You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Cris Berneburg - US <cb...@caci.com> on 2014/12/11 17:28:26 UTC
tomcat on windows 2012 weirdness
Hi Folks
I'm having trouble with my JSP web app using Tomcat 6 and 7 on Windows Server 2012.
The issue is that no matter what file I request in the browser URL, it always returns the app welcome file, that is, the login page. Even when requesting an image. The one exception is that after logging in, the main menu page appears, but none of the graphics or CSS files load. Clicking on the app links, it just brings up the welcome page again. Checking the Tomcat log files, I see that Tomcat is returning the welcome page instead of the files requested in the main menu page.
Using the Tomcat manager, I see that my application has a ridiculous number of sessions, instead of just one. I interpret that for every single file requested, a new Tomcat session is being generated and possibly invalidated.
FYI, using the same setup on Windows Server 2003 and 2008 works fine. Opening the same firewall ports on all three OS's has been done. Even disabling the firewall on 2012 does not affect the issue in any way. And to make things even weirder, accessing the application from a browser on the server itself using localhost works fine!
I wonder if there is some mystery setting somewhere that is crippling the app. Got any suggestions? Please help. Thanks!
--
Cris Berneburg, Lead Software Engineer
CACI, IRMA Project, 703-679-5313
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Cris Berneburg - US <cb...@caci.com>.
Chris
>>> When emitting a URL onto a page for a client, the application needs to run the URL through a call to HttpServletResponse.encodeURL(String) or HttpServletResponse.encodeRedirectURL(String). These methods will add the ";jsessionid=[id]" path parameter to the URL when the client does not support cookies. In this way, session-tracking will still work.
You are "almost certainly" correct about the sessions and cookies. :-) I tried another experiment. I logged into the app to get to the main page and obtain a session. The images did not load. FYI, I checked the links and they do *not* append ";jsessionid=[id]". Then, I went to the address bar and requested one of the images that failed BUT appended ";jsessionid=[id]". (I obtained the active session ID from a Tomcat log file.) The image loaded!
>>>If the application isn't doing this for *every URL in the whole application*, then sessions can be dropped and the user will have to re-authenticate. If this is the case, you only have two options:
>>> 1. Re-enable cookies on your browser 2. Review the application and
>>>fix every instance of a URL on a page (it's a huge job)
So the web application is *not* written correctly to handle when the client does not support cookies. That is, it does not call HttpServletResponse .encodeURL or .encodeRedirectURL. And wow, rewriting would be "a huge job". :-)
--
Cris Berneburg, Lead Software Engineer
CACI, IRMA Project, 703-679-5313
-----Original Message-----
From: Christopher Schultz [mailto:chris@christopherschultz.net]
Sent: Friday, December 12, 2014 2:36 PM
To: Tomcat Users List
Subject: Re: tomcat on windows 2012 weirdness
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cris,
On 12/12/14 2:18 PM, Cris Berneburg - US wrote:
> Hi Chris
>
> Thanks for your replies. I am somewhat new to Tomcat, only been using
> it for 1 year, so some of the technical details are new to me.
>
>> Is it possible that you are not using URL-based session ids, and that
>> your browser has cookies disabled via a policy?
>
> I will need to check URL-based session ids. How do I check?
If your browser has cookies disabled, then all the links on the web pages in this web application should have a ";jsessionid=[id]" path parameter added to them. See below.
> Also, my browser does not have cookies disabled.
This is almost certainly the issue.
If your browser does not support cookies (Tomcat knows if you support cookies if you send a JSESSIONID cookie, but it can't tell if you send nothing), then the web application must fall-back to using URL-based session-tracking.
Unfortunately, this isn't entirely auto-magical: the web application needs to support it properly. Most 3rd-party web applications should already be doing things properly, but if you have an in-house application, it may not be written properly.
When emitting a URL onto a page for a client, the application needs to run the URL through a call to HttpServletResponse.encodeURL(String) or HttpServletResponse.encodeRedirectURL(String). These methods will add the ";jsessionid=[id]" path parameter to the URL when the client does not support cookies. In this way, session-tracking will still work.
If the application isn't doing this for *every URL in the whole application*, then sessions can be dropped and the user will have to re-authenticate. If this is the case, you only have two options:
1. Re-enable cookies on your browser
2. Review the application and fix every instance of a URL on a page (it's a huge job)
>> Is the browser or the server (or both) on Windows 2012?
>
> The server is on Win 2012. It works OK when both the browser and
> server are the same 2012 VM. I don't know if it works when both client
> and server are both Win 2012 but different machines. I will be able to
> check that soon. It does not work with different client OS version and
> box than the server, but that may simply be coincidence.
It may be a cookie policy: if localhost is trusted, the cookie policy may change.
>> Try using a protocol sniffer to see if the browser is sending a
>> session id to the server, and if the server is responding with a
>> session id either before or after login.
>
> Wow, that sounds intimidating - never done that before. :-)
It's worth learning how to do. I think there's a plug-in for MSIE called IEHeaders (or something similar). Install that and you can watch the conversation between client and server -- even when TLS is being used.
Hope that helps,
- -chris
> -----Original Message----- From: Christopher Schultz
> [mailto:chris@christopherschultz.net] Sent: Thursday, December 11,
> 2014 1:35 PM To: Tomcat Users List Subject: Re: tomcat on windows
> 2012 weirdness
>
> Cris,
>
> On 12/11/14 12:41 PM, Christopher Schultz wrote:
>> Cris,
>
>> On 12/11/14 11:28 AM, Cris Berneburg - US wrote:
>>> I'm having trouble with my JSP web app using Tomcat 6 and 7 on
>>> Windows Server 2012.
>
>>> The issue is that no matter what file I request in the browser URL,
>>> it always returns the app welcome file, that is, the login page.
>>> Even when requesting an image. The one exception is that after
>>> logging in, the main menu page appears, but none of the graphics or
>>> CSS files load. Clicking on the app links, it just brings up the
>>> welcome page again. Checking the Tomcat log files, I see that
>>> Tomcat is returning the welcome page instead of the files requested
>>> in the main menu page.
>
>>> Using the Tomcat manager, I see that my application has a ridiculous
>>> number of sessions, instead of just one. I interpret that for every
>>> single file requested, a new Tomcat session is being generated and
>>> possibly invalidated.
>
>>> FYI, using the same setup on Windows Server 2003 and 2008 works
>>> fine. Opening the same firewall ports on all three OS's has been
>>> done. Even disabling the firewall on 2012 does not affect the issue
>>> in any way. And to make things even weirder, accessing the
>>> application from a browser on the server itself using localhost
>>> works fine!
>
>>> I wonder if there is some mystery setting somewhere that is
>>> crippling the app. Got any suggestions? Please help.
>>> Thanks!
>
>> Check two quick things:
>
>> 1. Do you have any security-constraints in WEB-INF/web.xml? If so, do
>> they all make sense, and can users actually access those resources
>> once logged-in (or at all)?
>
>> 2. Do you have any servlets in WEB-INF/web.xml mapped to "/"
>> other than the DefaultServlet (which should be configured by default
>> so you shouldn't have to configure it yourself)?
>
> After re-reading your post, it's pretty clear that my initial
> questions will be worthless and not help you.
>
> Is it possible that you are not using URL-based session ids, and that
> your browser has cookies disabled via a policy? Is the browser or the
> server (or both) on Windows 2012?
>
> Try using a protocol sniffer to see if the browser is sending a
> session id to the server, and if the server is responding with a
> session id either before or after login.
>
> -chris
>
>
> ---------------------------------------------------------------------
>
>
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUi0O5AAoJEBzwKT+lPKRY75IQAMAXlA67XF2xe6YZg+cZNdmF
XYzYeijvh4GOclJJPYYSkrkvTdLUB49WHEVCH8U+zI8aNVXMLGoFj8WrD79gHNvI
d7UBvd16blrJnYCArTpzk0UlhgD84mLNaVTpyrv8wD6Vqsky6B9lrk/sYl3J/lbr
Tu/S2KxPektrd2JtqCsXCQefeniCOvGTbbWA5oEdEYMkwM7Q9DO5uwL+nRE0KgGr
rp0//nbj3Fm+QsQ2Qm1CILUEQrh/ZT1IvEy/OON0wp/OSd0RwoWzBQna7+T7iP50
Y3toyAyJ1IWj/jN45XWVoMBHZYBrSrka/rOw38Y2mygIthQkjI1N0/m14fvcJ0A5
+YbRuZTdB785nFesOaNPCDPRjynxaHZUiG7FbiSGTZuVgKrVvP9T8l6ILfrgab9c
O5PjBcyn6MQWlDWHCwvgFaNbfFpC8phUc0TZQ2x0eDP4/SYw1U1MBsWvS5iA6AP1
ekWWb7BdJhydKSBId+hHsVDNNQfCVfKbc2QrbOkyDITc4XW04O/b1xWq2+KRwhzg
ubZZNrj9KKWr/pUWx/g1pUlhpAUpSFOc5ltgcHi/BN9BPxylKezg1hYZzSXTEndg
RbQXPkWBY6GRngVIRyjg1fp7IloPYgKnkbY6gkGTXw9sjG2XeeIuzdi1lGoZerk3
TQ2uHb9ELH34ITqb+9oI
=THku
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: tomcat on windows 2012 weirdness
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Mark,
On 12/18/14 1:31 PM, Mark Eggers wrote:
> Chris,
>
> On 12/18/2014 9:42 AM, Christopher Schultz wrote:
>> Cris,
>
>> On 12/18/14 12:22 PM, Cris Berneburg - US wrote:
>>> Chris
>
>>> cb> I interpret this to mean that my local IE browser thinks
>>> the cb> intranet web site that I access either by name or by IP
>>> is actually cb> 2 different sites in 2 different security
>>> zones. I will try to cb> adjust my browser security settings
>>> and see if that makes any differences.
>
>>> cs> That sounds plausible. If IE changes its cookie policy
>>> based upon those zones, then you may have found the issue. I
>>> wonder if your local policy whitelists a certain IP range but
>>> doesn't use hostnames, which may account for the difference.
>
>>> Turning off IE Compatibility Mode for intranet sites did boost
>>> the request header User-Agent from "Mozilla/4.0" to
>>> "Mozilla/5.0", but the browser still would not accept cookies.
>>> I have since found the source of the problem and the solution,
>>> which I will send in a follow-up message.
>
>> Looking forward to it.
>
>>> cs> Time to ask your webapp software vendor to fix their web
>>> application cs> so it can be used without cookies ;)
>
>>> Ouch! I *am* the software developer for this web application.
>>> :-)
>
>> Well, the good news is that there's a chance it'll get done.
>> Sometimes 3rd-party vendors will just say "sorry, we simply
>> don't support that configuration; use a supported configuration"
>> which is a lousy answer IMO.
>
>> You can also fix the application as you go; you don't have to do
>> 100% of it all at once... nobody has noticed before, so nobody
>> will notice if you do 10% of it and then sit on it for a while.
