We need to set tomcat 8 container character encoding of request and response to UTF-8 intead of ISO-8859-1 , What is the setting for the same
We tried setting as mentioned below ,
https://wiki.apache.org/tomcat/FAQ/CharacterEncoding#Q1
But that requires creating filter etc. Is there any elegant way where we can just change some configuration set to make it applicable at container level
Tomcat 8+ comes bundled with a filter to set the character encoding.
This is described in Tomcat 8 Container Provided Filters.
This filter needs to be configured in your web.xml file plus a few other changes as below.
The following configuration works for
Tomcat 8.0.30
jdk1.8.0_66
SQL Server 2008 R2
Microsoft JDBC driver (sqljdbc42.jar)
Character Encoding Filter
web.xml
<filter>
<filter-name>setCharacterEncodingFilter</filter-name>
<filter-class>org.apache.catalina.filters.SetCharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>setCharacterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
JSP Page Encoding
web.xml
<jsp-config>
<jsp-property-group>
<url-pattern>*.jsp</url-pattern>
<page-encoding>UTF-8</page-encoding>
</jsp-property-group>
</jsp-config>
JSP Page Creation
Only standard English characters should be used
ie no accented characters etc
Database Character Types
All character types for table columns should be Unicode types eg NCHAR, NVARCHAR & NTEXT.
Database Connection String
For a SQL Server 2008 R2 database with collation 'Latin1_General_CI_AS', it seems that the connection string does not need to be set to use UTF-8.
context.xml
<Resource name="jdbc/gtraxDS" auth="Container"
type="javax.sql.DataSource"
driverClassName="com.microsoft.sqlserver.jdbc.SQLServerDriver"
url="jdbc:sqlserver://ctceu-wgc-dv026:45666; databaseName=gtraxd2"
username="myAppUsername"
password="myAppPa55word"/>
Strict Servlet compliance
Do not set 'strict servlet compliance'.
From the Tomcat 8 Migration Guide
The default value of URIEncoding attribute for HTTP and AJP connectors has been changed from
"ISO-8859-1" to be "UTF-8" (if "strict servlet compliance" mode is off, which is the default)
File System Character Encoding
Iterating & displaying contents of:
System.getProperties();
gives:
...
file.encoding Cp1252
file.encoding.pkg sun.io
...
It seems that the file encoding does not need to be changed
Character encoding filter should be the first filter in the filter chain that accesses request parameters.
I had the same issue with HTML pages returned by the controllers. there was no problem while running in IntelliJ IDEA 2018 but after building the war file and deploying it in tomcat there was encoding problem with HTML pages which were in project static folder.
after a bit searching, I found this life-saving answer and I added the below tag in the web.xml file of tomcat in C:\apache-tomcat\conf directory and everything just worked like a charm.
<mime-mapping>
<extension>html</extension>
<mime-type>text/html;charset=UTF-8</mime-type>
</mime-mapping>
for me it was enough to setup tomcat's web.inf (/tomcat/8.0.33/conf/web.inf), specifically header.
instead of :
<?xml version="1.0" encoding="ISO-8859-1"?>
i'm using now :
<?xml version="1.0" encoding="UTF-8"?>
Related
Before anything else, I've already read all those solutions that says I put an error-page block in my application's or tomcat's conf/web.xml and add an error-code block inside with the corresponding location and those didn't work (did those for 404 errors and those worked).
What I already did inside my application's and tomcat's web.xml:
<error-page> <!-- this worked -->
<error-code>404</error-code>
<location>/pageNotFound.html</location>
</error-page>
<error-page> <!-- this did not work -->
<error-code>501</error-code>
<location>/pageNotFound.html</location>
</error-page>
I'm using Tomcat 8.5.63, and the goal is to remove the "Apache Tomcat/8.5.63" part on the response whenever a 501 error appears.
I want to remove this part:
tomcat error response page
The way I'm testing this is that I intercept a request using a pentest tool (I'm using burp suite community) and modify a request to include a Transfer-Encoding: cow header (yes I know that header is invalid).
Any ideas on how to implement a custom page so that the 501 can be handled properly?
