You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Bernhard Wraase <bw...@netkosmos.de> on 2004/02/26 10:21:06 UTC
bug in redirect to https
Hi,
I found a bug in tomcat 5. I can reproduce it with tomcat 5.016, 5.018
and 5.019. Other versions of tomcat 5 I didn't test.
Here is my testcase:
create a folder under <tomcat5>/webapps (ie. sec-test)
put a zip-file and/or a pdf-file in it (ie. a.pdf, b.zip)
configure https with certificate and port in server.xml
configure the redirect from http to https in server.xml
configure the webapp
start tomcat 5
start IE 5.5 or 6.0
try https://<servername>/sec-test/a.pdf
try https://<servername>/sec-test/b.zip
both works correctly
Now the buggy behavior:
add a web.xml with following part:
<security-constraint>
<web-resource-collection>
<web-resource-name>The Entire Web App</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
Now it is not anymore possible to open or store neither the pdf-file nor
the zip-file with same url from above.
"Internet Explorer cannot download a.pdf from localhost.
Internet Explorer was not able to open this Internet site. The
requested site is either unavailable or cannnot be found. Please try
again later."
"Internet Explorer cannot download b.zip from localhost.
Internet Explorer was not able to open this Internet site. The
requested site is either unavailable or cannnot be found. Please try
again later."
This happens only with IE 5.5 and 6.0, not with mozilla 1.6 or Opera
7.23(tested).
The same webapp works works correctly in tomcat 4.02, 4.04, 4.1.30(all
tested).
I tested on solaris(8), linux(SuSe 8.1) and W2000, the behavior is the
same, means the operating system does not matter.
Could this please anybody confirm?
If somebody has a smart workarround or bugfix for tomcat 5 I appreciate
it very much.
I try to understand the BaseAuthenticator(catalina.jar) since I thought
there would be the bug but I must confess that I failed:-(
--
Regards Bernhard Wraase
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: bug in redirect to https
Posted by Bernhard Wraase <bw...@netkosmos.de>.
> See http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27122.
This seems to me as a different bug.
Martin says that this problem is only on solaris present.
In my case these Url works with IE 5.5 and 6.0 correctly:
http://<servername>/sec-test/a.pdf
http://<servername>/sec-test/b.zip
https://<servername>/sec-test/a.pdf
https://<servername>/sec-test/b.zip
When I activate this in web.xml:
<security-constraint>
<web-resource-collection>
<web-resource-name>The Entire Web App</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
then the problem arise.
I started for every request the IE new.
When I remove this security constraint, the buggy behavior diappear.
Again, the same webapp runs with tomcat 4.02, 4.04, 4.1.30 and this
security constraint(redirect) without any problem.
The operating system that I tested was solaris, linuy and W2000.
They had no influence to the problem.
It seems to be the redirect from http to https which causes the issue.
--
Regards Bernhard Wraase
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: bug in redirect to https
Posted by Bill Barker <wb...@wilshire.com>.
See http://nagoya.apache.org/bugzilla/show_bug.cgi?id=27122.
"Bernhard Wraase" <bw...@netkosmos.de> wrote in message
news:403DBA82.4050807@netkosmos.de...
> Hi,
>
> I found a bug in tomcat 5. I can reproduce it with tomcat 5.016, 5.018
> and 5.019. Other versions of tomcat 5 I didn't test.
>
> Here is my testcase:
>
> create a folder under <tomcat5>/webapps (ie. sec-test)
> put a zip-file and/or a pdf-file in it (ie. a.pdf, b.zip)
> configure https with certificate and port in server.xml
> configure the redirect from http to https in server.xml
> configure the webapp
> start tomcat 5
>
> start IE 5.5 or 6.0
> try https://<servername>/sec-test/a.pdf
> try https://<servername>/sec-test/b.zip
>
> both works correctly
>
> Now the buggy behavior:
>
> add a web.xml with following part:
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>The Entire Web App</web-resource-name>
> <url-pattern>/*</url-pattern>
> </web-resource-collection>
> <user-data-constraint>
> <transport-guarantee>CONFIDENTIAL</transport-guarantee>
> </user-data-constraint>
> </security-constraint>
>
>
> Now it is not anymore possible to open or store neither the pdf-file nor
> the zip-file with same url from above.