>
>> There's no better time to start fixing your URLs than now, so
>> every time you have to edit a HTML template, just fix the URLs
>> in that file. Here's the recipe you want:
>
>> Change
>
>> <a href="/foo/bar">...</a>
>
>> to
>
>> <a href="<%= request.getContextPath() +
>> response.encodeURL("/foo/bar") %>">...</a>
>
>> Better yet, use JSTL:
>
>
> Won't you need:
>
> <a href="<c:url value='/foo/bar'/>">...</a>
>
> instead of
>
>> <a href="<c:url value="/foo/bar"/>">...</a>
>
> unless you set
>
> org.apache.jasper.compiler.Parser.STRICT_QUOTE_ESCAPING=false
>
> in catalina.properties?
Good question. I wouldn't think it would matter since the <a href=
should be ignored and the <c:url> should be compiled, but it might
matter if you are using .jsp versus .jspx.
I try to avoid JSP as much as possible, so I'm not a good judge ;)
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUkzRxAAoJEBzwKT+lPKRYQYYP/3eI8B2CIGvO3z2wxZqTxtq8
lPo1Qky4Kd8jqFnj8s4PUMB+/JixifsDcqYjQUFjD1i8HGSSHGE8bM6gDcgQHC5M
+qgz8K7pkqZ1IKbU7U/I4JDOvVHS7GPfD+SUWPB8shJIC/eLv+fbzmnOnsb5E5Eu
vO9iWmQs4yWfhja9uOjs3SEuhm+PKrA8xcIyyFWqpkMxLWk+26khtMpgHsDrBlRN
I75IdT1hflJ5L+3buXa6sRTTANn4IJtSP8XaV+pZshZKfPNMwJH3whJwt1d+cuH+
7rWEN0F5dJs5zl9kucFAwfWY8fdEYxKuJvO8hyJ8m33OA5veaalMHTOiXPzLaoC6
xfecsJKlhcWHMKgoed7bKknkiMJSaRPEWjkifR2ZdolFr+yo+HUuz85nPVcqgW89
W+/OVlq4wpDm+fMK6EOpKOH5CG6Am5/wKI4hfkl2cVlkQ/DAQ3/xy/m+TyvFOL3H
+rkUc6UZzF5KRuN3WhdpCIjFril1ExoR/4jgBmEZ806maX5rhbHazsGA8YIBXRY4
RnG3oUPiaJCBqIP+GcI98H57c22xQ6ez7tB5N3W5L2MPCgqZ4ebs1iNOBE4twypk
nY8ejtuViZaPjZie4hkaBg1I50Jymec+15KGFo00E2QY4/L1S7yL9Nj3o1a8odMd
u5W12FbVL07ShhLmrfvB
=lSJX
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: tomcat on windows 2012 weirdness
Posted by Mark Eggers <it...@yahoo.com.INVALID>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Chris,
On 12/18/2014 9:42 AM, Christopher Schultz wrote:
> Cris,
>
> On 12/18/14 12:22 PM, Cris Berneburg - US wrote:
>> Chris
>
>> cb> I interpret this to mean that my local IE browser thinks the
>> cb> intranet web site that I access either by name or by IP is
>> actually cb> 2 different sites in 2 different security zones. I
>> will try to cb> adjust my browser security settings and see if
>> that makes any differences.
>
>> cs> That sounds plausible. If IE changes its cookie policy based
>> upon those zones, then you may have found the issue. I wonder if
>> your local policy whitelists a certain IP range but doesn't use
>> hostnames, which may account for the difference.
>
>> Turning off IE Compatibility Mode for intranet sites did boost
>> the request header User-Agent from "Mozilla/4.0" to
>> "Mozilla/5.0", but the browser still would not accept cookies. I
>> have since found the source of the problem and the solution,
>> which I will send in a follow-up message.
>
> Looking forward to it.
>
>> cs> Time to ask your webapp software vendor to fix their web
>> application cs> so it can be used without cookies ;)
>
>> Ouch! I *am* the software developer for this web application.
>> :-)
>
> Well, the good news is that there's a chance it'll get done.
> Sometimes 3rd-party vendors will just say "sorry, we simply don't
> support that configuration; use a supported configuration" which is
> a lousy answer IMO.
>
> You can also fix the application as you go; you don't have to do
> 100% of it all at once... nobody has noticed before, so nobody will
> notice if you do 10% of it and then sit on it for a while.
>
> There's no better time to start fixing your URLs than now, so
> every time you have to edit a HTML template, just fix the URLs in
> that file. Here's the recipe you want:
>
> Change
>
> <a href="/foo/bar">...</a>
>
> to
>
> <a href="<%= request.getContextPath() +
> response.encodeURL("/foo/bar") %>">...</a>
>
> Better yet, use JSTL:
>
Won't you need:
<a href="<c:url value='/foo/bar'/>">...</a>
instead of
> <a href="<c:url value="/foo/bar"/>">...</a>
unless you set
org.apache.jasper.compiler.Parser.STRICT_QUOTE_ESCAPING=false
in catalina.properties?
>
> Then you don't need to see all that nasty Java stuff.
>
> Remember you also want to fix <img>, <script>, <link>, <base>...
> everything that can have a URL.
>
> -chris
. . . been bit by this before
/mde/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQEcBAEBAgAGBQJUkx1wAAoJEEFGbsYNeTwtUikH/0h/3RUm1LT3rGCGJTGvqEz/
te3BNqa9siys4axmXKDjn/Y4SkZgMO6h9GEojbuMH+PKoc8qlmOl2rbOAkAML06L
JNljND2si2JkFebUMB6Q7pjAr0nXpK2SuVxA7K7TfgwPluzwHPC6nk/uK3ksF18k
O9Ra4jiMAFK2MyHd7LLzIojkQGOtCSMLWuFNg7Vxd1pW8I2JaX+2ndN65aBNH5ZJ
RYwoud8l5vqCtgn4U1kQhHsMJ+umaxUz+kYGbNIo5axXxF9kl+4ft6n7zUnlBhzL
0/CUKdRvxjls1E2uSiKHJSxwj0ozvtsQlKUCZai+U7eNX+2k55+aJYN5q+ahyU4=
=ehuK
-----END PGP SIGNATURE-----
---
This email is free from viruses and malware because avast! Antivirus protection is active.
http://www.avast.com
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: tomcat on windows 2012 weirdness
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cris,
On 12/18/14 12:22 PM, Cris Berneburg - US wrote:
> Chris
>
> cb> I interpret this to mean that my local IE browser thinks the
> cb> intranet web site that I access either by name or by IP is
> actually cb> 2 different sites in 2 different security zones. I
> will try to cb> adjust my browser security settings and see if
> that makes any differences.
>
> cs> That sounds plausible. If IE changes its cookie policy based
> upon those zones, then you may have found the issue. I wonder if
> your local policy whitelists a certain IP range but doesn't use
> hostnames, which may account for the difference.
>
> Turning off IE Compatibility Mode for intranet sites did boost the
> request header User-Agent from "Mozilla/4.0" to "Mozilla/5.0", but
> the browser still would not accept cookies. I have since found
> the source of the problem and the solution, which I will send in a
> follow-up message.
Looking forward to it.
> cs> Time to ask your webapp software vendor to fix their web
> application cs> so it can be used without cookies ;)
>
> Ouch! I *am* the software developer for this web application. :-)
Well, the good news is that there's a chance it'll get done. Sometimes
3rd-party vendors will just say "sorry, we simply don't support that
configuration; use a supported configuration" which is a lousy answer IMO.
You can also fix the application as you go; you don't have to do 100%
of it all at once... nobody has noticed before, so nobody will notice
if you do 10% of it and then sit on it for a while.
There's no better time to start fixing your URLs than now, so every
time you have to edit a HTML template, just fix the URLs in that file.
Here's the recipe you want:
Change
<a href="/foo/bar">...</a>
to
<a href="<%= request.getContextPath() +
response.encodeURL("/foo/bar") %>">...</a>
Better yet, use JSTL:
<a href="<c:url value="/foo/bar"/>">...</a>
Then you don't need to see all that nasty Java stuff.
Remember you also want to fix <img>, <script>, <link>, <base>...
everything that can have a URL.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUkxIjAAoJEBzwKT+lPKRYfngP/2nZtpB8UdyGL2FkzzzKqG+c
SRo8+Mx2KAYbGXudGhijbZojvfNqv8R1/qfUPzDDZEXmPnKKp9lEZEKY3ppwBFA6
VoBXkFXiLlppIRT9S0LHEWPeinT8wRNH9recSvSAmfFE8PaTDE8vuZ/jeohI4kFs
YXu8IhTfPsc9Yuxgrx5UxPRvjWFZuvySotxvsHj65TSh28TRebk4xWlBsUDxkRM1
INLpjh7IqgudFXa4oikxBxnNXArtRwrq3KnsDwqCHTA3xKle8q2Ye6wFMf4y3TMc
i1uqjHjIHpg01n7TKOvzwUTGL9YpQHNgGl1jYZYrfiB21/QNFpKyPD6y3RiLOjLT
p532xmV9zo+tYpTl8wvv9v7Bo3lo3DxDRweJSyVf7BUtxdNpNMlIqMiR8NLG4V0n
YDDN2IxD+3X9vETcj+LyeLNMcJy5vA7m2tyeErymB8SZ7d8unw0K/mhILuGGjpIF
EQ0Yw/2NtPXOZR4bxB3yyV4gMgAe+7D3xLynwal+RVqwWk6Bui/eo68fQnlgwwa2
BD9gYoA7mketZ7p/JhM2wyxWOZVXnD0nf/vayj8i2+w6WvSaTxzDbDJ0+QOw3PvE
9ryk16P04XotlaBewGrDoZDsbsrlIlTLaR0UtaTfLX4EWZRWXARRYQZVKvj/lm4F
z/KPPejPgYTk6XgrBJxA
=Y7yF
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Cris Berneburg - US <cb...@caci.com>.
Chris
cb> I interpret this to mean that my local IE browser thinks the
cb> intranet web site that I access either by name or by IP is actually
cb> 2 different sites in 2 different security zones. I will try to
cb> adjust my browser security settings and see if that makes any differences.
cs> That sounds plausible. If IE changes its cookie policy based upon those zones, then you may have found the issue. I wonder if your local policy whitelists a certain IP range but doesn't use hostnames, which may account for the difference.
Turning off IE Compatibility Mode for intranet sites did boost the request header User-Agent from "Mozilla/4.0" to "Mozilla/5.0", but the browser still would not accept cookies. I have since found the source of the problem and the solution, which I will send in a follow-up message.
cs> Time to ask your webapp software vendor to fix their web application
cs> so it can be used without cookies ;)
Ouch! I *am* the software developer for this web application. :-)
--
Cris Berneburg, Lead Software Engineer
CACI, IRMA Project, 703-679-5313
-----Original Message-----
From: Christopher Schultz [mailto:chris@christopherschultz.net]
Sent: Wednesday, December 17, 2014 5:41 PM
To: Tomcat Users List
Subject: Re: tomcat on windows 2012 weirdness
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cris,
On 12/17/14 2:15 PM, Cris Berneburg - US wrote:
> Ameer (and Chris)
>
> I discovered something else. When accessing the internal web site by
> name, it does not work right. But when I access the web site by IP
> address, it functions correctly!
>
>> If you are using IE9, it has a very useful utility in its developer
>> tool to capture network traffic. Few simple steps to capture it:
>> Press F12 --> Go to network tab--> start capturing You can
>> save/export the captured data in an xml file and then can see
>> everything going to-and-fro between your browser and server.