The error pages you declare are used in two situations:
To allow developers to customize the appearance of content returned to a Web client
when a servlet generates an error, the deployment descriptor defines a list of error
page descriptions. The syntax allows the configuration of resources to be returned by
the container either when a servlet or filter calls sendError on the response for
specific status codes, or if the servlet generates an exception or error that propagates
to the container.
(Servlet 4.0 Specification, section 10.9.2)
In your case the error happens much earlier during the processing of the HTTP request itself. Therefore you need to modify the server's configuration (server.xml) and add a custom ErrorReportValve (cf. documentation). If all you want is to omit the server's version string, just add:
<Host>
<Valve className="org.apache.catalina.valves.ErrorReportValve" showServerInfo="false" />
...
</Host>
I'm trying to install Openfire 4.0.2 . My problem is that after restarting Openfire and pressing Admin Console I always see Setup Page. What should I do to fix it?
This is my openfire.xml file
<?xml version="1.0" encoding="UTF-8"?>
<!--
This file stores bootstrap properties needed by Openfire.
Property names must be in the format: "prop.name.is.blah=value"
That will be stored as:
<prop>
<name>
<is>
<blah>value</blah>
</is>
</name>
</prop>
Most properties are stored in the Openfire database. A
property viewer and editor is included in the admin console.
-->
<!-- root element, all properties must be under this element -->
<jive>
<adminConsole>
<!-- Disable either port by setting the value to -1 -->
<port>7090</port>
<securePort>7091</securePort>
</adminConsole>
<locale>en</locale>
<!-- Network settings. By default, Openfire will bind to all network interfaces.
Alternatively, you can specify a specific network interfaces that the server
will listen on. For example, 127.0.0.1. This setting is generally only useful
on multi-homed servers. -->
<!--
<network>
<interface>127.0.0.1</interface>
</network>
-->
<!-- SPDY Protocol is npn.
(note: npn does not work with Java 8)
add -Xbootclasspath/p:/OPENFIRE_HOME/lib/npn-boot.jar to .vmoptions file -->
<!--
<spdy>
<protocol>npn</protocol>
</spdy>
-->
<!-- XEP-0198 properties -->
<stream>
<management>
<!-- Whether stream management is offered to clients by server. -->
<active>true</active>
<!-- Number of stanzas sent to client before a stream management
acknowledgement request is made. -->
<requestFrequency>5</requestFrequency>
</management>
</stream>
</jive>
Thank you.
In a file like this you miss the database part, so probably you never finished the setup really.
However there are 2 flags you must add:
in openfire.xml <setup>true</setup>
as child of <jive> tag
and in ofProperty table of database
INSERT INTO OFPROPERTY (NAME,PROPVALUE) VALUES ('setup','true');
The answer is, you have to uninstall Openfire and after delete Openfire folder which is situated in C:/ProgramFiles(x86)/ and reinstall Openfire.
The setup procedure of Openfire will, if it runs successfully, modify the content of the openfire.xml file. The most typical reason for this to fail is a file permission problem. Make sure that the user that is executing Openfire is allowed to read & write all files under the Openfire home folder.
I am able to rename the value of org.apache.coyote.http11.Http11Protocol.SERVER to anything else, so the HTTP-Response-Header contains something like:
Server:Apache
instead of the default
Server:Apache-Coyote/1.1
Using a empty value for org.apache.coyote.http11.Http11Protocol.SERVER does not remove the Server-Header.
How can I remove the Server-Header from my responses?
You can modify your tomcat server.xml and add a "server" option and set it to whatever you want. The server option should be set for any http or ssl connectors that you have running. For example, below is a sample HTTP Connector configuration from an example server.xml file
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" enableLookups="false" xpoweredby="false" server="Web"/>
Short answer - you can't remove the header, but you should modify it (see other answers).
The server header is defined in the RFC and it is mandatory. (not defined as optional in the spec)
Taken from http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.38
14.38 Server
The Server response-header field contains information about the software used by the origin server to handle the request.
The field can contain multiple product tokens (section 3.8) and
comments identifying the server and any significant subproducts. The
product tokens are listed in order of their significance for
identifying the application.
If the response is being forwarded through a proxy, the proxy application MUST NOT modify the Server
response-header. Instead, it SHOULD include a Via field (as described
in section 14.45).
