You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Hrvoje Lončar <ho...@gmail.com> on 2025/07/06 11:33:00 UTC
POST parameters chopped
Hi!
After recent Tomcat security changes, my POST request are failing but not
all the time.
The problem is that the same request sometimes ends up with an error and
sometimes not.
Tomcat is 10.0.42 protected by nginx which handles SSL certificate and
forwards dynamic requests to Tomcat.
Java exception:
*2025-07-05 11:26:45,649 INFO (HttpSecurityConfig.java:210) [WEB_SECURITY]
CustomAccessDeniedHandler: Unauthorized access; URI = /suggest; URL =
http://thevegcat.com/suggest <http://thevegcat.com/suggest>;
AccessDeniedException = Invalid CSRF Token 'null' was found on the request
parameter '_csrf' or header
'X-XSRF-TOKEN'.org.springframework.security.web.csrf.InvalidCsrfTokenException:
Invalid CSRF Token 'null' was found on the request parameter '_csrf' or
header 'X-XSRF-TOKEN'. at
org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:129)*
...which tells me CSRF field of POST request was chopped out of request.
Below is my server.xml
*<?xml version="1.0" encoding="UTF-8"?><Server port="8005"
shutdown="SHUTDOWN"> <Listener
className="org.apache.catalina.startup.VersionLoggerListener"/>
<Listener className="org.apache.catalina.core.AprLifecycleListener"/>
<Listener
className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
<Listener
className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
<Listener
className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
<GlobalNamingResources> <Resource name="UserDatabase"
auth="Container" type="org.apache.catalina.UserDatabase" description="User
database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFact>
</GlobalNamingResources> <Service name="Catalina">
<Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000"
redirectPort="8443" maxParameterCount="1000" maxPartCount="1000"/>
<Engine name="Catalina" defaultHost="localhost">
<Realm className="org.apache.catalina.realm.LockOutRealm">
<Realm
className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/> </Realm>
<Host name="localhost" appBase="webapps" unpackWARs="true"
autoDeploy="true"> <Valve
className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t
"%r" %s %b"/> </Host>
</Engine> </Service></Server>*
Thanks!
--
*TheVegCat.com <https://thevegcat.com/>*
*VegCook.net <https://vegcook.net/>*
*horvoje.net <https://horvoje.net/>*
Re: POST parameters chopped
Posted by Hrvoje Lončar <ho...@gmail.com>.
Hi!
The problem is that sometimes it works and sometimes don't but with
strictly the same data entered.
BR,
Hrvoje
*TheVegCat.com <https://thevegcat.com/>*
*VegCook.net <https://vegcook.net/>*
*horvoje.net <https://horvoje.net/>*
On Sun, 6 Jul 2025, 15:22 Martin Konicsek, <ma...@konicsek.de> wrote:
> Hi,
> maybe nginx strips the header
>
> try proxy settings of nginx
> proxy_set_header X-XSRF-TOKEN $http_x_xsrf_token;
>
>
>
>
> 06.07.2025 13:33:35 Hrvoje Lončar <ho...@gmail.com>:
>
> > Hi!
> >
> > After recent Tomcat security changes, my POST request are failing but not
> > all the time.
> > The problem is that the same request sometimes ends up with an error and
> > sometimes not.
> >
> > Tomcat is 10.0.42 protected by nginx which handles SSL certificate and
> > forwards dynamic requests to Tomcat.
> >
> > Java exception:
> >
> >
> >
> > *2025-07-05 11:26:45,649 INFO (HttpSecurityConfig.java:210)
> [WEB_SECURITY]
> > CustomAccessDeniedHandler: Unauthorized access; URI = /suggest; URL =
> > http://thevegcat.com/suggest <http://thevegcat.com/suggest>;
> > AccessDeniedException = Invalid CSRF Token 'null' was found on the
> request
> > parameter '_csrf' or header
> >
> 'X-XSRF-TOKEN'.org.springframework.security.web.csrf.InvalidCsrfTokenException:
> > Invalid CSRF Token 'null' was found on the request parameter '_csrf' or
> > header 'X-XSRF-TOKEN'. at
> >
> org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:129)*
> >
> > ...which tells me CSRF field of POST request was chopped out of request.
