Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Reply-To: <naga.ramesh@manthan.com>
From: "Naga Ramesh" <naga.ramesh@manthan.com>
To: "'Tomcat Users List'" <users@tomcat.apache.org>
References: <004901d369a7$f8af76a0$ea0e63e0$@manthan.com> <3af1965e-bab8-7174-ccad-80bca9a27907@apache.org> <008e01d369b0$2496f5b0$6dc4e110$@manthan.com> <3de038e8-8903-8980-b6af-0ebd9a3b7c9c@olafkock.de>
In-Reply-To: <3de038e8-8903-8980-b6af-0ebd9a3b7c9c@olafkock.de>
Subject: RE: getting some cookie & security related issues.
Date: Thu, 30 Nov 2017 13:55:37 +0530
Message-ID: <00a401d369b4$ce43dca0$6acb95e0$@manthan.com>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
Thread-Index: AQGfxletQp40ShGDGuHcchmSBJ8tsAGNxKnfAUWvTSECsZqh/aNnsu9g
Content-Language: en-us
archived-at: Thu, 30 Nov 2017 08:25:48 -0000

Thanks Olaf..

There's one piece of information that looks suspicious to me: HTTPS from AWS
to Tomcat, port 8080. While it's possible that you're doing this,
8080 is typically used to handle http requests, while 8443 would be a
default choice in the 8000+ range of ports for handling https. Please
confirm or deny that you have reconfigured a secure connector to listen to
port 8080, otherwise it's not clear that you're indeed configuring the
communication from AWS to Tomcat as an encrypted one.


User-https request	--->	AWS-ELB-443 & here we have applied the SSL
&443 redirect to 8080 of tomcat(non SSL)


To preempt the next mail and give more information upfront: If you indeed
have tomcat listen on 8080 for http, it won't have a clue that this
connection is secure, because it doesn't know anything about the original
connection. You can fake the knowledge about the connection to be secure
with the connector attribute secure="true", but you'll have to make sure
that nobody can reach your tomcat through any other way than through your
load balancer when you do. Another option is to use AJP for the
communication between AWS and Tomcat (I don't know if this is supported on
the AWS-ELB side). While this protocol is unencrypted, it does forward the
http/https information from the original connection

I have tried this way (secure="true") also, but application is working fine
but we are unable to login the application & getting the oops session
expired error message, so I have reverted this parameter.


Regards,
Naga Ramesh R
1974
-----Original Message-----
From: Olaf Kock [mailto:tomcat@olafkock.de] 
Sent: Thursday, November 30, 2017 1:33 PM
To: users@tomcat.apache.org
Subject: Re: getting some cookie & security related issues.


On 30.11.2017 08:52, Naga Ramesh wrote:
> User --------> AWS --------> Tomcat
>        (HTTPS)        (HTTPS)
>
> User-HTTPS request----> AWS-ELB(https-443)  re-direct to tomcat 
> connector
> port-8080
>
> What is the (expected) path when the user makes an HTTPS request? Is it:
>
> User --------> AWS --------> Tomcat
>        (HTTPS)        (HTTPS)
There's one piece of information that looks suspicious to me: HTTPS from AWS
to Tomcat, port 8080. While it's possible that you're doing this,
8080 is typically used to handle http requests, while 8443 would be a
default choice in the 8000+ range of ports for handling https. Please
confirm or deny that you have reconfigured a secure connector to listen to
port 8080, otherwise it's not clear that you're indeed configuring the
communication from AWS to Tomcat as an encrypted one.

To preempt the next mail and give more information upfront: If you indeed
have tomcat listen on 8080 for http, it won't have a clue that this
connection is secure, because it doesn't know anything about the original
connection. You can fake the knowledge about the connection to be secure
with the connector attribute secure="true", but you'll have to make sure
that nobody can reach your tomcat through any other way than through your
load balancer when you do. Another option is to use AJP for the
communication between AWS and Tomcat (I don't know if this is supported on
the AWS-ELB side). While this protocol is unencrypted, it does forward the
http/https information from the original connection 
User->AWS

Please clarify your situation. Thanks,
Olaf

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org