>
>> Compare the traffic when you are communicating from localhost, which
>> you say is working fine, with the traffic when you are accessing from
>> an outside client. Pay special attention to the headers section of
>> the HTTP calls.
>
> Thanks for your suggestion. I tried the IE9 Developer Tools trace,
> and it was revealing. I noticed something strange.
> Accessing the web server by IP, the User-Agent was "Mozilla/5.0", but
> by server name User-Agent was "Mozilla/4.0". There are other header
> differences too. By IP has the session and cookie info, but by name
> does not - aha! The "Accept" header was different also.
>
> I interpret this to mean that my local IE browser thinks the intranet
> web site that I access either by name or by IP is actually
> 2 different sites in 2 different security zones. I will try to adjust
> my browser security settings and see if that makes any differences.
That sounds plausible. If IE changes its cookie policy based upon those zones, then you may have found the issue. I wonder if your local policy whitelists a certain IP range but doesn't use hostnames, which may account for the difference.
Time to ask your webapp software vendor to fix their web application so it can be used without cookies ;)
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUkgZyAAoJEBzwKT+lPKRYiw0QAIVq/Y8aO6JkXM0RQ4d2dWLX
4TDwVF0XI07uVa1QcvkgYxqdvd6pA4yOeZVbqDTv72gGG5gPnKVkqPTCp0lmoZ3m
SVxQ0fwSoJOFkzTVo8LMj/LtNYpMbgGr95S4uU7yEU9NvREYggEbD0npxVWt605Q
Z+WBvLoSCdmimEQFagCQDiqbx+daosd+Af+WUbP3DrKjT5aLj31CEp3hWzvjas3s
eYANOMe0bwf3s5oV1zcRHJLF9cO/mnFFn4ZTW8T9MFUJyYqgQg8rX7Kl5mynpiGt
SNOO3RF3IvEzosjMri0FKqrIvLL5TFt7cYvHKTWI0MH3eJERvAnV7HLFebfgaSVv
peBxNcNHTr0QLzmKbvM6ykF01xDfqxsBbOXz7CXb4XkHfj7JdoMSa/SuEWQIIc7X
vM5+Z4ObVF491VIq7AZBNLh/BwPVT8f5ot0QiFS234FeulfSqRH2rbDjHQhwP4Z0
bpVsmTyY9v2dJdmUZubTBOXgmKgyFSWInIEIEX6i7wQmJLeIU9fNflzg9/iqxxeb
WQtYu74SfP3MS79Fy6R/p1v4GxRIpSEIuE2Ovchnb9J3DXLkMKO03xcgu8IoupI9
OjHqjC6CnIV1XGS/cJL96bdAuPYvv3pvPloeT1u+gQ+3KdAf0/XJxBNPSFBOQZJ7
p7LIG+jYWMtX0x7pMWai
=KlDA
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Cris Berneburg - US <cb...@caci.com>.
Konstantin
Thanks for your response. I was encouraged by your suggestion, thinking that setting would be the magic solution to my problem. :-)
I wrote a very simple filter to set the response header for "X-UA-Compatible: IE=edge". However, it did not solve the problem. I could see in the IE developer tools that the name and value were set. But the request header User-Agent remained "Mozilla/4.0", and the still browser would not accept cookies.
Turning off IE Compatibility Mode for intranet sites did boost the request header User-Agent from "Mozilla/4.0" to "Mozilla/5.0", but the browser still would not accept cookies.
I have since found the source of the problem and the solution, which I will send in a follow-up message.
--
Cris Berneburg, Lead Software Engineer
CACI, IRMA Project, 703-679-5313
-----Original Message-----
From: Konstantin Preißer [mailto:kpreisser@apache.org]
Sent: Wednesday, December 17, 2014 2:45 PM
To: 'Tomcat Users List'
Subject: RE: tomcat on windows 2012 weirdness
Hi,
> -----Original Message-----
> From: Cris Berneburg - US [mailto:cberneburg@caci.com]
> Sent: Wednesday, December 17, 2014 8:15 PM
> To: 'Tomcat Users List'
> Subject: RE: tomcat on windows 2012 weirdness
>
> Ameer (and Chris)
>
> I discovered something else. When accessing the internal web site by
> name, it does not work right. But when I access the web site by IP
> address, it functions correctly!
>
> > If you are using IE9, it has a very useful utility in its developer
> > tool to
> capture network traffic. Few simple steps to capture it:
> > Press F12 --> Go to network tab--> start capturing You can
> > save/export the
> captured data in an xml file and then can see everything going
> to-and-fro between your browser and server.
>
> > Compare the traffic when you are communicating from localhost, which
> you say is working fine, with the traffic when you are accessing from
> an outside client.
> > Pay special attention to the headers section of the HTTP calls.
>
> Thanks for your suggestion. I tried the IE9 Developer Tools trace,
> and it was revealing. I noticed something strange. Accessing the web
> server by IP, the User-Agent was "Mozilla/5.0", but by server name
> User-Agent was "Mozilla/4.0". There are other header differences too.
> By IP has the session and cookie info, but by name does not - aha!
> The "Accept" header was different also.
>
> I interpret this to mean that my local IE browser thinks the intranet
> web site that I access either by name or by IP is actually 2 different
> sites in 2 different security zones. I will try to adjust my browser
> security settings and see if that makes any differences.
Just some additional notes about IE (I don't know if they are applicable to your situation):
- IE displays "intranet sites" in "Compatibility mode" by default (that is, IE7 mode). This is why I always add the following HTTP header to websites:
X-UA-Compatible: IE=edge
This will ensure IE always uses the latest document mode/level. Note that with this header IE's browser mode can still be compatibility view (sending a Mozilla/4.0 MSIE 7.0 User-Agent) although the document mode will be the latest (IE9 on IE9, IE11 on IE11 etc.)
The Developer Tools should show the current browser mode and document mode of IE.
- In IE on a Windows Server OS, for security reasons the IE enhanced security mode is active which will block some content on websites in the "internet" security zone (while for intranet sites it will use a lower security level). This mode can be enabled or disabled in the Server Manager.
Regards,
Konstantin Preißer
Re: tomcat on windows 2012 weirdness
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cris,
On 12/17/14 2:15 PM, Cris Berneburg - US wrote:
> Ameer (and Chris)
>
> I discovered something else. When accessing the internal web site
> by name, it does not work right. But when I access the web site by
> IP address, it functions correctly!
>
>> If you are using IE9, it has a very useful utility in its
>> developer tool to capture network traffic. Few simple steps to
>> capture it: Press F12 --> Go to network tab--> start capturing
>> You can save/export the captured data in an xml file and then can
>> see everything going to-and-fro between your browser and server.
>
>> Compare the traffic when you are communicating from localhost,
>> which you say is working fine, with the traffic when you are
>> accessing from an outside client. Pay special attention to the
>> headers section of the HTTP calls.
>
> Thanks for your suggestion. I tried the IE9 Developer Tools
> trace, and it was revealing. I noticed something strange.
> Accessing the web server by IP, the User-Agent was "Mozilla/5.0",
> but by server name User-Agent was "Mozilla/4.0". There are other
> header differences too. By IP has the session and cookie info, but
> by name does not - aha! The "Accept" header was different also.
>
> I interpret this to mean that my local IE browser thinks the
> intranet web site that I access either by name or by IP is actually
> 2 different sites in 2 different security zones. I will try to
> adjust my browser security settings and see if that makes any
> differences.
That sounds plausible. If IE changes its cookie policy based upon
those zones, then you may have found the issue. I wonder if your local
policy whitelists a certain IP range but doesn't use hostnames, which
may account for the difference.
Time to ask your webapp software vendor to fix their web application
so it can be used without cookies ;)
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUkgZyAAoJEBzwKT+lPKRYiw0QAIVq/Y8aO6JkXM0RQ4d2dWLX
4TDwVF0XI07uVa1QcvkgYxqdvd6pA4yOeZVbqDTv72gGG5gPnKVkqPTCp0lmoZ3m
SVxQ0fwSoJOFkzTVo8LMj/LtNYpMbgGr95S4uU7yEU9NvREYggEbD0npxVWt605Q
Z+WBvLoSCdmimEQFagCQDiqbx+daosd+Af+WUbP3DrKjT5aLj31CEp3hWzvjas3s
eYANOMe0bwf3s5oV1zcRHJLF9cO/mnFFn4ZTW8T9MFUJyYqgQg8rX7Kl5mynpiGt
SNOO3RF3IvEzosjMri0FKqrIvLL5TFt7cYvHKTWI0MH3eJERvAnV7HLFebfgaSVv
peBxNcNHTr0QLzmKbvM6ykF01xDfqxsBbOXz7CXb4XkHfj7JdoMSa/SuEWQIIc7X
vM5+Z4ObVF491VIq7AZBNLh/BwPVT8f5ot0QiFS234FeulfSqRH2rbDjHQhwP4Z0
bpVsmTyY9v2dJdmUZubTBOXgmKgyFSWInIEIEX6i7wQmJLeIU9fNflzg9/iqxxeb
WQtYu74SfP3MS79Fy6R/p1v4GxRIpSEIuE2Ovchnb9J3DXLkMKO03xcgu8IoupI9
OjHqjC6CnIV1XGS/cJL96bdAuPYvv3pvPloeT1u+gQ+3KdAf0/XJxBNPSFBOQZJ7
p7LIG+jYWMtX0x7pMWai
=KlDA
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Konstantin Preißer <kp...@apache.org>.
Hi,
> -----Original Message-----
> From: Cris Berneburg - US [mailto:cberneburg@caci.com]
> Sent: Wednesday, December 17, 2014 8:15 PM
> To: 'Tomcat Users List'
> Subject: RE: tomcat on windows 2012 weirdness
>
> Ameer (and Chris)
>
> I discovered something else. When accessing the internal web site by name,
> it does not work right. But when I access the web site by IP address, it
> functions correctly!
>
> > If you are using IE9, it has a very useful utility in its developer tool to
> capture network traffic. Few simple steps to capture it:
> > Press F12 --> Go to network tab--> start capturing You can save/export the
> captured data in an xml file and then can see everything going to-and-fro
> between your browser and server.
>
> > Compare the traffic when you are communicating from localhost, which
> you say is working fine, with the traffic when you are accessing from an
> outside client.
> > Pay special attention to the headers section of the HTTP calls.
>
> Thanks for your suggestion. I tried the IE9 Developer Tools trace, and it was
> revealing. I noticed something strange. Accessing the web server by IP, the
> User-Agent was "Mozilla/5.0", but by server name User-Agent was
> "Mozilla/4.0". There are other header differences too. By IP has the session
> and cookie info, but by name does not - aha! The "Accept" header was
> different also.
>
> I interpret this to mean that my local IE browser thinks the intranet web site
> that I access either by name or by IP is actually 2 different sites in 2 different
> security zones. I will try to adjust my browser security settings and see if that
> makes any differences.
Just some additional notes about IE (I don't know if they are applicable to your situation):
- IE displays "intranet sites" in "Compatibility mode" by default (that is, IE7 mode). This is why I always add the following HTTP header to websites:
X-UA-Compatible: IE=edge
This will ensure IE always uses the latest document mode/level. Note that with this header IE's browser mode can still be compatibility view (sending a Mozilla/4.0 MSIE 7.0 User-Agent) although the document mode will be the latest (IE9 on IE9, IE11 on IE11 etc.)
