You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2025/10/09 20:44:51 UTC
[Bug 69848] New: http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
Bug ID: 69848
Summary: http method DELETE is converted to OPTIONS when
request is sent through Apache proxy over AJP
Connector
Product: Tomcat 10
Version: 10.1.47
Hardware: Other
OS: Linux
Status: NEW
Severity: critical
Priority: P2
Component: Connectors
Assignee: dev@tomcat.apache.org
Reporter: ArifMohammed.Technical@gmail.com
Target Milestone: ------
Created attachment 40117
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40117&action=edit
Java Servlet with http methods
### Steps to Reproduce
1. Setup Apache as frontend to Tomcat. Both Apache and tomcat are on same
domain (example: localhost)
1.a) On Apache side enable JkMount/mod_jk module and add the following
directive in ssl.conf
JkMount /servlet/* worker1
1.b) update the worker.properties (worker1 config) to redirect the traffic
to Tomcat's AJP port(localhost:8888)
1.c) update the Apache ssl port to 9999
2. Compile and deploy the attached servlet code to Tomcat
2.a) Folder structure
servlet/
├── WEB-INF/
│ ├── web.xml
│ └── classes/
│ └── TestServlet.java
3. HTTP request sent.
curl -k -i -v -X DELETE "https://localhost:9999/servlet/test"
4. Observed behavior
- Servlet's doDelete method NOT called and hence did not received the
response text.
- However, I got the 200 response code with the following header
Allow: GET, HEAD, POST, DELETE, OPTIONS
- I see the following in Tomcat's access log for the URI recieved.
"OPTIONS /servlet/test HTTP/1.1"
- Note: Same setup works perfectly with http connector.
### Expected Behavior
- I am supposed to get the reponse text "DELETE received".
### Actual Behavior
- When Tomcat receives the request on AJP connector, it is somehow
converting the http method DELETE to OPTIONS and forwards the request to the
servlet.
- And then this request is being treated as preflight request.
### Additional Information
- Tomcat version: 10.1.47
- Java version: OpenJDK 17.0.16
- OS version: Suse Linux Enterprise Server - 6.4.0
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |bernhard.pfeiffer@brz.gv.at
--- Comment #6 from Mark Thomas <ma...@apache.org> ---
*** Bug 69849 has been marked as a duplicate of this bug. ***
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
--- Comment #3 from benjamin@jemlich.de ---
We're seeing the same issue and looking through the commit history the bug was
introduced in
https://github.com/apache/tomcat/commit/aa73a727aa0eeb355048a19527bb81be89910ff4
where one of entries in java/org/apache/coyote/ajp/Constants.java replaced
"DELETE" with Method.OPTIONS
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
benjamin@jemlich.de changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |benjamin@jemlich.de
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
--- Comment #8 from Mark Thomas <ma...@apache.org> ---
Given the number of reports we have received, it does look like a new set of
releases is required. If we start them today we could - potentially - have them
available for Monday.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
--- Comment #10 from Christopher Schultz <ch...@christopherschultz.net> ---
(In reply to Christopher Schultz from comment #2)
> I have the same setup
Apologies: I did *not* have the same setup :/
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |thomas.haarbach@isys.de
--- Comment #7 from Mark Thomas <ma...@apache.org> ---
*** Bug 69850 has been marked as a duplicate of this bug. ***
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |RESOLVED
Resolution|--- |FIXED
--- Comment #4 from Mark Thomas <ma...@apache.org> ---
Fixed in:
- 11.0.x for 11.0.13 onwards
- 10.1.x for 10.1.48 onwards
- 9.0.x for 9.0.111 onwards
Sorry. That was me. Not sure how that happened given that only some of the
changes were incorrect. I was using search and replace a method at a time so
I'd have expected all of them to wrong. I'll go and double check the commit log
in case there are other methods with the same problem.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
--- Comment #5 from Remy Maucherat <re...@apache.org> ---
Ok, I didn't realize where the regression is coming from. So I guess there are
no options other than proceed with new releases ?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
--- Comment #9 from Remy Maucherat <re...@apache.org> ---
(In reply to Mark Thomas from comment #8)
> Given the number of reports we have received, it does look like a new set of
> releases is required. If we start them today we could - potentially - have
> them available for Monday.
+1, let's do that.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
Christopher Schultz <ch...@christopherschultz.net> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #2 from Christopher Schultz <ch...@christopherschultz.net> ---
I have the same setup (minus the port 9999) on Debian Linux and the DELETE is
passed through to Tomcat without a problem.
You might need to provide more information.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
--- Comment #1 from Arif <Ar...@gmail.com> ---
Created attachment 40118
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40118&action=edit
web.xml
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69848] http method DELETE is converted to OPTIONS when request is sent through Apache proxy over AJP Connector
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69848
Arif <Ar...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |ArifMohammed.Technical@gmai
| |l.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org