You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Christopher Schultz <ch...@christopherschultz.net> on 2022/08/24 18:15:25 UTC
Unexpected double-slash in javax.servlet.forward.request_uri
All,
I haven't tried narrowing this down very much yet, but I have a
situation where I'm using javax.servlet.forward.request_uri to build a
URI and the string I'm pulling from there starts with TWO / characters
instead of one.
This ends up breaking navigation because the browser interprets this as
a protocol-relative URI instead of a host-relative URI and Bar Things
happen.
Has anyone ever seen anything like this?
Tomcat 8.5.latest.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Unexpected double-slash in javax.servlet.forward.request_uri
Posted by Christopher Schultz <ch...@christopherschultz.net>.
All,
On 8/24/22 14:15, Christopher Schultz wrote:
> I haven't tried narrowing this down very much yet, but I have a
> situation where I'm using javax.servlet.forward.request_uri to build a
> URI and the string I'm pulling from there starts with TWO / characters
> instead of one.
>
> This ends up breaking navigation because the browser interprets this as
> a protocol-relative URI instead of a host-relative URI and Bar Things
> happen.
>
> Has anyone ever seen anything like this?
>
> Tomcat 8.5.latest.
I believe I have located the source of this. I'm using mod_proxy,
mod_proxy_http, and mod_proxy_balancer to front Tomcat with httpd. Here
was my balancer confioguration:
<Proxy "balancer://my-balancer">
BalancerMember http://localhost:8217/
ProxySet stickysession=JSESSIONID|jsessionid scolonpathdelim=On
</Proxy>
And here was an example ProxyPass directive that I tried with the
Examples web app in order to determine if my application was responsible
(it wasn't).
ProxyPass /examples/ balancer://my-balancer/examples/
That trivially reproduces the problem when visiting:
http://localhost/examples/servlets/servlet/RequestInfoExample
The problem is that my "balancer" configuration contains a trailing /
character, and should have been:
BalancerMember http://localhost:8217
(Note the missing trailing-slash.)
It's frustrating that it's so easy to make configuration errors like that.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: AW: Unexpected double-slash in javax.servlet.forward.request_uri
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Thomas,
On 8/25/22 11:20, Thomas Hoffmann (Speed4Trade GmbH) wrote:
> Hello Chris,
> I think I misread your message, sorry.
> So the request attribute javax.servlet.forward.request_uri contained a URL starting with // , right?
>
> Do you have the initial http request, how it looks like?
As I said, I haven't traced-through this the whole way. It's entirely
possible that some component in my own product is doing this.
I've never seen it when deployed into a real environment. This kind of
thing only happens when I'm using "localhost".
-chris
>> ________________________________
>> Von: Christopher Schultz <ch...@christopherschultz.net>
>> Gesendet: Mittwoch, 24. August 2022 20:15:25
>> An: Tomcat Users List
>> Betreff: Unexpected double-slash in javax.servlet.forward.request_uri
>>
>> All,
>>
>> I haven't tried narrowing this down very much yet, but I have a situation where
>> I'm using javax.servlet.forward.request_uri to build a URI and the string I'm
>> pulling from there starts with TWO / characters instead of one.
>>
>> This ends up breaking navigation because the browser interprets this as a
>> protocol-relative URI instead of a host-relative URI and Bar Things happen.
>>
>> Has anyone ever seen anything like this?
>>
>> Tomcat 8.5.latest.
>>
>> -chris
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>
>> -----Ursprüngliche Nachricht-----
>> Von: Thomas Hoffmann (Speed4Trade GmbH)
>> <Th...@speed4trade.com.INVALID>
>> Gesendet: Donnerstag, 25. August 2022 10:48
>> An: Tomcat Users List <us...@tomcat.apache.org>
>> Betreff: AW: Unexpected double-slash in javax.servlet.forward.request_uri
>>
>> Hello Chris,
>>
>> I think it matches the RFC7231
>> https://www.rfc-editor.org/rfc/rfc7231#section-7.1.2
>>
>> It allows relative URLs which refers to:
>> https://www.rfc-editor.org/rfc/rfc3986#section-4.2
>>
>> Which allows protocol relative paths:
>> relative-part = "//" authority path-abempty
>> / path-absolute
>> / path-noscheme
>> / path-empty
>>
>> Greetings, Thomas
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
AW: Unexpected double-slash in javax.servlet.forward.request_uri
Posted by "Thomas Hoffmann (Speed4Trade GmbH)" <Th...@speed4trade.com.INVALID>.
Hello Chris,
I think I misread your message, sorry.
So the request attribute javax.servlet.forward.request_uri contained a URL starting with // , right?
Do you have the initial http request, how it looks like?
Greetings, Thomas
> ________________________________
> Von: Christopher Schultz <ch...@christopherschultz.net>
> Gesendet: Mittwoch, 24. August 2022 20:15:25
> An: Tomcat Users List
> Betreff: Unexpected double-slash in javax.servlet.forward.request_uri
>
> All,
>
> I haven't tried narrowing this down very much yet, but I have a situation where
> I'm using javax.servlet.forward.request_uri to build a URI and the string I'm
> pulling from there starts with TWO / characters instead of one.
>
> This ends up breaking navigation because the browser interprets this as a
> protocol-relative URI instead of a host-relative URI and Bar Things happen.
>
> Has anyone ever seen anything like this?
>
> Tomcat 8.5.latest.
>
> -chris
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
> -----Ursprüngliche Nachricht-----
> Von: Thomas Hoffmann (Speed4Trade GmbH)
> <Th...@speed4trade.com.INVALID>
> Gesendet: Donnerstag, 25. August 2022 10:48
> An: Tomcat Users List <us...@tomcat.apache.org>
> Betreff: AW: Unexpected double-slash in javax.servlet.forward.request_uri
>
> Hello Chris,
>
> I think it matches the RFC7231
> https://www.rfc-editor.org/rfc/rfc7231#section-7.1.2
>
> It allows relative URLs which refers to:
> https://www.rfc-editor.org/rfc/rfc3986#section-4.2
>
> Which allows protocol relative paths:
> relative-part = "//" authority path-abempty
> / path-absolute
> / path-noscheme
> / path-empty
>
> Greetings, Thomas
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
AW: Unexpected double-slash in javax.servlet.forward.request_uri
Posted by "Thomas Hoffmann (Speed4Trade GmbH)" <Th...@speed4trade.com.INVALID>.
Hello Chris,
I think it matches the RFC7231
https://www.rfc-editor.org/rfc/rfc7231#section-7.1.2
It allows relative URLs which refers to:
https://www.rfc-editor.org/rfc/rfc3986#section-4.2
Which allows protocol relative paths:
relative-part = "//" authority path-abempty
/ path-absolute
/ path-noscheme
/ path-empty
Greetings, Thomas
________________________________
Von: Christopher Schultz <ch...@christopherschultz.net>
Gesendet: Mittwoch, 24. August 2022 20:15:25
An: Tomcat Users List
Betreff: Unexpected double-slash in javax.servlet.forward.request_uri
All,
I haven't tried narrowing this down very much yet, but I have a
situation where I'm using javax.servlet.forward.request_uri to build a
URI and the string I'm pulling from there starts with TWO / characters
instead of one.
This ends up breaking navigation because the browser interprets this as
a protocol-relative URI instead of a host-relative URI and Bar Things
happen.
Has anyone ever seen anything like this?
Tomcat 8.5.latest.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org