The Developer Tools should show the current browser mode and document mode of IE.
- In IE on a Windows Server OS, for security reasons the IE enhanced security mode is active which will block some content on websites in the "internet" security zone (while for intranet sites it will use a lower security level). This mode can be enabled or disabled in the Server Manager.
Regards,
Konstantin Preißer
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Cris Berneburg - US <cb...@caci.com>.
Ameer (and Chris)
I discovered something else. When accessing the internal web site by name, it does not work right. But when I access the web site by IP address, it functions correctly!
> If you are using IE9, it has a very useful utility in its developer tool to capture network traffic. Few simple steps to capture it:
> Press F12 --> Go to network tab--> start capturing You can save/export the captured data in an xml file and then can see everything going to-and-fro between your browser and server.
> Compare the traffic when you are communicating from localhost, which you say is working fine, with the traffic when you are accessing from an outside client.
> Pay special attention to the headers section of the HTTP calls.
Thanks for your suggestion. I tried the IE9 Developer Tools trace, and it was revealing. I noticed something strange. Accessing the web server by IP, the User-Agent was "Mozilla/5.0", but by server name User-Agent was "Mozilla/4.0". There are other header differences too. By IP has the session and cookie info, but by name does not - aha! The "Accept" header was different also.
I interpret this to mean that my local IE browser thinks the intranet web site that I access either by name or by IP is actually 2 different sites in 2 different security zones. I will try to adjust my browser security settings and see if that makes any differences.
--
Cris Berneburg, Lead Software Engineer
CACI, IRMA Project, 703-679-5313
-----Original Message-----
From: Ameer Mawia [mailto:ameer.mawia@gmail.com]
Sent: Friday, December 12, 2014 3:12 PM
To: Tomcat Users List
Subject: Re: tomcat on windows 2012 weirdness
On Sat, Dec 13, 2014 at 1:06 AM, Christopher Schultz < chris@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Cris,
>
> On 12/12/14 2:18 PM, Cris Berneburg - US wrote:
> > Hi Chris
> >
> > Thanks for your replies. I am somewhat new to Tomcat, only been
> > using it for 1 year, so some of the technical details are new to me.
> >
> >> Is it possible that you are not using URL-based session ids, and
> >> that your browser has cookies disabled via a policy?
> >
> > I will need to check URL-based session ids. How do I check?
>
> If your browser has cookies disabled, then all the links on the web
> pages in this web application should have a ";jsessionid=[id]" path
> parameter added to them. See below.
>
> > Also, my browser does not have cookies disabled.
>
> This is almost certainly the issue.
>
>
Chris, I think he meant cookies are already enabled on his browser.
> If your browser does not support cookies (Tomcat knows if you support
> cookies if you send a JSESSIONID cookie, but it can't tell if you send
> nothing), then the web application must fall-back to using URL-based
> session-tracking.
>
> Unfortunately, this isn't entirely auto-magical: the web application
> needs to support it properly. Most 3rd-party web applications should
> already be doing things properly, but if you have an in-house
> application, it may not be written properly.
>
> When emitting a URL onto a page for a client, the application needs to
> run the URL through a call to HttpServletResponse.encodeURL(String) or
> HttpServletResponse.encodeRedirectURL(String). These methods will add
> the ";jsessionid=[id]" path parameter to the URL when the client does
> not support cookies. In this way, session-tracking will still work.
>
> If the application isn't doing this for *every URL in the whole
> application*, then sessions can be dropped and the user will have to
> re-authenticate. If this is the case, you only have two options:
>
> 1. Re-enable cookies on your browser
> 2. Review the application and fix every instance of a URL on a page
> (it's a huge job)
>
> >> Is the browser or the server (or both) on Windows 2012?
> >
> > The server is on Win 2012. It works OK when both the browser and
> > server are the same 2012 VM. I don't know if it works when both
> > client and server are both Win 2012 but different machines. I will
> > be able to check that soon. It does not work with different client
> > OS version and box than the server, but that may simply be
> > coincidence.
>
> It may be a cookie policy: if localhost is trusted, the cookie policy
> may change.
>
> >> Try using a protocol sniffer to see if the browser is sending a
> >> session id to the server, and if the server is responding with a
> >> session id either before or after login.
> >
> > Wow, that sounds intimidating - never done that before. :-)
>
> It's worth learning how to do. I think there's a plug-in for MSIE
> called IEHeaders (or something similar). Install that and you can
> watch the conversation between client and server -- even when TLS is
> being used.
>
>
If you are using IE9, it has a very useful utility in its developer tool to capture network traffic. Few simple steps to capture it:
Press F12 --> Go to network tab--> start capturing You can save/export the captured data in an xml file and then can see everything going to-and-fro between your browser and server.
Compare the traffic when you are communicating from localhost, which you say is working fine, with the traffic when you are accessing from an outside client.
Pay special attention to the headers section of the HTTP calls.
Hope that helps,
> - -chris
>
> > -----Original Message----- From: Christopher Schultz
> > [mailto:chris@christopherschultz.net] Sent: Thursday, December 11,
> > 2014 1:35 PM To: Tomcat Users List Subject: Re: tomcat on windows
> > 2012 weirdness
> >
> > Cris,
> >
> > On 12/11/14 12:41 PM, Christopher Schultz wrote:
> >> Cris,
> >
> >> On 12/11/14 11:28 AM, Cris Berneburg - US wrote:
> >>> I'm having trouble with my JSP web app using Tomcat 6 and 7 on
> >>> Windows Server 2012.
> >
> >>> The issue is that no matter what file I request in the browser
> >>> URL, it always returns the app welcome file, that is, the login
> >>> page. Even when requesting an image. The one exception is that
> >>> after logging in, the main menu page appears, but none of the
> >>> graphics or CSS files load. Clicking on the app links, it just
> >>> brings up the welcome page again. Checking the Tomcat log files,
> >>> I see that Tomcat is returning the welcome page instead of the
> >>> files requested in the main menu page.
> >
> >>> Using the Tomcat manager, I see that my application has a
> >>> ridiculous number of sessions, instead of just one. I interpret
> >>> that for every single file requested, a new Tomcat session is
> >>> being generated and possibly invalidated.
> >
> >>> FYI, using the same setup on Windows Server 2003 and 2008 works
> >>> fine. Opening the same firewall ports on all three OS's has been
> >>> done. Even disabling the firewall on 2012 does not affect the
> >>> issue in any way. And to make things even weirder, accessing the
> >>> application from a browser on the server itself using localhost
> >>> works fine!
> >
> >>> I wonder if there is some mystery setting somewhere that is
> >>> crippling the app. Got any suggestions? Please help.
> >>> Thanks!
> >
> >> Check two quick things:
> >
> >> 1. Do you have any security-constraints in WEB-INF/web.xml? If so,
> >> do they all make sense, and can users actually access those
> >> resources once logged-in (or at all)?
> >
> >> 2. Do you have any servlets in WEB-INF/web.xml mapped to "/"
> >> other than the DefaultServlet (which should be configured by
> >> default so you shouldn't have to configure it yourself)?
> >
> > After re-reading your post, it's pretty clear that my initial
> > questions will be worthless and not help you.
> >
> > Is it possible that you are not using URL-based session ids, and
> > that your browser has cookies disabled via a policy? Is the browser
> > or the server (or both) on Windows 2012?
> >
> > Try using a protocol sniffer to see if the browser is sending a
> > session id to the server, and if the server is responding with a
> > session id either before or after login.
> >
> > -chris
> >
> >
> > --------------------------------------------------------------------
> > -
> >
> >
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
> >
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> Comment: GPGTools - http://gpgtools.org
>
> iQIcBAEBCAAGBQJUi0O5AAoJEBzwKT+lPKRY75IQAMAXlA67XF2xe6YZg+cZNdmF
> XYzYeijvh4GOclJJPYYSkrkvTdLUB49WHEVCH8U+zI8aNVXMLGoFj8WrD79gHNvI
> d7UBvd16blrJnYCArTpzk0UlhgD84mLNaVTpyrv8wD6Vqsky6B9lrk/sYl3J/lbr
> Tu/S2KxPektrd2JtqCsXCQefeniCOvGTbbWA5oEdEYMkwM7Q9DO5uwL+nRE0KgGr
> rp0//nbj3Fm+QsQ2Qm1CILUEQrh/ZT1IvEy/OON0wp/OSd0RwoWzBQna7+T7iP50
> Y3toyAyJ1IWj/jN45XWVoMBHZYBrSrka/rOw38Y2mygIthQkjI1N0/m14fvcJ0A5
> +YbRuZTdB785nFesOaNPCDPRjynxaHZUiG7FbiSGTZuVgKrVvP9T8l6ILfrgab9c
> O5PjBcyn6MQWlDWHCwvgFaNbfFpC8phUc0TZQ2x0eDP4/SYw1U1MBsWvS5iA6AP1
> ekWWb7BdJhydKSBId+hHsVDNNQfCVfKbc2QrbOkyDITc4XW04O/b1xWq2+KRwhzg
> ubZZNrj9KKWr/pUWx/g1pUlhpAUpSFOc5ltgcHi/BN9BPxylKezg1hYZzSXTEndg
> RbQXPkWBY6GRngVIRyjg1fp7IloPYgKnkbY6gkGTXw9sjG2XeeIuzdi1lGoZerk3
> TQ2uHb9ELH34ITqb+9oI
> =THku
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Cris Berneburg - US <cb...@caci.com>.
Chris
Thanks again for your replies. Meh, sorry for the double-negative about the cookies. :-)
One thing I learned by trial and error is that accessing the internal web site by name behaves wrongly, but accessing it by IP behaves rightly!
Also, I must be wrong about the cookies being enabled/disabled anyway. I did the IE9 trace Ameer suggested, and it was revealing. It appears the cookies are conditional depending on how the server is accessed. Will follow up in another message.
--
Cris Berneburg, Lead Software Engineer
CACI, IRMA Project, 703-679-5313
-----Original Message-----
From: Christopher Schultz [mailto:chris@christopherschultz.net]
Sent: Friday, December 12, 2014 3:15 PM
To: Tomcat Users List
Subject: Re: tomcat on windows 2012 weirdness
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Ameer,
On 12/12/14 3:11 PM, Ameer Mawia wrote:
> On Sat, Dec 13, 2014 at 1:06 AM, Christopher Schultz <
> chris@christopherschultz.net> wrote:
>
> Cris,
>
> On 12/12/14 2:18 PM, Cris Berneburg - US wrote:
>>>> Hi Chris
>>>>
>>>> Thanks for your replies. I am somewhat new to Tomcat, only been
>>>> using it for 1 year, so some of the technical details are new to
>>>> me.
>>>>
>>>>> Is it possible that you are not using URL-based session ids, and
>>>>> that your browser has cookies disabled via a policy?
>>>>
>>>> I will need to check URL-based session ids. How do I check?
>
> If your browser has cookies disabled, then all the links on the web
> pages in this web application should have a ";jsessionid=[id]"
> path parameter added to them. See below.
>
>>>> Also, my browser does not have cookies disabled.
>
> This is almost certainly the issue.
>
>
>> Chris, I think he meant cookies are already enabled on his browser.
Ah! A double-negative. I read too quickly.
