[users@httpd] Only the first request = 'Invalid direct reference to form login page' but not the rest.

[Rob Stewart <ro...@googlemail.com>]

Hi.
 I've set up a pair of Apache Tomcat servers (6.0.16) (using
simpleTcpCluster for session replication) being reverse proxied by an
Apache HTTPD server (2.2.8) all on the same machine.

 I have a java servlet that requires authentication. The servlet when
accessed directly on either one of the Tomcats works fine - normal
operation being...

User goes to servlet URL.
Server redirects to login page.
User sends j_security parameters (Yes, this is FORM authentication).
If authenticates to valid user server redirects to originally requested URL.

 However, when I access the same servlet through the reverse proxy
after restarting the servers (this only happens with the VERY FIRST
request on the servers) I get this...

User goes to servlet URL.
Server redirects to login page.
User sends j_security parameters.
Server reports "Invalid direct reference to form login page".

 This error happens once then all works well even following the exact
same steps from another instance of the same browser (after closing
the browser to clear any session cookies). It happens even if you use
WGET to perform the same operations, so I believe this rules out
browser quirks too. It happens in IE and Firefox - all on only the
first request to the proxy.

 I've also discovered that if I perform the steps described above
direct to either of the Tomcat instances before going through the
proxy then the problem then does not occur at all. Which makes me
think it's a proxy/HTTPD problem.

 I've checked the Apache v2.2.9 changelog and I can't see anything
that may be relevant, if this is a bug. However, if anyone knows
different let me know.

 Any help much appreciated. Let me know if you need more details or if
I should be talking to the tomcat group.

-- 
Rob (rob.rstuff@googlemail.com)

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

[users@httpd] Re: Only the first request = 'Invalid direct reference to form login page' but not the rest.

[Rob Stewart <ro...@googlemail.com>]

Turns out my first request problem WAS a configuration issue. Here's
the details in case you see something similar...

When you have two tomcats and wish to cluster them with
simpleTCPCluster and AJP protocol via an Apache HTTPD reverse proxy...

  You MUST specify a 'jvmRoute' for each Tomcat in their 'server.xml'
files AND a 'route' in the proxy balancer...

server.xml
----
    <Engine name="Catalina"
            defaultHost="localhost"
            jvmRoute="tc1">
---

httpd.conf
----
  BalancerMember ajp://127.0.0.1:18009 route=tc1
----

  Otherwise the first (and only the first) request fails - the load
balancer sends the 2nd request to the wrong node.

  This is even if you are NOT using mod_jk as specified on the how-to docs...

http://tomcat.apache.org/tomcat-6.0-doc/cluster-howto.html

  In other words - the docs need updated. At least in my opinion.

  Oh and watch out! If you copy and paste the value from the xml to
the conf file be sure to remove the quotes - as the conf file will
take them as part of the route name and drive you INSANE whilst you
try to figure out what is wrong. ( route="tc1" will not match with
jvmRoute="tc1" ).

-- 
Rob (rob.rstuff@googlemail.com)

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org