On 30/07/2026 13:43, Anushka sur wrote:
Hi Christopher,
Have pasted the whole server.xml file
If you aren't going to bother following the advice you have been given
more than a week ago, there isn't much point you asking here for help.
https://lists.apache.org/thread/v1o3zdprpcry19zny2oqqj9nocj8vnp2
You need *TWO* Host elements.
You only have a single certificate, so the TLS configuration won't be an
issue here.
Mark
<?xml version="1.0" encoding="UTF-8"?>
<Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.startup.VersionLoggerListener" />
<Listener className="org.apache.catalina.core.AprLifecycleListener"
SSLEngine="on" />
<Listener
className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener
className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener
className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
<!-- Application Context (sanitized path) -->
<Context path="/app/context" docBase="app_folder" reloadable="true" />
<GlobalNamingResources>
<Resource
name="UserDatabase"
auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<Service name="Catalina">
<!-- SSL Connector (all sensitive info masked) -->
<Connector
protocol="org.apache.coyote.http11.Http11NioProtocol"
port="8083"
connectionTimeout="20000"
maxThreads="200"
scheme="https"
secure="true"
SSLEnabled="true"
keystoreFile="/***/***/sanitized_cert.pfx"
keystorePass="********"
keystoreType="PKCS12"
clientAuth="false"
sslProtocol="TLS" />
<Engine name="Catalina" defaultHost="localhost">
<Realm className="org.apache.catalina.realm.LockOutRealm">
<Realm
className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase" />
</Realm>
<Host
name="localhost"
appBase="webapps"
unpackWARs="true"
autoDeploy="true">
<Valve
className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="localhost_access_log"
suffix=".txt"
pattern="%h %l %u %t "%r" %s %b" />
</Host>
</Engine>
</Service>
</Server>
On Wed, 29 Jul, 2026, 19:33 Christopher Schultz, <
[email protected]> wrote:
Anushka,
On 7/23/26 2:03 AM, Anushka sur wrote:
We tested by intercepting the request to
https://sdcoradb5.hdfc.com:8083/ORDS and modifying only the HTTP Host
header to bing.com while sending the request to the same Tomcat server.
The
application still processed the request instead of rejecting it with a
4xx
response.
Please post your <Engine> element and *all* <Host> elements from your
server.xml file. Also, all <Connector> elements.
In fact, post the whole file, redacting any specific values that contain
sensitive information.
-chris
On Thu, 23 Jul, 2026, 00:47 Christopher Schultz, <
[email protected]> wrote:
Anushka,
On 7/21/26 6:15 AM, Anushka sur wrote:
As you suggested, we created a dedicated virtual host in the |
server.xml| file. However, even after adding the virtual host
configuration, the issue still persists.
For example, when we access the application using:
|https://sdcoradb5.hdfc.com:8083/ORDS <
https://sdcoradb5.hdfc.com:8083/
ORDS>|
Can you be very clear about what you mean, here?
If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
presumably you will get a response from your application.
If you make a request to bing.com using e.g. curl, then it will
obviously contact Bing and not go to your application at all.
Where does the "redirect" come into the picture? Note that "redirect"
has a very specific meaning in the context of HTTP / web applications.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