Well, the protocol analyzer will certainly help inform the conversation.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUi0zKAAoJEBzwKT+lPKRYZHAQAJYqjchuvYXOuYQN2PmjAbly
dnlmXiOJIeaPVCaVtFy2oBxhxP0KaAZHFUdofF2n9Fx2s5EIL5fxexIp0wkQmmuE
PORs1Wm5Iz0ArOVCXcP3lBgQFYB/TRY0ryo/2MTQE7Eto77frBGL6gduqiHeelJn
vfJ9DF1IujxWadGVzhF6277wkANrL/RBJBr23ly/dBGmZ09mzGMtGWbLdXPxN6rv
IimC1K8/r4RKbz8qYRib1CCx2Rmn5xfxw5aAp0I71xyUdBygSH6DiZmzLKDalCnV
OqX6ujD5TlFO7x56I7/C+BdohZUXopTKQwVFnvbgbTsfBwZ9qNQCFtcI6QauYJWK
B9Q8Jo5uZ+7kSE/5U9EY6G6vZUKGBi2iqc13CWMrpMNOavjO9vIc823WBjkfPVIP
cd8WQgwjQaHLooGeHKxkPZDiUKXsIK4/aGLs38V2Oe3NvTnZLuWqAcXyuwke2/sP
Yav+Yp9F7QKIZnlJWSjIM3Nk4DZjg4P2p3pi/N+k3ko0g/4L9P4tBirE2BwzT/Yu
CpFLF//Io0xTeSk5BbB2ghTBY5dzZOZNA4oNhTAXvgvrLaENYKb2vwRu8ArACVR+
bBnFGgkEC+vl26KgcZVJEfrj+9Q+Q9eMAs7VkAIikfizZYogYdXBKNXdj+Y72LM2
/Cup5W8jGgaXJnzLCm8k
=lmci
-----END PGP SIGNATURE-----
Re: tomcat on windows 2012 weirdness
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Ameer,
On 12/12/14 3:11 PM, Ameer Mawia wrote:
> On Sat, Dec 13, 2014 at 1:06 AM, Christopher Schultz <
> chris@christopherschultz.net> wrote:
>
> Cris,
>
> On 12/12/14 2:18 PM, Cris Berneburg - US wrote:
>>>> Hi Chris
>>>>
>>>> Thanks for your replies. I am somewhat new to Tomcat, only
>>>> been using it for 1 year, so some of the technical details
>>>> are new to me.
>>>>
>>>>> Is it possible that you are not using URL-based session
>>>>> ids, and that your browser has cookies disabled via a
>>>>> policy?
>>>>
>>>> I will need to check URL-based session ids. How do I check?
>
> If your browser has cookies disabled, then all the links on the
> web pages in this web application should have a ";jsessionid=[id]"
> path parameter added to them. See below.
>
>>>> Also, my browser does not have cookies disabled.
>
> This is almost certainly the issue.
>
>
>> Chris, I think he meant cookies are already enabled on his
>> browser.
Ah! A double-negative. I read too quickly.
Well, the protocol analyzer will certainly help inform the conversation.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUi0zKAAoJEBzwKT+lPKRYZHAQAJYqjchuvYXOuYQN2PmjAbly
dnlmXiOJIeaPVCaVtFy2oBxhxP0KaAZHFUdofF2n9Fx2s5EIL5fxexIp0wkQmmuE
PORs1Wm5Iz0ArOVCXcP3lBgQFYB/TRY0ryo/2MTQE7Eto77frBGL6gduqiHeelJn
vfJ9DF1IujxWadGVzhF6277wkANrL/RBJBr23ly/dBGmZ09mzGMtGWbLdXPxN6rv
IimC1K8/r4RKbz8qYRib1CCx2Rmn5xfxw5aAp0I71xyUdBygSH6DiZmzLKDalCnV
OqX6ujD5TlFO7x56I7/C+BdohZUXopTKQwVFnvbgbTsfBwZ9qNQCFtcI6QauYJWK
B9Q8Jo5uZ+7kSE/5U9EY6G6vZUKGBi2iqc13CWMrpMNOavjO9vIc823WBjkfPVIP
cd8WQgwjQaHLooGeHKxkPZDiUKXsIK4/aGLs38V2Oe3NvTnZLuWqAcXyuwke2/sP
Yav+Yp9F7QKIZnlJWSjIM3Nk4DZjg4P2p3pi/N+k3ko0g/4L9P4tBirE2BwzT/Yu
CpFLF//Io0xTeSk5BbB2ghTBY5dzZOZNA4oNhTAXvgvrLaENYKb2vwRu8ArACVR+
bBnFGgkEC+vl26KgcZVJEfrj+9Q+Q9eMAs7VkAIikfizZYogYdXBKNXdj+Y72LM2
/Cup5W8jGgaXJnzLCm8k
=lmci
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: tomcat on windows 2012 weirdness
Posted by Ameer Mawia <am...@gmail.com>.
On Sat, Dec 13, 2014 at 1:06 AM, Christopher Schultz <
chris@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Cris,
>
> On 12/12/14 2:18 PM, Cris Berneburg - US wrote:
> > Hi Chris
> >
> > Thanks for your replies. I am somewhat new to Tomcat, only been
> > using it for 1 year, so some of the technical details are new to
> > me.
> >
> >> Is it possible that you are not using URL-based session ids, and
> >> that your browser has cookies disabled via a policy?
> >
> > I will need to check URL-based session ids. How do I check?
>
> If your browser has cookies disabled, then all the links on the web
> pages in this web application should have a ";jsessionid=[id]" path
> parameter added to them. See below.
>
> > Also, my browser does not have cookies disabled.
>
> This is almost certainly the issue.
>
>
Chris, I think he meant cookies are already enabled on his browser.
> If your browser does not support cookies (Tomcat knows if you support
> cookies if you send a JSESSIONID cookie, but it can't tell if you send
> nothing), then the web application must fall-back to using URL-based
> session-tracking.
>
> Unfortunately, this isn't entirely auto-magical: the web application
> needs to support it properly. Most 3rd-party web applications should
> already be doing things properly, but if you have an in-house
> application, it may not be written properly.
>
> When emitting a URL onto a page for a client, the application needs to
> run the URL through a call to HttpServletResponse.encodeURL(String) or
> HttpServletResponse.encodeRedirectURL(String). These methods will add
> the ";jsessionid=[id]" path parameter to the URL when the client does
> not support cookies. In this way, session-tracking will still work.
>
> If the application isn't doing this for *every URL in the whole
> application*, then sessions can be dropped and the user will have to
> re-authenticate. If this is the case, you only have two options:
>
> 1. Re-enable cookies on your browser
> 2. Review the application and fix every instance of a URL on a page
> (it's a huge job)
>
> >> Is the browser or the server (or both) on Windows 2012?
> >
> > The server is on Win 2012. It works OK when both the browser and
> > server are the same 2012 VM. I don't know if it works when both
> > client and server are both Win 2012 but different machines. I will
> > be able to check that soon. It does not work with different client
> > OS version and box than the server, but that may simply be
> > coincidence.
>
> It may be a cookie policy: if localhost is trusted, the cookie policy
> may change.
>
> >> Try using a protocol sniffer to see if the browser is sending a
> >> session id to the server, and if the server is responding with a
> >> session id either before or after login.
> >
> > Wow, that sounds intimidating - never done that before. :-)
>
> It's worth learning how to do. I think there's a plug-in for MSIE
> called IEHeaders (or something similar). Install that and you can
> watch the conversation between client and server -- even when TLS is
> being used.
>
>
If you are using IE9, it has a very useful utility in its developer tool to
capture network traffic. Few simple steps to capture it:
Press F12 --> Go to network tab--> start capturing
You can save/export the captured data in an xml file and then can see
everything going to-and-fro between your browser and server.
Compare the traffic when you are communicating from localhost, which you
say is working fine, with the traffic when you are accessing from an
outside client.
Pay special attention to the headers section of the HTTP calls.
Hope that helps,
> - -chris
>
> > -----Original Message----- From: Christopher Schultz
> > [mailto:chris@christopherschultz.net] Sent: Thursday, December 11,
> > 2014 1:35 PM To: Tomcat Users List Subject: Re: tomcat on windows
> > 2012 weirdness
> >
> > Cris,
> >
> > On 12/11/14 12:41 PM, Christopher Schultz wrote:
> >> Cris,
> >
> >> On 12/11/14 11:28 AM, Cris Berneburg - US wrote:
> >>> I'm having trouble with my JSP web app using Tomcat 6 and 7 on
> >>> Windows Server 2012.
> >
> >>> The issue is that no matter what file I request in the browser
> >>> URL, it always returns the app welcome file, that is, the login
> >>> page. Even when requesting an image. The one exception is that
> >>> after logging in, the main menu page appears, but none of the
> >>> graphics or CSS files load. Clicking on the app links, it just
> >>> brings up the welcome page again. Checking the Tomcat log
> >>> files, I see that Tomcat is returning the welcome page instead
> >>> of the files requested in the main menu page.
> >
> >>> Using the Tomcat manager, I see that my application has a
> >>> ridiculous number of sessions, instead of just one. I
> >>> interpret that for every single file requested, a new Tomcat
> >>> session is being generated and possibly invalidated.
> >
> >>> FYI, using the same setup on Windows Server 2003 and 2008 works
> >>> fine. Opening the same firewall ports on all three OS's has
> >>> been done. Even disabling the firewall on 2012 does not affect
> >>> the issue in any way. And to make things even weirder,
> >>> accessing the application from a browser on the server itself
> >>> using localhost works fine!
> >
> >>> I wonder if there is some mystery setting somewhere that is
> >>> crippling the app. Got any suggestions? Please help.
> >>> Thanks!
> >
> >> Check two quick things:
> >
> >> 1. Do you have any security-constraints in WEB-INF/web.xml? If
> >> so, do they all make sense, and can users actually access those
> >> resources once logged-in (or at all)?
> >
> >> 2. Do you have any servlets in WEB-INF/web.xml mapped to "/"
> >> other than the DefaultServlet (which should be configured by
> >> default so you shouldn't have to configure it yourself)?
> >
> > After re-reading your post, it's pretty clear that my initial
> > questions will be worthless and not help you.
> >
> > Is it possible that you are not using URL-based session ids, and
> > that your browser has cookies disabled via a policy? Is the browser
> > or the server (or both) on Windows 2012?
> >
> > Try using a protocol sniffer to see if the browser is sending a
> > session id to the server, and if the server is responding with a
> > session id either before or after login.