> >
> > Below is my server.xml
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> >
> > *<?xml version="1.0" encoding="UTF-8"?><Server port="8005"
> > shutdown="SHUTDOWN"> <Listener
> > className="org.apache.catalina.startup.VersionLoggerListener"/>
> > <Listener className="org.apache.catalina.core.AprLifecycleListener"/>
> > <Listener
> > className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
> > <Listener
> > className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
> > <Listener
> > className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
> > <GlobalNamingResources> <Resource name="UserDatabase"
> > auth="Container" type="org.apache.catalina.UserDatabase"
> description="User
> > database that can be updated and saved"
> > factory="org.apache.catalina.users.MemoryUserDatabaseFact>
> > </GlobalNamingResources> <Service name="Catalina">
> > <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000"
> > redirectPort="8443" maxParameterCount="1000" maxPartCount="1000"/>
> > <Engine name="Catalina" defaultHost="localhost">
> > <Realm className="org.apache.catalina.realm.LockOutRealm">
> > <Realm
> > className="org.apache.catalina.realm.UserDatabaseRealm"
> > resourceName="UserDatabase"/> </Realm>
> > <Host name="localhost" appBase="webapps" unpackWARs="true"
> > autoDeploy="true"> <Valve
> > className="org.apache.catalina.valves.AccessLogValve" directory="logs"
> > prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t
> > "%r" %s %b"/> </Host>
> > </Engine> </Service></Server>*
> >
> > Thanks!
> >
> >
> > --
> > *TheVegCat.com <https://thevegcat.com/>*
> > *VegCook.net <https://vegcook.net/>*
> > *horvoje.net <https://horvoje.net/>*
>
Re: POST parameters chopped
Posted by Martin Konicsek <ma...@konicsek.de>.
Hi,
maybe nginx strips the header
try proxy settings of nginx
proxy_set_header X-XSRF-TOKEN $http_x_xsrf_token;
06.07.2025 13:33:35 Hrvoje Lončar <ho...@gmail.com>:
> Hi!
>
> After recent Tomcat security changes, my POST request are failing but not
> all the time.
> The problem is that the same request sometimes ends up with an error and
> sometimes not.
>
> Tomcat is 10.0.42 protected by nginx which handles SSL certificate and
> forwards dynamic requests to Tomcat.
>
> Java exception:
>
>
>
> *2025-07-05 11:26:45,649 INFO (HttpSecurityConfig.java:210) [WEB_SECURITY]
> CustomAccessDeniedHandler: Unauthorized access; URI = /suggest; URL =
> http://thevegcat.com/suggest <http://thevegcat.com/suggest>;
> AccessDeniedException = Invalid CSRF Token 'null' was found on the request
> parameter '_csrf' or header
> 'X-XSRF-TOKEN'.org.springframework.security.web.csrf.InvalidCsrfTokenException:
> Invalid CSRF Token 'null' was found on the request parameter '_csrf' or
> header 'X-XSRF-TOKEN'. at
> org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:129)*
>
> ...which tells me CSRF field of POST request was chopped out of request.