Note: Revealing the specific software version of the server might
allow the server machine to become more vulnerable to attacks
against software that is known to contain security holes. Server
implementors are encouraged to make this field a configurable
option.
It should be possible since Tomcat 5.5. Check out this discussion: https://mail-archives.apache.org/mod_mbox/tomcat-users/200508.mbox/%3C42FBE8AA.1060401#joedog.org%3E
and this link:
https://tomcat.apache.org/tomcat-4.1-doc/config/coyote.html
Accordingly the following should set the server header to TEST. Empty should make it empty.
<Connector className="org.apache.coyote.tomcat4.CoyoteConnector" port="8180" inProcessors="5" maxProcessors="75" enableLookups="true" acceptCount="10" debug="0" connectionTimeout="20000" useURIValidationHack="false" server="TEST"/>
Setting the Server header to Apache should security-wise be good enough in most cases. Just from that it won't be possible to infer which OS nor which exact version with which modules and the versions of the modules running.
if you are using embedded tomcat then you can try below code.
import org.apache.catalina.startup.Tomcat;
final Tomcat server = new Tomcat();
server.getConnector().setXpoweredBy(false);
server.getConnector().setAttribute("server", "");
For Web application.
Set Server header from the code.
It worked for me in Java Spring boot project.
response.setHeader("Server", "none");
Try adding from code if it is deployed in tomcat.
I am currently trying to use embeded Tomcat for my application and am trying to set it up to get the URL of the http request.
Some Background:
I am using the same code as in the first answer for the post here : Howto embed Tomcat 6?
The only change I have made is :
private String catalinaHome = "/home/xyz/tomcat"; // This dir is created and has full access permissions
Also , I am looking at: http://tomcat.apache.org/tomcat-5.5-doc/catalina/docs/api/org/apache/catalina/startup/Embedded.html
There are no server.xml and tomcat-users.xml that I could find, so I created a tomcat-users.xml since I was getting an exception :Memory database file /home/xyz/tomcat/conf/tomcat-users.xml cannot be read .
tomcat-users.xml:
<?xml version='1.0' encoding='utf-8'?>
<tomcat-users>
<role rolename="tomcat"/>
<role rolename="role1"/>
<user username="tomcat" password="tomcat" roles="tomcat"/>
<user username="both" password="tomcat" roles="tomcat,role1"/>
<user username="role1" password="tomcat" roles="role1"/>
</tomcat-users>
The code uses container.setRealm(new MemoryRealm());
It appears from here : http://tomcat.apache.org/tomcat-4.1-doc/catalina/funcspecs/fs-memory-realm.html that I should have a server.xml file and there should already be one created by default.
1] Do I need to create a server.xml, what should be the default in it ?
I have put a file with default from here : http://www.akadia.com/download/soug/tomcat/html/tomcat_server_xml.html , but just want to know what is the right thing to do ?
2]When I access http://localhost:8089/mywebapp/index.html, all i get is The requested resource () is not available, though I have an index.html page at the "webappDir" in the code
3] My only need from the embedded tomcat is to intercept so as to get the URL passed to tomcat in my code. I can then parse the URL [do my stuff] and then create a http payload and send an http response back.
I would appreciate any pointers, especially for 3] ?
Thanks!
Ok, for your first question, yo do not need server.xml. If you check the code of your initial post they are setting the parameters there. So that is what server.xml would encapsulate. In reality what happens is that Tomcat will parse server.xml for the properties you are defining on your java file where you instanciate the catalina call to start. But since it is embedded you are setting all those parameters on you class instead.
For your second question, check your logs directory and see what is being parsed. Something is happening after your service starts because it should already redirect you once you call the port. either way, just try http://localhost:8089 and see what you get back in return from tomcat. It should give you some kind of response back from the server itself.
if you do it like this "http://localhost:8089/mywebapp/index.html" you are trying to access a created context, and that might not be configured correctly, but that is just a guess right now.
Try this first and tell me what you get back. we can troubleshoot from this point and see if I can help more in that sense.
Quick question, is this windows or linux you are installing on?