>
> "Internet Explorer cannot download a.pdf from localhost.
> Internet Explorer was not able to open this Internet site. The
> requested site is either unavailable or cannnot be found. Please try
> again later."
>
> "Internet Explorer cannot download b.zip from localhost.
> Internet Explorer was not able to open this Internet site. The
> requested site is either unavailable or cannnot be found. Please try
> again later."
>
> This happens only with IE 5.5 and 6.0, not with mozilla 1.6 or Opera
> 7.23(tested).
> The same webapp works works correctly in tomcat 4.02, 4.04, 4.1.30(all
> tested).
> I tested on solaris(8), linux(SuSe 8.1) and W2000, the behavior is the
> same, means the operating system does not matter.
>
> Could this please anybody confirm?
>
> If somebody has a smart workarround or bugfix for tomcat 5 I appreciate
> it very much.
> I try to understand the BaseAuthenticator(catalina.jar) since I thought
> there would be the bug but I must confess that I failed:-(
>
> --
> Regards Bernhard Wraase
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: bug in redirect to https
Posted by Bernhard Wraase <bw...@netkosmos.de>.
Antonio Fiol Bonnín wrote:
> Could you please post your connector config?
Here it is:
<Connector port="80"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" redirectPort="443" acceptCount="100"
debug="0" connectionTimeout="20000"
disableUploadTimeout="true" />
<Connector port="443"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" debug="9" scheme="https" secure="true"
keystoreFile="E:\jakarta-tomcat-5.0.18\conf\keystore.ImportKey"
keystorePass="asdf"
clientAuth="false" sslProtocol="TLS" />
The filetypes *.gif, *.jpg, *.html are always displayed correctly from
IE 5.5 and 6.0, no matter which version of tomcat or operating system I
tested.
--
Regards Bernhard Wraase
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: bug in redirect to https
Posted by Antonio Fiol Bonnín <fi...@terra.es>.
Could you please post your connector config?
Bernhard Wraase wrote:
> Hi,
>
> I found a bug in tomcat 5. I can reproduce it with tomcat 5.016, 5.018
> and 5.019. Other versions of tomcat 5 I didn't test.
>
> Here is my testcase:
>
> create a folder under <tomcat5>/webapps (ie. sec-test)
> put a zip-file and/or a pdf-file in it (ie. a.pdf, b.zip)
> configure https with certificate and port in server.xml
> configure the redirect from http to https in server.xml
> configure the webapp
> start tomcat 5
>
> start IE 5.5 or 6.0
> try https://<servername>/sec-test/a.pdf
> try https://<servername>/sec-test/b.zip
>
> both works correctly
>
> Now the buggy behavior:
>
> add a web.xml with following part:
> <security-constraint>
> <web-resource-collection>
> <web-resource-name>The Entire Web App</web-resource-name>
> <url-pattern>/*</url-pattern>
> </web-resource-collection>
> <user-data-constraint>
> <transport-guarantee>CONFIDENTIAL</transport-guarantee>
> </user-data-constraint>
> </security-constraint>
>
>
> Now it is not anymore possible to open or store neither the pdf-file
> nor the zip-file with same url from above.
>
> "Internet Explorer cannot download a.pdf from localhost.
> Internet Explorer was not able to open this Internet site. The
> requested site is either unavailable or cannnot be found. Please try
> again later."
>
> "Internet Explorer cannot download b.zip from localhost.
> Internet Explorer was not able to open this Internet site. The
> requested site is either unavailable or cannnot be found. Please try
> again later."
>
> This happens only with IE 5.5 and 6.0, not with mozilla 1.6 or Opera
> 7.23(tested).
> The same webapp works works correctly in tomcat 4.02, 4.04, 4.1.30(all
> tested).
> I tested on solaris(8), linux(SuSe 8.1) and W2000, the behavior is the
> same, means the operating system does not matter.
>
> Could this please anybody confirm?
>
> If somebody has a smart workarround or bugfix for tomcat 5 I
> appreciate it very much.
> I try to understand the BaseAuthenticator(catalina.jar) since I
> thought there would be the bug but I must confess that I failed:-(
>