>
> Below is my server.xml
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
>
> *<?xml version="1.0" encoding="UTF-8"?><Server port="8005"
> shutdown="SHUTDOWN"> <Listener
> className="org.apache.catalina.startup.VersionLoggerListener"/>
> <Listener className="org.apache.catalina.core.AprLifecycleListener"/>
> <Listener
> className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
> <Listener
> className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
> <Listener
> className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
> <GlobalNamingResources> <Resource name="UserDatabase"
> auth="Container" type="org.apache.catalina.UserDatabase" description="User
> database that can be updated and saved"
> factory="org.apache.catalina.users.MemoryUserDatabaseFact>
> </GlobalNamingResources> <Service name="Catalina">
> <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000"
> redirectPort="8443" maxParameterCount="1000" maxPartCount="1000"/>
> <Engine name="Catalina" defaultHost="localhost">
> <Realm className="org.apache.catalina.realm.LockOutRealm">
> <Realm
> className="org.apache.catalina.realm.UserDatabaseRealm"
> resourceName="UserDatabase"/> </Realm>
> <Host name="localhost" appBase="webapps" unpackWARs="true"
> autoDeploy="true"> <Valve
> className="org.apache.catalina.valves.AccessLogValve" directory="logs"
> prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t
> "%r" %s %b"/> </Host>
> </Engine> </Service></Server>*
>
> Thanks!
>
>
> --
> *TheVegCat.com <https://thevegcat.com/>*
> *VegCook.net <https://vegcook.net/>*
> *horvoje.net <https://horvoje.net/>*
Re: POST parameters chopped
Posted by Hrvoje Lončar <ho...@gmail.com>.
Hi Christopher!
Just to inform you about Tomcat 11 behaviour regarding my issues with POST
parameters - so far it didn't happen, starting from 2025-07-11 until now.
That is not guarantee it won't happen ever but at least I was free of
exceptions for 6 days.
BR,
Hrvoje
On Mon, Jul 14, 2025 at 2:48 PM Christopher Schultz <
chris@christopherschultz.net> wrote:
> Hrvoje,
>
> On 7/11/25 7:51 PM, Hrvoje Lončar wrote:
> > I did a bit radical step and upgraded to 11.0.9.
> > Now waiting to see what happens.
>
> I'm interested to see what happens. My expectation is that is will
> behave exactly the same.
>
> The major differences between Tomcat 9, 10.1, and 11 are their support
> for the various specification versions. Where their (Tomcats') features
> overlap, they should be implemented identically.
>
> -chris
>
> > On Thu, Jul 10, 2025 at 1:54 PM Christopher Schultz <
> > chris@christopherschultz.net> wrote:
> >
> >> Hrvoje,
> >>
> >> On 7/10/25 6:52 AM, Hrvoje Lončar wrote:
> >>> Currently it's 10.1.39 as I wanted to avoid 10.1.42 but I get the same
> >>> unpredictable behaviour from both.
> >>
> >> Oh, that's interesting. Of course, upon your first report I had assumed
> >> it was the "maxPartCount" but then you posted your configuration which
> >> included an explicit maxPartCount set to 1000 (which seems high).
> >>
> >> But the reduced limit on "parts" was not added until 10.1.42 so things
> >> should have been working just fine before that. Note that adding
> >> maxPartCount before 10.1.42 won't actually do anything other than issue
> >> a warning.
> >>
> >>> I had 10.1.39 for some time before upgrading to 10.1.42 but no one
> >> reported
> >>> that form is not working which is not a proof that it was working
> >> correctly.
> >>
> >> So are you able to reproduce the missing _csrf parameters before
> 10.1.42?
> >>
> >> Does this only happen with POST? Does it only happen with this page?
> >>
> >> Have you configured the FailedRequestFilter[1] to catch and throw errors
> >> when the request has errors (e.g. too many parameters)?
> >>
> >> -chris
> >>
> >> [1]
> >>
> >>
> https://tomcat.apache.org/tomcat-10.0-doc/config/filter.html#Failed_Request_Filter
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >>
> >>
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
*TheVegCat.com <https://thevegcat.com/>*
*VegCook.net <https://vegcook.net/>*
*horvoje.net <https://horvoje.net/>*
Re: POST parameters chopped
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Hrvoje,
On 7/11/25 7:51 PM, Hrvoje Lončar wrote:
> I did a bit radical step and upgraded to 11.0.9.
> Now waiting to see what happens.
I'm interested to see what happens. My expectation is that is will
behave exactly the same.
The major differences between Tomcat 9, 10.1, and 11 are their support
for the various specification versions. Where their (Tomcats') features
overlap, they should be implemented identically.