> >
> > -chris
> >
> >
> > ---------------------------------------------------------------------
> >
> >
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
> >
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
> Comment: GPGTools - http://gpgtools.org
>
> iQIcBAEBCAAGBQJUi0O5AAoJEBzwKT+lPKRY75IQAMAXlA67XF2xe6YZg+cZNdmF
> XYzYeijvh4GOclJJPYYSkrkvTdLUB49WHEVCH8U+zI8aNVXMLGoFj8WrD79gHNvI
> d7UBvd16blrJnYCArTpzk0UlhgD84mLNaVTpyrv8wD6Vqsky6B9lrk/sYl3J/lbr
> Tu/S2KxPektrd2JtqCsXCQefeniCOvGTbbWA5oEdEYMkwM7Q9DO5uwL+nRE0KgGr
> rp0//nbj3Fm+QsQ2Qm1CILUEQrh/ZT1IvEy/OON0wp/OSd0RwoWzBQna7+T7iP50
> Y3toyAyJ1IWj/jN45XWVoMBHZYBrSrka/rOw38Y2mygIthQkjI1N0/m14fvcJ0A5
> +YbRuZTdB785nFesOaNPCDPRjynxaHZUiG7FbiSGTZuVgKrVvP9T8l6ILfrgab9c
> O5PjBcyn6MQWlDWHCwvgFaNbfFpC8phUc0TZQ2x0eDP4/SYw1U1MBsWvS5iA6AP1
> ekWWb7BdJhydKSBId+hHsVDNNQfCVfKbc2QrbOkyDITc4XW04O/b1xWq2+KRwhzg
> ubZZNrj9KKWr/pUWx/g1pUlhpAUpSFOc5ltgcHi/BN9BPxylKezg1hYZzSXTEndg
> RbQXPkWBY6GRngVIRyjg1fp7IloPYgKnkbY6gkGTXw9sjG2XeeIuzdi1lGoZerk3
> TQ2uHb9ELH34ITqb+9oI
> =THku
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: tomcat on windows 2012 weirdness
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cris,
On 12/12/14 2:18 PM, Cris Berneburg - US wrote:
> Hi Chris
>
> Thanks for your replies. I am somewhat new to Tomcat, only been
> using it for 1 year, so some of the technical details are new to
> me.
>
>> Is it possible that you are not using URL-based session ids, and
>> that your browser has cookies disabled via a policy?
>
> I will need to check URL-based session ids. How do I check?
If your browser has cookies disabled, then all the links on the web
pages in this web application should have a ";jsessionid=[id]" path
parameter added to them. See below.
> Also, my browser does not have cookies disabled.
This is almost certainly the issue.
If your browser does not support cookies (Tomcat knows if you support
cookies if you send a JSESSIONID cookie, but it can't tell if you send
nothing), then the web application must fall-back to using URL-based
session-tracking.
Unfortunately, this isn't entirely auto-magical: the web application
needs to support it properly. Most 3rd-party web applications should
already be doing things properly, but if you have an in-house
application, it may not be written properly.
When emitting a URL onto a page for a client, the application needs to
run the URL through a call to HttpServletResponse.encodeURL(String) or
HttpServletResponse.encodeRedirectURL(String). These methods will add
the ";jsessionid=[id]" path parameter to the URL when the client does
not support cookies. In this way, session-tracking will still work.
If the application isn't doing this for *every URL in the whole
application*, then sessions can be dropped and the user will have to
re-authenticate. If this is the case, you only have two options:
1. Re-enable cookies on your browser
2. Review the application and fix every instance of a URL on a page
(it's a huge job)
>> Is the browser or the server (or both) on Windows 2012?
>
> The server is on Win 2012. It works OK when both the browser and
> server are the same 2012 VM. I don't know if it works when both
> client and server are both Win 2012 but different machines. I will
> be able to check that soon. It does not work with different client
> OS version and box than the server, but that may simply be
> coincidence.
It may be a cookie policy: if localhost is trusted, the cookie policy
may change.
>> Try using a protocol sniffer to see if the browser is sending a
>> session id to the server, and if the server is responding with a
>> session id either before or after login.
>
> Wow, that sounds intimidating - never done that before. :-)
It's worth learning how to do. I think there's a plug-in for MSIE
called IEHeaders (or something similar). Install that and you can
watch the conversation between client and server -- even when TLS is
being used.
Hope that helps,
- -chris
> -----Original Message----- From: Christopher Schultz
> [mailto:chris@christopherschultz.net] Sent: Thursday, December 11,
> 2014 1:35 PM To: Tomcat Users List Subject: Re: tomcat on windows
> 2012 weirdness
>
> Cris,
>
> On 12/11/14 12:41 PM, Christopher Schultz wrote:
>> Cris,
>
>> On 12/11/14 11:28 AM, Cris Berneburg - US wrote:
>>> I'm having trouble with my JSP web app using Tomcat 6 and 7 on
>>> Windows Server 2012.
>
>>> The issue is that no matter what file I request in the browser
>>> URL, it always returns the app welcome file, that is, the login
>>> page. Even when requesting an image. The one exception is that
>>> after logging in, the main menu page appears, but none of the
>>> graphics or CSS files load. Clicking on the app links, it just
>>> brings up the welcome page again. Checking the Tomcat log
>>> files, I see that Tomcat is returning the welcome page instead
>>> of the files requested in the main menu page.
>
>>> Using the Tomcat manager, I see that my application has a
>>> ridiculous number of sessions, instead of just one. I
>>> interpret that for every single file requested, a new Tomcat
>>> session is being generated and possibly invalidated.
>
>>> FYI, using the same setup on Windows Server 2003 and 2008 works
>>> fine. Opening the same firewall ports on all three OS's has
>>> been done. Even disabling the firewall on 2012 does not affect
>>> the issue in any way. And to make things even weirder,
>>> accessing the application from a browser on the server itself
>>> using localhost works fine!
>
>>> I wonder if there is some mystery setting somewhere that is
>>> crippling the app. Got any suggestions? Please help.
>>> Thanks!
>
>> Check two quick things:
>
>> 1. Do you have any security-constraints in WEB-INF/web.xml? If
>> so, do they all make sense, and can users actually access those
>> resources once logged-in (or at all)?
>
>> 2. Do you have any servlets in WEB-INF/web.xml mapped to "/"
>> other than the DefaultServlet (which should be configured by
>> default so you shouldn't have to configure it yourself)?
>
> After re-reading your post, it's pretty clear that my initial
> questions will be worthless and not help you.
>
> Is it possible that you are not using URL-based session ids, and
> that your browser has cookies disabled via a policy? Is the browser
> or the server (or both) on Windows 2012?
>
> Try using a protocol sniffer to see if the browser is sending a
> session id to the server, and if the server is responding with a
> session id either before or after login.
>
> -chris
>
>
> ---------------------------------------------------------------------
>
>
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUi0O5AAoJEBzwKT+lPKRY75IQAMAXlA67XF2xe6YZg+cZNdmF
XYzYeijvh4GOclJJPYYSkrkvTdLUB49WHEVCH8U+zI8aNVXMLGoFj8WrD79gHNvI
d7UBvd16blrJnYCArTpzk0UlhgD84mLNaVTpyrv8wD6Vqsky6B9lrk/sYl3J/lbr
Tu/S2KxPektrd2JtqCsXCQefeniCOvGTbbWA5oEdEYMkwM7Q9DO5uwL+nRE0KgGr
rp0//nbj3Fm+QsQ2Qm1CILUEQrh/ZT1IvEy/OON0wp/OSd0RwoWzBQna7+T7iP50
Y3toyAyJ1IWj/jN45XWVoMBHZYBrSrka/rOw38Y2mygIthQkjI1N0/m14fvcJ0A5
+YbRuZTdB785nFesOaNPCDPRjynxaHZUiG7FbiSGTZuVgKrVvP9T8l6ILfrgab9c
O5PjBcyn6MQWlDWHCwvgFaNbfFpC8phUc0TZQ2x0eDP4/SYw1U1MBsWvS5iA6AP1
ekWWb7BdJhydKSBId+hHsVDNNQfCVfKbc2QrbOkyDITc4XW04O/b1xWq2+KRwhzg
ubZZNrj9KKWr/pUWx/g1pUlhpAUpSFOc5ltgcHi/BN9BPxylKezg1hYZzSXTEndg
RbQXPkWBY6GRngVIRyjg1fp7IloPYgKnkbY6gkGTXw9sjG2XeeIuzdi1lGoZerk3
TQ2uHb9ELH34ITqb+9oI
=THku
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Cris Berneburg - US <cb...@caci.com>.
Hi Chris
Thanks for your replies. I am somewhat new to Tomcat, only been using it for 1 year, so some of the technical details are new to me.
> Is it possible that you are not using URL-based session ids, and that your browser has cookies disabled via a policy?
I will need to check URL-based session ids. How do I check? Also, my browser does not have cookies disabled.
> Is the browser or the server (or both) on Windows 2012?
The server is on Win 2012. It works OK when both the browser and server are the same 2012 VM. I don't know if it works when both client and server are both Win 2012 but different machines. I will be able to check that soon. It does not work with different client OS version and box than the server, but that may simply be coincidence.
> Try using a protocol sniffer to see if the browser is sending a session id to the server, and if the server is responding with a session id either before or after login.
Wow, that sounds intimidating - never done that before. :-)
--
Cris Berneburg, Lead Software Engineer
CACI, IRMA Project, 703-679-5313
-----Original Message-----
From: Christopher Schultz [mailto:chris@christopherschultz.net]
Sent: Thursday, December 11, 2014 1:35 PM
To: Tomcat Users List
Subject: Re: tomcat on windows 2012 weirdness
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cris,
On 12/11/14 12:41 PM, Christopher Schultz wrote:
> Cris,
>
> On 12/11/14 11:28 AM, Cris Berneburg - US wrote:
>> I'm having trouble with my JSP web app using Tomcat 6 and 7 on
>> Windows Server 2012.
>
>> The issue is that no matter what file I request in the browser URL,
>> it always returns the app welcome file, that is, the login page. Even
>> when requesting an image. The one exception is that after logging
>> in, the main menu page appears, but none of the graphics or CSS files
>> load. Clicking on the app links, it just brings up the welcome page
>> again. Checking the Tomcat log files, I see that Tomcat is returning
>> the welcome page instead of the files requested in the main menu
>> page.
>
>> Using the Tomcat manager, I see that my application has a ridiculous
>> number of sessions, instead of just one. I interpret that for every
>> single file requested, a new Tomcat session is being generated and
>> possibly invalidated.
>
>> FYI, using the same setup on Windows Server 2003 and 2008 works fine.
>> Opening the same firewall ports on all three OS's has been done. Even
>> disabling the firewall on 2012 does not affect the issue in any way.
>> And to make things even weirder, accessing the application from a
>> browser on the server itself using localhost works fine!
>
>> I wonder if there is some mystery setting somewhere that is crippling
>> the app. Got any suggestions? Please help. Thanks!
>
> Check two quick things:
>
> 1. Do you have any security-constraints in WEB-INF/web.xml? If so, do
> they all make sense, and can users actually access those resources
> once logged-in (or at all)?
>
> 2. Do you have any servlets in WEB-INF/web.xml mapped to "/" other
> than the DefaultServlet (which should be configured by default so you
> shouldn't have to configure it yourself)?
After re-reading your post, it's pretty clear that my initial questions will be worthless and not help you.
Is it possible that you are not using URL-based session ids, and that your browser has cookies disabled via a policy? Is the browser or the server (or both) on Windows 2012?
