You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Christopher Schultz <ch...@christopherschultz.net> on 2024/04/16 15:16:11 UTC
Unexpected behavior of filters
All,
I'm not sure if this is the first time I've tried something like this,
but I was surprised by the behavior I observed today when trying to
configure a new Filter.
I have an existing Filter that looks at Cookies provided in a request.
I wanted to add a new Filter that takes request parameters and returns
them from request.getCookies() but only for a small number of URL
patterns which we handle only internally, both for security (?) and also
for performance, since this isn't a really common thing for us to do.
So I have these two filters:
<filter>
<filter-name>cookieUserFilter</filter-name>
<filter-class>...</filter-class>
</filter>
<filter>
<filter-name>cookieParameterFilter</filter-name>
<filter-class>...</filter-class>
</filter>
<filter-mapping>
<filter-name>cookieParameterFilter</filter-name>
<url-pattern>*.xml.do</url-pattern>
<url-pattern>/some/specific/pattern</url-pattern>
<filter-pattern>
<filter-mapping>
<filter-name>cookieUserFilter</filter-name>
<url-pattern>*.do</url-pattern>
<url-pattern>*.jsp</url-pattern>
<filter-pattern>
I have tested that both Filters work as expected when called. However,
when I configure them as above and request /foo.xml.do, only the
cookieUserFilter is being called. The cookieParameterFilter is not being
called. I'm explicitly defining them in that order to ensure that the
cookieParameterFilter is called /first/ to ensure that the parameters
are converted into Cookies before the cookieUserFilter is called.
In order to get the cookieParameterFilter to be called, I have to
configure it like this in my filter-mapping:
<filter-mapping>
<filter-name>cookieParameterFilter</filter-name>
<url-pattern>*.do</url-pattern>
<url-pattern>*.xml.do</url-pattern><!-- this probably no longer
matters -->
<url-pattern>/some/specific/pattern</url-pattern>
<filter-pattern>
This means it will apply to all requests, which isn't what I want.
The only thing I can think of is that *.xml.do isn't mapped to any
specific servlet, while *.do /is/. Will <filter>s only apply to URL
patterns that are explicitly-mapped to a specific servlet?
That doesn't sound right to me. I have other mappings that only map to a
URL space and not anything that has a specific servlet mapping.
What am I missing?
This is Tomcat 9.0.85 and everything is defined in WEB-INF/web.xml.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Unexpected behavior of filters
Posted by Konstantin Kolinko <kn...@gmail.com>.
вт, 16 апр. 2024 г. в 22:42, Christopher Schultz <ch...@christopherschultz.net>:
>
> [...]
>
> 2. Abort this stupid idea and do something else
URLs that end with ".do" always remind me about this old page:
https://www.w3.org/Provider/Style/URI
Cool URIs don't change
(c)1998 Tim BL
Though you might have already seen it.
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Unexpected behavior of filters
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Konstantin,
On 4/16/24 13:16, Konstantin Kolinko wrote:
> вт, 16 апр. 2024 г. в 18:17, Christopher Schultz <ch...@christopherschultz.net>:
>>
>> All,
>>
>> I'm not sure if this is the first time I've tried something like this,
>> but I was surprised by the behavior I observed today when trying to
>> configure a new Filter.
>>
>> I have an existing Filter that looks at Cookies provided in a request.
>>
>> I wanted to add a new Filter that takes request parameters and returns
>> them from request.getCookies() but only for a small number of URL
>> patterns which we handle only internally, both for security (?) and also
>> for performance, since this isn't a really common thing for us to do.
>>
>> So I have these two filters:
>>
>> <filter>
>> <filter-name>cookieUserFilter</filter-name>
>> <filter-class>...</filter-class>
>> </filter>
>>
>> <filter>
>> <filter-name>cookieParameterFilter</filter-name>
>> <filter-class>...</filter-class>
>> </filter>
>>
>> <filter-mapping>
>> <filter-name>cookieParameterFilter</filter-name>
>> <url-pattern>*.xml.do</url-pattern>
>> <url-pattern>/some/specific/pattern</url-pattern>
>> <filter-pattern>
>>
>> <filter-mapping>
>> <filter-name>cookieUserFilter</filter-name>
>> <url-pattern>*.do</url-pattern>
>> <url-pattern>*.jsp</url-pattern>
>> <filter-pattern>
>>
>> I have tested that both Filters work as expected when called. However,
>> when I configure them as above and request /foo.xml.do, only the
>> cookieUserFilter is being called. The cookieParameterFilter is not being
>> called.
