected] > >> For additional commands, e-mail: [email protected] > >> > >> > > > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