Try using a protocol sniffer to see if the browser is sending a session id to the server, and if the server is responding with a session id either before or after login.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUiePTAAoJEBzwKT+lPKRYORoP/iCMTFyLmWf6SCBbQX4HH7A+
zGFqVw95Iaf2Kd2xwMqy6xA8SLpVhtr/TezyJQQHTCg3pMgx9NS9kFZPV4QACEVF
iM6QGk0xnzEo5v4SBTgj9dp/aIF3eYQV0P6kkLGlEm7Zgno/nIHHRL3hYQAj+Lj9
f7czP1nEx2+OyoVtVedV1LxyvuohtUJto5/c1cslwl3+GhCYNqqAcFchdRjDp/KI
qt9IWvkC3OfS+asTfxJ23BITAHXnTDOemeIYZ9yRolVfbYzI8+JtNMDjMB69hQgS
yy45//MI38p50dW2+qxNk41R113I3rL7fvAV7lKJh6Eaxr/R0oxUgEj1cSv34s5X
x30feYSxmpVBveCgb4pmiGoZ/DmEhb53qHDs5EbPE3LkjkN9nAN1A9mGscwMETBC
SqF1ECgJz8H95hOOf/g45CZSyB+5fQ1VHoTGQQya6WBVYrvfl+tRxCMw2bP2/I2L
2Owl4IYOGZxqjkMHzX5ubRYqE2TLXo3pgTNKYRaR6fJhlR04gAZqdnAXCES67VD0
WSFqSQcMZYuzZvCAJ87YOiCLbvF48uV2BEOUTmxp92f1i1o3qoAqrmOZVtP1d+Gu
rxXHYjd0sw0jV27VWpoWc0KVsLP/ZXxKrjU2h8OE0vr5MHeZkPyj6YKs9BISV8An
30qBjkuotwNX319XEmtz
=zyqf
-----END PGP SIGNATURE-----
Re: tomcat on windows 2012 weirdness
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cris,
On 12/11/14 12:41 PM, Christopher Schultz wrote:
> Cris,
>
> On 12/11/14 11:28 AM, Cris Berneburg - US wrote:
>> I'm having trouble with my JSP web app using Tomcat 6 and 7 on
>> Windows Server 2012.
>
>> The issue is that no matter what file I request in the browser
>> URL, it always returns the app welcome file, that is, the login
>> page. Even when requesting an image. The one exception is that
>> after logging in, the main menu page appears, but none of the
>> graphics or CSS files load. Clicking on the app links, it just
>> brings up the welcome page again. Checking the Tomcat log files,
>> I see that Tomcat is returning the welcome page instead of the
>> files requested in the main menu page.
>
>> Using the Tomcat manager, I see that my application has a
>> ridiculous number of sessions, instead of just one. I interpret
>> that for every single file requested, a new Tomcat session is
>> being generated and possibly invalidated.
>
>> FYI, using the same setup on Windows Server 2003 and 2008 works
>> fine. Opening the same firewall ports on all three OS's has been
>> done. Even disabling the firewall on 2012 does not affect the
>> issue in any way. And to make things even weirder, accessing
>> the application from a browser on the server itself using
>> localhost works fine!
>
>> I wonder if there is some mystery setting somewhere that is
>> crippling the app. Got any suggestions? Please help. Thanks!
>
> Check two quick things:
>
> 1. Do you have any security-constraints in WEB-INF/web.xml? If so,
> do they all make sense, and can users actually access those
> resources once logged-in (or at all)?
>
> 2. Do you have any servlets in WEB-INF/web.xml mapped to "/" other
> than the DefaultServlet (which should be configured by default so
> you shouldn't have to configure it yourself)?
After re-reading your post, it's pretty clear that my initial
questions will be worthless and not help you.
Is it possible that you are not using URL-based session ids, and that
your browser has cookies disabled via a policy? Is the browser or the
server (or both) on Windows 2012?
Try using a protocol sniffer to see if the browser is sending a
session id to the server, and if the server is responding with a
session id either before or after login.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUiePTAAoJEBzwKT+lPKRYORoP/iCMTFyLmWf6SCBbQX4HH7A+
zGFqVw95Iaf2Kd2xwMqy6xA8SLpVhtr/TezyJQQHTCg3pMgx9NS9kFZPV4QACEVF
iM6QGk0xnzEo5v4SBTgj9dp/aIF3eYQV0P6kkLGlEm7Zgno/nIHHRL3hYQAj+Lj9
f7czP1nEx2+OyoVtVedV1LxyvuohtUJto5/c1cslwl3+GhCYNqqAcFchdRjDp/KI
qt9IWvkC3OfS+asTfxJ23BITAHXnTDOemeIYZ9yRolVfbYzI8+JtNMDjMB69hQgS
yy45//MI38p50dW2+qxNk41R113I3rL7fvAV7lKJh6Eaxr/R0oxUgEj1cSv34s5X
x30feYSxmpVBveCgb4pmiGoZ/DmEhb53qHDs5EbPE3LkjkN9nAN1A9mGscwMETBC
SqF1ECgJz8H95hOOf/g45CZSyB+5fQ1VHoTGQQya6WBVYrvfl+tRxCMw2bP2/I2L
2Owl4IYOGZxqjkMHzX5ubRYqE2TLXo3pgTNKYRaR6fJhlR04gAZqdnAXCES67VD0
WSFqSQcMZYuzZvCAJ87YOiCLbvF48uV2BEOUTmxp92f1i1o3qoAqrmOZVtP1d+Gu
rxXHYjd0sw0jV27VWpoWc0KVsLP/ZXxKrjU2h8OE0vr5MHeZkPyj6YKs9BISV8An
30qBjkuotwNX319XEmtz
=zyqf
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: tomcat on windows 2012 weirdness
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Cris,
On 12/11/14 11:28 AM, Cris Berneburg - US wrote:
> I'm having trouble with my JSP web app using Tomcat 6 and 7 on
> Windows Server 2012.
>
> The issue is that no matter what file I request in the browser
> URL, it always returns the app welcome file, that is, the login
> page. Even when requesting an image. The one exception is that
> after logging in, the main menu page appears, but none of the
> graphics or CSS files load. Clicking on the app links, it just
> brings up the welcome page again. Checking the Tomcat log files, I
> see that Tomcat is returning the welcome page instead of the files
> requested in the main menu page.
>
> Using the Tomcat manager, I see that my application has a
> ridiculous number of sessions, instead of just one. I interpret
> that for every single file requested, a new Tomcat session is being
> generated and possibly invalidated.
>
> FYI, using the same setup on Windows Server 2003 and 2008 works
> fine. Opening the same firewall ports on all three OS's has been
> done. Even disabling the firewall on 2012 does not affect the issue
> in any way. And to make things even weirder, accessing the
> application from a browser on the server itself using localhost
> works fine!
>
> I wonder if there is some mystery setting somewhere that is
> crippling the app. Got any suggestions? Please help. Thanks!
Check two quick things:
1. Do you have any security-constraints in WEB-INF/web.xml? If so, do
they all make sense, and can users actually access those resources
once logged-in (or at all)?
2. Do you have any servlets in WEB-INF/web.xml mapped to "/" other
than the DefaultServlet (which should be configured by default so you
shouldn't have to configure it yourself)?
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUiddDAAoJEBzwKT+lPKRYgh0P/AqSe8MtqnoAiihz72ie2bCi
TrONeyCbE72u4c7GLjJNdW7FcWuXVJxydgg5g1FSajSOpumrDGherpodijMAuUEg
kspX4KqrN2AVS2O5bEo8UVWHSuqxC/AkXHikbNPdrGF+FKolDMxkqRH1OVXUsBWu
K0cmQp1+hl4TiB55f/voewQEaRqk6NwuA7oKW3hAPr2fc25fWpZyJpdHbR4zqzbT
/gzxPX6pM2+38wZh6E4MTXuPU1dnwiYwA6LGxQ8jtwyBc5dEiXBo0ve12cGPnBqC
+FyzC2PDqACRe8tY2VCIONj0njPehYtzanlGHejTRPVNHef/LMN8L5TP4Dd3WFOL
2CI9CQqPokVRh5c2mUm75UtC4WOkRDxf2XQw94c/O5/royMqp21EPom8I28ndDeJ
WcvQ9mXarTxoFb+tNodjkLOy9iOsLAtBEvLiAAVXwUZ4fS/J68pyzaaZ6paXpJIU
eteHGK1YbIPgKG2brTFP3fsh3iqZDjvSFL8IVuraPeRMQE0zIhxsEmaH2PNR9/VN
LDcizNp/OxINh7SWO7g7+lVd4vFVSHLnbRMH6L8NnG+ixohRq4rj4UU1CejutHya
3HKGUgDKAs0LK1NhfJ+YJ89nB9VfZmNpdsbwE88W6rpCnkIQw4pTHHD0fzst/Co+
C2NOUYohaAmqFw8sDhWf
=cy0i
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Jeffrey Janner <Je...@PolyDyne.com>.
> -----Original Message-----
> From: Christopher Schultz [mailto:chris@christopherschultz.net]
> Sent: Thursday, December 11, 2014 3:10 PM
> To: Tomcat Users List
> Subject: Re: tomcat on windows 2012 weirdness
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Jeffrey,
>
> On 12/11/14 4:00 PM, Jeffrey Janner wrote:
> > I noticed the ridiculous number of session issue on one of my
> > servers, but it wasn't Windows 2012, but 2008 R2. Don't think the
> > windows version has anything to do with it, but something about the
> > Tomcat version. Looking at the manager, I had a couple hundred
> > really old sessions, several hours expired, that were still showing
> > up in the list. When I click on the "expire" button, they all went
> > away. Noticed this when I was starting the upgrade to the latest
> > Tomcat 7 release, and haven't checked back to see if it is still an
> > issue since the upgrade. If I get a little time later today, I'll
> > recheck.
>
> I think this can happen if Tomcat's background processing thread dies.
> That can happen for a few reasons, including a transient OOME where
> the GC can catch-up once the offending thread (e.g.
> BackgroundProcessor) dies and releases its local references.
>
> Once that happens, sessions will never automatically die.
>
> I can't remember if clicking "expire sessions (now)" just wakes up the
> background thread (which would do nothing, of course), or if it
> synchronously does a cleanup (which would fix the issue, but only
> temporarily).
>
> - -chris
Thanks. I'll keep an eye out for it.
We had upgraded our app at the same time as moving to Tomcat 7.0.55 (or 56) and I noticed it when upgrading to 57 to get the latest security fixes.
Jeff
Re: tomcat on windows 2012 weirdness
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Jeffrey,
On 12/11/14 4:00 PM, Jeffrey Janner wrote:
> I noticed the ridiculous number of session issue on one of my
> servers, but it wasn't Windows 2012, but 2008 R2. Don't think the
> windows version has anything to do with it, but something about the
> Tomcat version. Looking at the manager, I had a couple hundred
> really old sessions, several hours expired, that were still showing
> up in the list. When I click on the "expire" button, they all went
> away. Noticed this when I was starting the upgrade to the latest
> Tomcat 7 release, and haven't checked back to see if it is still an
> issue since the upgrade. If I get a little time later today, I'll
> recheck.
I think this can happen if Tomcat's background processing thread dies.
That can happen for a few reasons, including a transient OOME where
the GC can catch-up once the offending thread (e.g.
BackgroundProcessor) dies and releases its local references.
Once that happens, sessions will never automatically die.
I can't remember if clicking "expire sessions (now)" just wakes up the
background thread (which would do nothing, of course), or if it
synchronously does a cleanup (which would fix the issue, but only
temporarily).
- -chris
>> -----Original Message----- From: Cris Berneburg - US
>> [mailto:cberneburg@caci.com] Sent: Thursday, December 11, 2014
>> 10:28 AM To: users@tomcat.apache.org Subject: tomcat on windows
>> 2012 weirdness
>>
>> Hi Folks
>>
>> I'm having trouble with my JSP web app using Tomcat 6 and 7 on
>> Windows Server 2012.
