More on redirection problems

[Nacho <na...@siapi.es>]

Hola a todos:

After some more research in the issues related to NATs and tomcat
standalone, and more reading, i think i have found a real and common
problem in tomcat 3.X, that it's not present in Tomcat 4.0 ( this is
from a brief reading of the code ).

The problem, i think i'd found, is that when tomcat does a redirection
do not use the "host" header received, he tries to recontruct host+port
info based on his own port and the name (or ip ) found  in the Host
header of the request, that IMHO is bad because the real uri (host+port)
is dictated by the Host header..

But in addition i'd found that the relevant RFC for tomcat3 ( that is a
HTTP 1.0 server AFAIK ) dont say anything about Host headers or
something similar at all.

I have prepared a simple patch for tomcat 3.2 and 3.x about this.

Any comments?

Saludos ,
Ignacio J. Ortega

Re: More on redirection problems

["Craig R. McClanahan" <Cr...@eng.sun.com>]

Nacho wrote:

> Hola a todos:
>
> After some more research in the issues related to NATs and tomcat
> standalone, and more reading, i think i have found a real and common
> problem in tomcat 3.X, that it's not present in Tomcat 4.0 ( this is
> from a brief reading of the code ).
>
> The problem, i think i'd found, is that when tomcat does a redirection
> do not use the "host" header received, he tries to recontruct host+port
> info based on his own port and the name (or ip ) found  in the Host
> header of the request, that IMHO is bad because the real uri (host+port)
> is dictated by the Host header..
>
> But in addition i'd found that the relevant RFC for tomcat3 ( that is a
> HTTP 1.0 server AFAIK ) dont say anything about Host headers or
> something similar at all.
>
> I have prepared a simple patch for tomcat 3.2 and 3.x about this.
>

What Tomcat 4.0 does is sets the value that is returned by
request.getServerName() -- and this is the value used to construct
absolute
URLs on a redirect -- from the value of the "Host" header.  If your
patch
does this to Tomcat 3.2, I'm +1 for it.

>
> Any comments?
>
> Saludos ,
> Ignacio J. Ortega
>

Craig


>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org

RE: More on redirection problems

[Ren� Salle <re...@wanadoo.fr>]

> The problem, i think i'd found, is that when tomcat does a redirection
> do not use the "host" header received, he tries to recontruct host+port
> info based on his own port and the name (or ip ) found  in the Host
> header of the request

Sorry that I didn't got any time to further investigate this issue.

I didn't understood what exact distinction you make here. But I think that
the correct behavior is for Tomcat to use the host name specified by the
user agent in its request headers whenever they are there.

> But in addition i'd found that the relevant RFC for tomcat3 ( that is a
> HTTP 1.0 server AFAIK ) dont say anything about Host headers or
> something similar at all.

T32 does support HTTP/1.1 host name based virtual hosting... (RFC2616 /
19.6.1.1)

I've lost one of your previous mail within which there was a Tomcat response
header broken on two lines, anything more about this?