If it is linux the configurations filea are located usually on /etc/tomcat6. (at least on ubuntu they are). Reply back with the version you have installed. I might be able to help you out.
I guess I should also elaborate here a little more. Tomcat is a service in linux as well, so in ubuntu you have to start tomcat in order to access it.
$: sudo service tomcat6 start
then it starts tomcat on port 8080 (usually if not changed) of your localhost. hence you type localhost:8080 to access the website for configuration of tomcat that gives you a It works prompt for you.
Let me know if you have more questions, I will try to respond to the best of my knowledge
I currently use a custom gzip encoder for my WCF service. I want to replace it with the built-in IIS 7 compression if that is possible. I can't find info online on how to that.
Is there any way to enable IIS 7 compression for WCF services?
Do you know if this will be supported out-of-the-box with .Net 4?
Edit June 15th: I'm still looking for a way to replace our custom gzip encoder with a mainstream approach so if you know how to do that with .Net 4 and IIS 7, please answer this question.
Thanks
Sidebar : My attempt at doing this manually
Since I can't find how to do it by simply turning a few knobs I decided to try and enable it manually.
So far I have:
Installed and enabled the IIS 7 Dynamic Compression Module
Changed the section of the applicationHost.config file to enable compression for mimeType="application/soap+xml" and mimeType="application/xop+xml".
I used an HTTP sniffer to sniff traffic sent from my app (Windows Forms). I see that requests do not have the Accept-Encoding:gzip,deflate http header.
So I
Added it manually to all outgoing calls using the OperationContextScope class and its OutgoingMessageProperties. (I will post the details later if I find the solution).
With the http sniffer, I can see that the client header now has the correct header:
POST /### path to my service ####/MyService.svc HTTP/1.1
MIME-Version: 1.0
Content-Type: multipart/related; type="application/xop+xml";
start="<http://tempuri.org/0>";
boundary="uuid:####### some uuid #############";
start-info="application/soap+xml"
Accept-Encoding: gzip,deflate
Host: ####### my server name #############
Content-Length: 1753
Expect: 100-continue
But the server response is still not compressed.
Why is the server response not compressed? Have I used the correct mime types? Once I get the server to return a compressed answer, will the client automatically decompress it or will have to write code on the client side to decompress?
Thanks for your help
I had the same problem; .aspx pages were compressed but WCF content wasn't. It has to do with the content type returned by the WCF service, which got appended to the mime-type.
I got it to work with the following section in the ApplicationHost.config:
<dynamicTypes>
<add mimeType="text/*" enabled="true" />
<add mimeType="message/*" enabled="true" />
<add mimeType="application/*" enabled="true" />
<add mimeType="*/*" enabled="false" />
</dynamicTypes>
Here's what I did (most of the same steps as mentioned already):
Install the Dynamic Compression Role Service for IIS role
Enable Dynamic Content Compression for the website that you use to host the WCF service
Open %SystemRoot%\system32\inetsrv\config\applicationhost.config and add the relevant content type to the section of the
After this it still didn't work.
I checked the data with Firefox' Tamper Data and noticed the content type returned was actually "application/xml; charset=utf-8".
After adding the complete content type, including the "; charset=utf-8" to the section, it worked:
<add mimeType="application/xml; charset=utf-8" enabled="true" />
As I felt that the character set encoding should not be determining if the compression works or not, I ended up letting IIS compress all application/* content types.
This is useful for IIS 6
http://ramon.bloggingabout.net/2008/11/06/wcf-and-http-gzipdeflate-compression-and-silverlight/
(updated URL)
Perhaps it depends on the specific WCF service setup you are using, but for the applications I have used it in (all were mixed access for both .NET applications and Silverlight pages), the generated WCF client class contained an EnableDecompression property that can be set to true. After that my Winforms apps send the correct headers and the webservice communication is correctly compressed.
It seems you can enable Dynamic Compression in IIS via the GUI or CLI.
This article shows you both ways:
http://www.hanselman.com/blog/EnablingDynamicCompressionGzipDeflateForWCFDataFeedsODataAndOtherCustomServicesInIIS7.aspx
I found the GUI way easy. The article shows you how to confirm it is working with Fiddler.
Cheers!