>>
>> The issue is that no matter what file I request in the browser
>> URL, it always returns the app welcome file, that is, the login
>> page. Even when requesting an image. The one exception is that
>> after logging in, the main menu page appears, but none of the
>> graphics or CSS files load. Clicking on the app links, it just
>> brings up the welcome page again. Checking the Tomcat log files,
>> I see that Tomcat is returning the welcome page instead of the
>> files requested in the main menu page.
>>
>> Using the Tomcat manager, I see that my application has a
>> ridiculous number of sessions, instead of just one. I interpret
>> that for every single file requested, a new Tomcat session is
>> being generated and possibly invalidated.
>>
>> FYI, using the same setup on Windows Server 2003 and 2008 works
>> fine. Opening the same firewall ports on all three OS's has been
>> done. Even disabling the firewall on 2012 does not affect the
>> issue in any way. And to make things even weirder, accessing the
>> application from a browser on the server itself using localhost
>> works fine!
>>
>> I wonder if there is some mystery setting somewhere that is
>> crippling the app. Got any suggestions? Please help. Thanks!
>>
>> -- Cris Berneburg, Lead Software Engineer CACI, IRMA Project,
>> 703-679-5313
>>
>>
>>
>> ---------------------------------------------------------------------
>>
>>
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
>
>
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
Comment: GPGTools - http://gpgtools.org
iQIcBAEBCAAGBQJUiggpAAoJEBzwKT+lPKRY1o0P/RasZl5zmrF2XEZZlA962zoW
JXDkZiV/GLXr3+EXy3hJjSLDrrGdil5i4msWgviGpO4nqh3a3svv3u4FAPcqz2xx
QVHK3RBC4ZWmo+BZTt+IZKSItG8YwPtekJiZHS2MRyuCKildUyEeTDHMMSs1Nwpi
J54hoyYEvNmG1rQmgH8XPfiu9dodiVD4eIhFSDI4Q65YwyfrfLhbF0vOxBOg3EdC
WYy+rANckEg3XRjNYLBOxN3ffO7bzQ/kBmPzHMFQPRCJmKoYxDN5zazeYpOHMN83
4pAObmADCYkEl4MD0GRJRQVu4OtfMRMNbcYMVNEKK3fM8twjPszJuFmK2FZRkdL+
zjuGuWSHdipZxLmx6ww09butoFdkfr2w7l6X6qi1PgYTlvrc7BbP6n9DWKwlj+mH
8AZm6OdychHSGhfL7FPCgU6+Bc+RNy3lKN3BnGVJlTtW9zHSYdHlHLH1a0GgJtrP
Szl9hZDl602ClzZ8tHXzL5G4GGWb47T+gVx/8FqFU6aTUzdrEIogxvF298SBKzvE
wH8wvz/YzJz1pcBA5B2xOPYIgRWPbUCyj9yqEwtqRVNwPGLpGSA4SHEP6T37Zec4
q60Dvvsfz09EYbrgpFoykxDLjRAVFBhd2h2rZS7/YYw+e4SA6WwAxLsaRZ/9Z2Tf
KX9GEXWUoWBbI4xKB3kx
=o+lP
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Jeffrey Janner <Je...@PolyDyne.com>.
I noticed the ridiculous number of session issue on one of my servers, but it wasn't Windows 2012, but 2008 R2. Don't think the windows version has anything to do with it, but something about the Tomcat version.
Looking at the manager, I had a couple hundred really old sessions, several hours expired, that were still showing up in the list. When I click on the "expire" button, they all went away.
Noticed this when I was starting the upgrade to the latest Tomcat 7 release, and haven't checked back to see if it is still an issue since the upgrade. If I get a little time later today, I'll recheck.
Jeff
> -----Original Message-----
> From: Cris Berneburg - US [mailto:cberneburg@caci.com]
> Sent: Thursday, December 11, 2014 10:28 AM
> To: users@tomcat.apache.org
> Subject: tomcat on windows 2012 weirdness
>
> Hi Folks
>
> I'm having trouble with my JSP web app using Tomcat 6 and 7 on Windows
> Server 2012.
>
> The issue is that no matter what file I request in the browser URL, it
> always returns the app welcome file, that is, the login page. Even when
> requesting an image. The one exception is that after logging in, the
> main menu page appears, but none of the graphics or CSS files load.
> Clicking on the app links, it just brings up the welcome page again.
> Checking the Tomcat log files, I see that Tomcat is returning the
> welcome page instead of the files requested in the main menu page.
>
> Using the Tomcat manager, I see that my application has a ridiculous
> number of sessions, instead of just one. I interpret that for every
> single file requested, a new Tomcat session is being generated and
> possibly invalidated.
>
> FYI, using the same setup on Windows Server 2003 and 2008 works fine.
> Opening the same firewall ports on all three OS's has been done. Even
> disabling the firewall on 2012 does not affect the issue in any way.
> And to make things even weirder, accessing the application from a
> browser on the server itself using localhost works fine!
>
> I wonder if there is some mystery setting somewhere that is crippling
> the app. Got any suggestions? Please help. Thanks!
>
> --
> Cris Berneburg, Lead Software Engineer
> CACI, IRMA Project, 703-679-5313
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: tomcat on windows 2012 weirdness
Posted by Cris Berneburg - US <cb...@caci.com>.
Andre
Thanks for taking the time to respond to my plea. :-)
> the way you describe it sounds like an authentication problem, where a bunch of near simultaneous requests to the server (for embedded images, css, etc.) all hit some "not yet authenticated" condition, and all together (or rather each separately) return a 401 or similar (or a login page instead of a requested image e.g.). Maybe there is something new in that respect with Windows Server 2012, which your application's authentication framework does not handle well ?
My problem is that I don't know what changed in Win 2012 that would cause Tomcat to behave differently. Perhaps it's a default security setting that changed? FYI, I can request image files from the 2008 server w/o being logged in and they display just fine.
Below is a sample from my localhost_access_log. Notice that all the files, except for the favicon which we don't have, all return a status of 200 and size 3715 - the welcome file - no matter what was requested. 200 means OK, right?
10.25.20.35 - - [03/Dec/2014:11:50:04 -0500] "GET /app/ HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:50:05 -0500] "GET /app/include/styles.css HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:50:05 -0500] "GET /app/css/GridStyle.css HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:50:05 -0500] "GET /app/images/back2.gif HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:50:06 -0500] "GET /images/favicon.ico HTTP/1.1" 404 987
10.25.20.35 - - [03/Dec/2014:11:51:27 -0500] "POST /app/Login HTTP/1.1" 200 5526
10.25.20.35 - - [03/Dec/2014:11:51:27 -0500] "GET /app/include/styles.css HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:51:27 -0500] "GET /app/images/back2.gif HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:51:27 -0500] "GET /app/css/GridStyle.css HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:51:27 -0500] "GET /app/images/f15.jpg HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:51:28 -0500] "GET /app/images/tab-off.gif HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:51:28 -0500] "GET /images/favicon.ico HTTP/1.1" 404 987
10.25.20.35 - - [03/Dec/2014:11:59:08 -0500] "GET /app/main/main.jsp HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:59:08 -0500] "GET /app/include/styles.css HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:59:08 -0500] "GET /app/images/back2.gif HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:59:08 -0500] "GET /app/css/GridStyle.css HTTP/1.1" 200 3715
10.25.20.35 - - [03/Dec/2014:11:59:08 -0500] "GET /app/images/favicon.ico HTTP/1.1" 200 3715
> (or the structure of your application).
> (e.g. the login page itself contains references to images and css which themselves are in a protected area and so on).
Eh, the login page itself is really plain - no images in it. Just the pages afterwards once you log in.
--
Cris Berneburg, Lead Software Engineer
CACI, IRMA Project, 703-679-5313
-----Original Message-----
From: André Warnier [mailto:aw@ice-sa.com]
Sent: Thursday, December 11, 2014 1:22 PM
To: Tomcat Users List
Subject: Re: tomcat on windows 2012 weirdness
Cris Berneburg - US wrote:
> Hi Folks
>
> I'm having trouble with my JSP web app using Tomcat 6 and 7 on Windows Server 2012.
>
> The issue is that no matter what file I request in the browser URL, it always returns the app welcome file, that is, the login page. Even when requesting an image. The one exception is that after logging in, the main menu page appears, but none of the graphics or CSS files load. Clicking on the app links, it just brings up the welcome page again. Checking the Tomcat log files, I see that Tomcat is returning the welcome page instead of the files requested in the main menu page.
>
> Using the Tomcat manager, I see that my application has a ridiculous number of sessions, instead of just one. I interpret that for every single file requested, a new Tomcat session is being generated and possibly invalidated..
>
> FYI, using the same setup on Windows Server 2003 and 2008 works fine. Opening the same firewall ports on all three OS's has been done. Even disabling the firewall on 2012 does not affect the issue in any way. And to make things even weirder, accessing the application from a browser on the server itself using localhost works fine!
>
> I wonder if there is some mystery setting somewhere that is crippling the app. Got any suggestions? Please help. Thanks!
>
Without realling getting to the bottom of it, the way you describe it sounds like an authentication problem, where a bunch of near simultaneous requests to the server (for embedded images, css, etc.) all hit some "not yet authenticated" condition, and all together (or rather each separately) return a 401 or similar (or a login page instead of a requested image e.g.).
Maybe there is something new in that respect with Windows Server 2012, which your application's authentication framework does not handle well ?
(or the structure of your application).
(e.g. the login page itself contains references to images and css which themselves are in a protected area and so on).
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: tomcat on windows 2012 weirdness
Posted by André Warnier <aw...@ice-sa.com>.
Cris Berneburg - US wrote:
> Hi Folks
>
> I'm having trouble with my JSP web app using Tomcat 6 and 7 on Windows Server 2012.
>
> The issue is that no matter what file I request in the browser URL, it always returns the app welcome file, that is, the login page. Even when requesting an image. The one exception is that after logging in, the main menu page appears, but none of the graphics or CSS files load. Clicking on the app links, it just brings up the welcome page again. Checking the Tomcat log files, I see that Tomcat is returning the welcome page instead of the files requested in the main menu page.
>
> Using the Tomcat manager, I see that my application has a ridiculous number of sessions, instead of just one. I interpret that for every single file requested, a new Tomcat session is being generated and possibly invalidated..
>
> FYI, using the same setup on Windows Server 2003 and 2008 works fine. Opening the same firewall ports on all three OS's has been done. Even disabling the firewall on 2012 does not affect the issue in any way. And to make things even weirder, accessing the application from a browser on the server itself using localhost works fine!
>
> I wonder if there is some mystery setting somewhere that is crippling the app. Got any suggestions? Please help. Thanks!
>
Without realling getting to the bottom of it, the way you describe it sounds like an
authentication problem, where a bunch of near simultaneous requests to the server (for
embedded images, css, etc.) all hit some "not yet authenticated" condition, and all
together (or rather each separately) return a 401 or similar (or a login page instead of a
requested image e.g.).
Maybe there is something new in that respect with Windows Server 2012, which your
application's authentication framework does not handle well ?
(or the structure of your application).
(e.g. the login page itself contains references to images and css which themselves are in
a protected area and so on).
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org