You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2019/10/15 13:16:03 UTC

[Bug 63851] New: Response's "Location" header must not disclose internal IPs

https://bz.apache.org/bugzilla/show_bug.cgi?id=63851

            Bug ID: 63851
           Summary: Response's "Location" header must not disclose
                    internal IPs
           Product: Tomcat 8
           Version: 8.5.14
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Connectors
          Assignee: dev@tomcat.apache.org
          Reporter: hauser@acm.org
  Target Milestone: ----

if you have an internal network and in server.xml

<Connector port ...
address="173.24.10.222"

when you send a redirect with a relative URL such as

  response.sendRedirect("/index.jsp");

the 
  "https://173.24.10.222:6443/index.jsp"
is given back in the Location header which is considered useful "discovery" for
unfriendly counterparts...

==> for these cases, maybe in 
 
https://tomcat.apache.org/tomcat-8.5-doc/config/http.html#Standard_Implementation
  it should be possible to add a

  "addressExternal" value ?

see also: bug 54367

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 63851] Response's "Location" header must not disclose internal IPs

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63851

Mark Thomas <ma...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEEDINFO                    |RESOLVED
         Resolution|---                         |INVALID

--- Comment #2 from Mark Thomas <ma...@apache.org> ---
Generally, I'd view fixing the Location header (and all the other headers that
reverse proxying tends to break) the responsibility of the reverse proxy.

That said, Tomcat already provides proxyPort and proxyName on the Connector for
this purpose.

Further assistance with using these attributes is available via the users
mailing list if required.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

[Bug 63851] Response's "Location" header must not disclose internal IPs

Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63851

Michael Osipov <mi...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |NEEDINFO

--- Comment #1 from Michael Osipov <mi...@apache.org> ---
Unless you haven't configured a host for this in Tomcat, the behavior seems
correct to me. I absolutely see no need for an "addressExternal" here. Either
you use Tomcat directly or via reverse proxy, but both require proper
configuration.

-- 
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org