Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
From: "Caldarale, Charles R" <Chuck.Caldarale@unisys.com>
To: Tomcat Users List <users@tomcat.apache.org>
Subject: RE: Tomcat 8.5.4 and LegacyCookieProcessor
Thread-Topic: Tomcat 8.5.4 and LegacyCookieProcessor
Thread-Index: AQHSz/uQv8efWuvcvU6hJpnxpQ/wCqH6WONA
Date: Thu, 18 May 2017 18:12:40 +0000
Message-ID: <CY1PR07MB255574E46C29212999277F9897E40@CY1PR07MB2555.namprd07.prod.outlook.com>
References: <CAJZHruMc27+tuwkR=fnOr9+WJGAOctKguiRjFfhGU5rfvFA7yA@mail.gmail.com>
In-Reply-To: <CAJZHruMc27+tuwkR=fnOr9+WJGAOctKguiRjFfhGU5rfvFA7yA@mail.gmail.com>
Accept-Language: en-US
Content-Language: en-US
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-originalarrivaltime: 18 May 2017 18:12:40.5260
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 8d894c2b-238f-490b-8dd1-d93898c5bf83
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY1PR07MB2556
archived-at: Thu, 18 May 2017 18:12:55 -0000

> From: jared.paul.walker@gmail.com [mailto:jared.paul.walker@gmail.com] On=
 Behalf Of Jared Walker
> Subject: Tomcat 8.5.4 and LegacyCookieProcessor

> We are migrating to the version of tomcat identified in the subject

Before exposing an almost year-old version to the nasty real world, you mig=
ht want to look at this:
        http://tomcat.apache.org/security-8.html
and then pick a newer level (hint: 8.5.15 would be good).

> 1. What are the security and compatibility concerns when using the
> legacy processor

Sorry, can't answer that one.

> 2. The header for LegacyCookieProcesor.java explicitly states: "This
> class is not thread-safe."

> Can someone here with background knowledge explain exactly whats not
> thread-safe about the processor?  Does this mean you cannot use it for
> multiple simultaneous requests (pretty hindering for a server) or does
> this mean that you cannot have multiple threads parse the cookie
> contents of a request in parallel (which isn't a very normal thing to
> do)?

It's neither, really; there is one instance of CookieProcessor per <Context=
>, and the fields within LegacyCookieProcessor that make it not thread-safe=
 are only set (in Tomcat) when the <Context> is initialized.  Were you to d=
ynamically reset the fields while requests were in progress, you could get =
in trouble.  The fields are described here:

http://tomcat.apache.org/tomcat-8.5-doc/config/cookie-processor.html

 - Chuck


THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MA=
TERIAL and is thus for use only by the intended recipient. If you received =
this in error, please contact the sender and delete the e-mail and its atta=
chments from all computers.


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org