You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Utkarsh Dave <ut...@gmail.com> on 2014/03/21 07:09:41 UTC
Issue while configuring CSRFPreventionFilter !
Hi all,
I am trying to configure the Tomcat inbuilt filter
(tomcat.valves.CiscoResponseHeaderFilter) into my $TOMCAT_HOME/conf/web.xml
<filter>
<filter-name>CSRF</filter-name>
<filter-class>org.apache.catalina.filters.CsrfPreventionFilter</filter-class>
<init-param>
<param-name>entryPoints</param-name>
<param-value>/index.jsp</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>CSRF</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
But after doing this Tomcat server stuck in starting status and do not
starts completely.
If I comment out the filter, Tomcat starts properly.
I verified the web.xml of Tomcat manager (
$TOMCAT_HOME/webapps/manager/WEB-INF/web.xml) where this filter is
configured by default and found that in below is used in filter mapping
<filter-mapping>
<filter-name>CSRF</filter-name>
<servlet-name>HTMLManager</servlet-name>
<servlet-name>jsp</servlet-name>
</filter-mapping>
So when use the same in $TOMCAT_HOME/conf/web.xml, Tomcat works properly.
Why i am not able to map the filter to /* url?
What is the difference between using servlet name and url pattern ?
Can anyone provide the inputs and help in this regard.
Thanks for your time in advance.
-Utkarsh
Re: Issue while configuring CSRFPreventionFilter !
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Utkarsh,
On 3/21/14, 3:01 AM, Utkarsh Dave wrote:
> Thanks Konstantin. My version of TOMCAT is 7.0.41 you said with
> this configuration i will not be able to access ROOT/index.html or
> any of the images, css or js files. What can i do to overcome this
> if i still want to go ahead configuring the
> $TOMCAT_HOME/conf/web.xml.
Stop right here.
Remove your Tomcat installation: you have corrupted it. Re-install a
new one.
Then, without editing anything in TOMCAT_HOME/conf, install your web
application.
Now, edit the file TOMCAT_HOME/webapps/yourwebapp/WEB-INF/web.xml
instead and add your Filter.
> Can i add them in entryPoints. ? I want to do it in this file
> because i dont want my 50 + webapps to modify there respective
> web.xml file. Rather we can configure them at 1 common place.
You do not want to do this, because the configuration for the Filter
is likely to be different in all of your web apps. If you want CSRF
protection in each web application, then you should configure them
appropriately. Your web applications should be self-contained.
If you don't want to hand-modify your individual web.xml files, then
write a deployment procedure that does it for you. If you tinker
around with conf/web.xml you are more likely to break things than
solve anything.
As you say, Tomcat won't even start up right now due to your edits.
>>> I am trying to configure the Tomcat inbuilt filter
>>> (tomcat.valves.CiscoResponseHeaderFilter) into my
>> $TOMCAT_HOME/conf/web.xml
Is that a typo? Did you mean CSRF instead of Cisco?
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBCAAGBQJTLISxAAoJEBzwKT+lPKRYnesP/R/IlCCfjarAYzEORcXB/wkw
0//Ew5ky3bnEOMRwPuE6loov2toyQ7KDqlfNFItw4CZcq0XrXHLHcIY2dE7Yz9j7
rDqDgLEl7Gh53LrFitvjnwryyY4I11gqKPxdpa/Mm9z2DhsltUuKKYgALcLKre4K
hYf6z36SBrpDUSsJBa6ALxLCrLliCs41K/3WjIdtICRZhkHx+4subgtKTyZu1d4n
Fngw2IShCXxf8Ai5w12P0hoZtk1SP4TZumV77YmtvEMbjSbYJEIzYiul6YTWTq9b
PtTIikZHq3qgUpHSCrj++hqxROVseHi0BouRSJs8ku8DxYNPhhNFEt5rKq6cw67x
BiX6scnZmhb3wZBKUF/R4nzH+6WBLbKwJdfPHOAOFInTEMYpEJwcjK8h7IeCvaLJ
VRaL8zbuDjNqCzfuJG42gVs3dVDFVv9cuYUOHaBCi3vPhUcRQGPRYdLlxoZIkvIm
uSCNqC4eoD3E7INKkrLexjmTzEF37eFWa43K8CgLlIolo/G9lRrxCMO7uGRBM+OV
WbTIogfxRrtojq5uAdWfDNwn7sg0rQhhJ4OG1MBLM8gOBSwcWGMBNHysviiaeYiN
GDGGClm7t3LQqIAoi5eKoE8ZE6RadF1D7wFTjT6/RkpZbzNpZZL+DgrPGM/kNOEo
80ijs0neNnq52gxmjcO9
=0kf8
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Issue while configuring CSRFPreventionFilter !
Posted by Utkarsh Dave <ut...@gmail.com>.
Thanks Konstantin.
My version of TOMCAT is 7.0.41
you said with this configuration i will not be able to access
ROOT/index.html or any of the images, css or js files.
What can i do to overcome this if i still want to go ahead configuring the
$TOMCAT_HOME/conf/web.xml. Can i add them in entryPoints. ?
I want to do it in this file because i dont want my 50 + webapps to modify
there respective web.xml file. Rather we can configure them at 1 common
place.
-Thanks
Utkarsh
On Fri, Mar 21, 2014 at 12:17 PM, Konstantin Kolinko <knst.kolinko@gmail.com
> wrote:
> 2014-03-21 10:09 GMT+04:00 Utkarsh Dave <ut...@gmail.com>:
> > Hi all,
> >
> > I am trying to configure the Tomcat inbuilt filter
> > (tomcat.valves.CiscoResponseHeaderFilter) into my
> $TOMCAT_HOME/conf/web.xml
>
> 1. The above file provides defaults for all web applications. It is
> unwise to modify it.
>
> E.g. with such configuration you wouldn't be able to access
> ROOT/index.html or any of the images, css or js files.
>
> > ...
> >
> > But after doing this Tomcat server stuck in starting status and do not
> > starts completely.
>
> 2. Read the logs.
>
> 3. If it is "stuck", take several thread dumps to see what exactly it is
> doing.
> If you do not know how to take thread dumps, see "Howto" page in Tomcat
> FAQ.
>
> > If I comment out the filter, Tomcat starts properly.
> > ...
>
> 4. As mentioned on the page below, what is your version of Tomcat?
> http://tomcat.apache.org/lists.html#tomcat-users
>
>
> Best regards,
> Konstantin Kolinko
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Issue while configuring CSRFPreventionFilter !
Posted by Konstantin Kolinko <kn...@gmail.com>.
2014-03-21 10:09 GMT+04:00 Utkarsh Dave <ut...@gmail.com>:
> Hi all,
>
> I am trying to configure the Tomcat inbuilt filter
> (tomcat.valves.CiscoResponseHeaderFilter) into my $TOMCAT_HOME/conf/web.xml
1. The above file provides defaults for all web applications. It is
unwise to modify it.
E.g. with such configuration you wouldn't be able to access
ROOT/index.html or any of the images, css or js files.
> ...
>
> But after doing this Tomcat server stuck in starting status and do not
> starts completely.
2. Read the logs.
3. If it is "stuck", take several thread dumps to see what exactly it is doing.
If you do not know how to take thread dumps, see "Howto" page in Tomcat FAQ.
> If I comment out the filter, Tomcat starts properly.
> ...
4. As mentioned on the page below, what is your version of Tomcat?
http://tomcat.apache.org/lists.html#tomcat-users
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org