-chris
> On Thu, Jul 10, 2025 at 1:54 PM Christopher Schultz <
> chris@christopherschultz.net> wrote:
>
>> Hrvoje,
>>
>> On 7/10/25 6:52 AM, Hrvoje Lončar wrote:
>>> Currently it's 10.1.39 as I wanted to avoid 10.1.42 but I get the same
>>> unpredictable behaviour from both.
>>
>> Oh, that's interesting. Of course, upon your first report I had assumed
>> it was the "maxPartCount" but then you posted your configuration which
>> included an explicit maxPartCount set to 1000 (which seems high).
>>
>> But the reduced limit on "parts" was not added until 10.1.42 so things
>> should have been working just fine before that. Note that adding
>> maxPartCount before 10.1.42 won't actually do anything other than issue
>> a warning.
>>
>>> I had 10.1.39 for some time before upgrading to 10.1.42 but no one
>> reported
>>> that form is not working which is not a proof that it was working
>> correctly.
>>
>> So are you able to reproduce the missing _csrf parameters before 10.1.42?
>>
>> Does this only happen with POST? Does it only happen with this page?
>>
>> Have you configured the FailedRequestFilter[1] to catch and throw errors
>> when the request has errors (e.g. too many parameters)?
>>
>> -chris
>>
>> [1]
>>
>> https://tomcat.apache.org/tomcat-10.0-doc/config/filter.html#Failed_Request_Filter
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: POST parameters chopped
Posted by Hrvoje Lončar <ho...@gmail.com>.
Hi Christopher!
I did a bit radical step and upgraded to 11.0.9.
Now waiting to see what happens.
Thanks a lot for your time!
On Thu, Jul 10, 2025 at 1:54 PM Christopher Schultz <
chris@christopherschultz.net> wrote:
> Hrvoje,
>
> On 7/10/25 6:52 AM, Hrvoje Lončar wrote:
> > Currently it's 10.1.39 as I wanted to avoid 10.1.42 but I get the same
> > unpredictable behaviour from both.
>
> Oh, that's interesting. Of course, upon your first report I had assumed
> it was the "maxPartCount" but then you posted your configuration which
> included an explicit maxPartCount set to 1000 (which seems high).
>
> But the reduced limit on "parts" was not added until 10.1.42 so things
> should have been working just fine before that. Note that adding
> maxPartCount before 10.1.42 won't actually do anything other than issue
> a warning.
>
> > I had 10.1.39 for some time before upgrading to 10.1.42 but no one
> reported
> > that form is not working which is not a proof that it was working
> correctly.
>
> So are you able to reproduce the missing _csrf parameters before 10.1.42?
>
> Does this only happen with POST? Does it only happen with this page?
>
> Have you configured the FailedRequestFilter[1] to catch and throw errors
> when the request has errors (e.g. too many parameters)?
>
> -chris
>
> [1]
>
> https://tomcat.apache.org/tomcat-10.0-doc/config/filter.html#Failed_Request_Filter
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
*TheVegCat.com <https://thevegcat.com/>*
*VegCook.net <https://vegcook.net/>*
*horvoje.net <https://horvoje.net/>*
Re: POST parameters chopped
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Hrvoje,
On 7/10/25 6:52 AM, Hrvoje Lončar wrote:
> Currently it's 10.1.39 as I wanted to avoid 10.1.42 but I get the same
> unpredictable behaviour from both.
Oh, that's interesting. Of course, upon your first report I had assumed
it was the "maxPartCount" but then you posted your configuration which
included an explicit maxPartCount set to 1000 (which seems high).
But the reduced limit on "parts" was not added until 10.1.42 so things
should have been working just fine before that. Note that adding
maxPartCount before 10.1.42 won't actually do anything other than issue
a warning.
> I had 10.1.39 for some time before upgrading to 10.1.42 but no one reported
> that form is not working which is not a proof that it was working correctly.
So are you able to reproduce the missing _csrf parameters before 10.1.42?