>> [...]
>>
>> What am I missing?
>>
>> This is Tomcat 9.0.85 and everything is defined in WEB-INF/web.xml.
>
> Hi, Chris!
>
> The Servlet 4.0 specification (the one that applies to Tomcat 9) says:
>
> 1) ch. 12.2 Specification of Mappings
>
> "A string beginning with a ‘ *. ’ prefix is used as an extension mapping."
>
> searching for "extension" finds:
> 2) ch 12.1 Use of URL Paths
>
> "3. If the last segment in the URL path contains an extension (e.g.
> .jsp), the servlet
> container will try to match a servlet that handles requests for the
> extension. An
> extension is defined as the part of the last segment after the last ’
> . ’ character."
>
> As it says "after the last '.' character" then by this design
> <url-pattern>*.xml.do</url-pattern> cannot match anything.
Aw. I suppose anything else would be terrible for performance.
So the problem is that I was specifying an "extension" mapping that is
not legal. I don't see anything in the log files, but this seems like a
good thing to log. I'll check to see if such a thing could be added.
I now have two options:
1. Specify every individual url-pattern that I want to support (which is
easy: there are a very small number of them)
2. Abort this stupid idea and do something else
I've already opted for #2 anyway because it's less-stupid than trying to
use request parameters as a proxy for cookies. It also solves like 2
other problems at the same time, so I like my other solution better.
> (You may look at how o.a.catalina.mapper.Mapper actually works.
>
> Look for extensionWrappers and method internalMapExtensionWrapper().)
Thanks for the pointer.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Unexpected behavior of filters
Posted by Konstantin Kolinko <kn...@gmail.com>.
вт, 16 апр. 2024 г. в 18:17, Christopher Schultz <ch...@christopherschultz.net>:
>
> All,
>
> I'm not sure if this is the first time I've tried something like this,
> but I was surprised by the behavior I observed today when trying to
> configure a new Filter.
>
> I have an existing Filter that looks at Cookies provided in a request.
>
> I wanted to add a new Filter that takes request parameters and returns
> them from request.getCookies() but only for a small number of URL
> patterns which we handle only internally, both for security (?) and also
> for performance, since this isn't a really common thing for us to do.
>
> So I have these two filters:
>
> <filter>
> <filter-name>cookieUserFilter</filter-name>
> <filter-class>...</filter-class>
> </filter>
>
> <filter>
> <filter-name>cookieParameterFilter</filter-name>
> <filter-class>...</filter-class>
> </filter>
>
> <filter-mapping>
> <filter-name>cookieParameterFilter</filter-name>
> <url-pattern>*.xml.do</url-pattern>
> <url-pattern>/some/specific/pattern</url-pattern>
> <filter-pattern>
>
> <filter-mapping>
> <filter-name>cookieUserFilter</filter-name>
> <url-pattern>*.do</url-pattern>
> <url-pattern>*.jsp</url-pattern>
> <filter-pattern>
>
> I have tested that both Filters work as expected when called. However,
> when I configure them as above and request /foo.xml.do, only the
> cookieUserFilter is being called. The cookieParameterFilter is not being
> called.
>[...]
>
> What am I missing?
>
> This is Tomcat 9.0.85 and everything is defined in WEB-INF/web.xml.
Hi, Chris!
The Servlet 4.0 specification (the one that applies to Tomcat 9) says:
1) ch. 12.2 Specification of Mappings
"A string beginning with a ‘ *. ’ prefix is used as an extension mapping."
searching for "extension" finds:
2) ch 12.1 Use of URL Paths
"3. If the last segment in the URL path contains an extension (e.g.
.jsp), the servlet
container will try to match a servlet that handles requests for the
extension. An
extension is defined as the part of the last segment after the last ’
. ’ character."
As it says "after the last '.' character" then by this design
<url-pattern>*.xml.do</url-pattern> cannot match anything.
(You may look at how o.a.catalina.mapper.Mapper actually works.
Look for extensionWrappers and method internalMapExtensionWrapper().)
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org