Does this only happen with POST? Does it only happen with this page?
Have you configured the FailedRequestFilter[1] to catch and throw errors
when the request has errors (e.g. too many parameters)?
-chris
[1]
https://tomcat.apache.org/tomcat-10.0-doc/config/filter.html#Failed_Request_Filter
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: POST parameters chopped
Posted by Hrvoje Lončar <ho...@gmail.com>.
Hi!
Currently it's 10.1.39 as I wanted to avoid 10.1.42 but I get the same
unpredictable behaviour from both.
I had 10.1.39 for some time before upgrading to 10.1.42 but no one reported
that form is not working which is not a proof that it was working correctly.
Thanks for your time!
BR,
Hrvoje.
root@ubuntu-8gb-nbg1-1:~ # nginx -v
nginx version: nginx/1.24.0 (Ubuntu)
root@ubuntu-8gb-nbg1-1:/opt/tomcat # ls -al
drwxr-xr-x 4 root root 4096 Jul 4 14:43 .
drwxr-xr-x 3 root root 4096 May 18 2023 ..
lrwxrwxrwx 1 root root 19 Jul 4 14:43 logs -> tomcat-10.1.39/logs
lrwxrwxrwx 1 root root 14 Jul 4 14:43 tomcat10 -> tomcat-10.1.39
drwxr-xr-x 9 tomcat tomcat 4096 Jun 17 00:48 tomcat-10.1.39
drwxr-xr-x 9 tomcat tomcat 4096 Jun 17 00:43 tomcat-10.1.42
lrwxrwxrwx 1 root root 22 Jul 4 14:43 webapps ->
tomcat-10.1.39/webapps
-rw-r----- 1 tomcat tomcat 36768248 Jun 17 00:22 catalina.out.gz
-rw-r--r-- 1 root root 143 Jun 19 22:58 README.TXT
root@ubuntu-8gb-nbg1-1:/opt/tomcat/tomcat10/conf # cat server.xml
<?xml version="1.0" encoding="UTF-8"?>
<Server port="8005" shutdown="SHUTDOWN">
<Listener
className="org.apache.catalina.startup.VersionLoggerListener"/>
<Listener
className="org.apache.catalina.core.AprLifecycleListener"/>
<Listener
className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
<Listener
className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
<Listener
className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
<GlobalNamingResources>
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase" description="User database that can
be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml"/>
</GlobalNamingResources>
<Service name="Catalina">
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000" redirectPort="8443" maxParameterCount="1000"
maxPartCount="1000"/>
<Engine name="Catalina" defaultHost="localhost">
<Realm
className="org.apache.catalina.realm.LockOutRealm">
<Realm
className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
</Realm>
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true">
<Valve
className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t
"%r" %s %b"/>
</Host>
</Engine>
</Service>
</Server>
On Wed, Jul 9, 2025 at 8:32 PM Christopher Schultz <
chris@christopherschultz.net> wrote:
> Hrvoje,
>
> On 7/9/25 1:04 PM, Hrvoje Lončar wrote:
> > This is the form:
> > https://thevegcat.com/suggest
> >
> > 13 fields are visible plus file field and few are hidden fields including
> > csrf token - nothing special or extreme.
> > Web app is published 6 years ago and all those years there was no trouble
> > at all.
>
> Which exact version of Tomcat is being used?
>
> Thanks,
> -chris
>
> > On Wed, 9 Jul 2025, 16:14 Christopher Schultz, <
> chris@christopherschultz.net>
> > wrote:
> >
> >> Hrvoje,
> >>
> >> On 7/6/25 7:33 AM, Hrvoje Lončar wrote:
> >> > After recent Tomcat security changes, my POST request are failing
> >> > but not all the time. The problem is that the same request sometimes
> >> > ends up with an error and sometimes not.
> >> >
> >> > Tomcat is 10.0.42 protected by nginx which handles SSL certificate
> and
> >> > forwards dynamic requests to Tomcat.>
> >> > [snip]
> >> >
> >> > <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000"
> >> > redirectPort="8443" maxParameterCount="1000" maxPartCount="1000"/>
> >>
> >> Are you anywhere near approaching your parameter limit of 1000?
> >>
> >> Is the nginx access log showing the _csrf parameters in the URL? How
> >> about the Tomcat log?
> >>
> >> -chris
> >>
> >> ---------------------------------------------------------------------
> >> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> >> For additional commands, e-mail: users-help@tomcat.apache.org
> >>
> >>
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
*TheVegCat.com <https://thevegcat.com/>*
*VegCook.net <https://vegcook.net/>*
*horvoje.net <https://horvoje.net/>*
Re: POST parameters chopped
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Hrvoje,
On 7/9/25 1:04 PM, Hrvoje Lončar wrote:
> This is the form:
> https://thevegcat.com/suggest
>
> 13 fields are visible plus file field and few are hidden fields including
> csrf token - nothing special or extreme.
> Web app is published 6 years ago and all those years there was no trouble
> at all.
Which exact version of Tomcat is being used?
Thanks,
-chris
> On Wed, 9 Jul 2025, 16:14 Christopher Schultz, <ch...@christopherschultz.net>
> wrote:
>
>> Hrvoje,
>>
>> On 7/6/25 7:33 AM, Hrvoje Lončar wrote:
>> > After recent Tomcat security changes, my POST request are failing
>> > but not all the time. The problem is that the same request sometimes
>> > ends up with an error and sometimes not.
>> >
>> > Tomcat is 10.0.42 protected by nginx which handles SSL certificate and
>> > forwards dynamic requests to Tomcat.>
>> > [snip]
>> >
>> > <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000"
>> > redirectPort="8443" maxParameterCount="1000" maxPartCount="1000"/>
>>
>> Are you anywhere near approaching your parameter limit of 1000?
>>
>> Is the nginx access log showing the _csrf parameters in the URL? How
>> about the Tomcat log?
>>
>> -chris
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: POST parameters chopped
Posted by Hrvoje Lončar <ho...@gmail.com>.
Hi!
This is the form:
https://thevegcat.com/suggest
13 fields are visible plus file field and few are hidden fields including
csrf token - nothing special or extreme.
Web app is published 6 years ago and all those years there was no trouble
at all.
BR,
Hrvoje
*TheVegCat.com <https://thevegcat.com/>*
*VegCook.net <https://vegcook.net/>*
*horvoje.net <https://horvoje.net/>*
On Wed, 9 Jul 2025, 16:14 Christopher Schultz, <ch...@christopherschultz.net>
wrote:
> Hrvoje,
>
> On 7/6/25 7:33 AM, Hrvoje Lončar wrote:
> > After recent Tomcat security changes, my POST request are failing
> > but not all the time. The problem is that the same request sometimes
> > ends up with an error and sometimes not.
> >
> > Tomcat is 10.0.42 protected by nginx which handles SSL certificate and
> > forwards dynamic requests to Tomcat.>
> > [snip]
> >
> > <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000"
> > redirectPort="8443" maxParameterCount="1000" maxPartCount="1000"/>
>
> Are you anywhere near approaching your parameter limit of 1000?
>
> Is the nginx access log showing the _csrf parameters in the URL? How
> about the Tomcat log?
>
> -chris
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: POST parameters chopped
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Hrvoje,
On 7/6/25 7:33 AM, Hrvoje Lončar wrote:
> After recent Tomcat security changes, my POST request are failing
> but not all the time. The problem is that the same request sometimes
> ends up with an error and sometimes not.
>
> Tomcat is 10.0.42 protected by nginx which handles SSL certificate and
> forwards dynamic requests to Tomcat.>
> [snip]
>
> <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000"
> redirectPort="8443" maxParameterCount="1000" maxPartCount="1000"/>
Are you anywhere near approaching your parameter limit of 1000?
Is the nginx access log showing the _csrf parameters in the URL? How
about the Tomcat log?
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org