Gitiles
Code Review Sign In
source.supwisdom.com / portal_platform / tomcat-cms / 07b3087b89f4c23810bb2a7902fe5a06f392b984 / . / webapps / docs / security-howto.html
blob: f4eb70aabd6f4a31adfee005c34917752fbc54f8 [file] [log] [blame]
Cheng Tang07b30872014-04-27 16:37:18 +0800[diff] [blame^]1<html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 7 (7.0.42) - Security Considerations</title><style type="text/css" media="print">
2 .noPrint {display: none;}
3 td#mainBody {width: 100%;}
4 </style><style type="text/css">
5 code {background-color:rgb(224,255,255);padding:0 0.1em;}
6 code.attributeName, code.propertyName {background-color:transparent;}
7 </style><style type="text/css">
8 .wrapped-source code { display: block; background-color: transparent; }
9 .wrapped-source div { margin: 0 0 0 1.25em; }
10 .wrapped-source p { margin: 0 0 0 1.25em; text-indent: -1.25em; }
11 </style><style type="text/css">
12 p.notice {
13 border: 1px solid rgb(255, 0, 0);
14 background-color: rgb(238, 238, 238);
15 color: rgb(0, 51, 102);
16 padding: 0.5em;
17 margin: 1em 2em 1em 1em;
18 }
19 </style></head><body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76"><table border="0" width="100%" cellspacing="0"><!--PAGE HEADER--><tr><td><!--PROJECT LOGO--><a href="http://tomcat.apache.org/"><img src="./images/tomcat.gif" align="right" alt="
20 The Apache Tomcat Servlet/JSP Container
21 " border="0"></a></td><td><h1><font face="arial,helvetica,sanserif">Apache Tomcat 7</font></h1><font face="arial,helvetica,sanserif">Version 7.0.42, Jul 2 2013</font></td><td><!--APACHE LOGO--><a href="http://www.apache.org/"><img src="./images/asf-logo.gif" align="right" alt="Apache Logo" border="0"></a></td></tr></table><table border="0" width="100%" cellspacing="4"><!--HEADER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><tr><!--LEFT SIDE NAVIGATION--><td width="20%" valign="top" nowrap class="noPrint"><p><strong>Links</strong></p><ul><li><a href="index.html">Docs Home</a></li><li><a href="http://wiki.apache.org/tomcat/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul><p><strong>User Guide</strong></p><ul><li><a href="introduction.html">1) Introduction</a></li><li><a href="setup.html">2) Setup</a></li><li><a href="appdev/index.html">3) First webapp</a></li><li><a href="deployer-howto.html">4) Deployer</a></li><li><a href="manager-howto.html">5) Manager</a></li><li><a href="realm-howto.html">6) Realms and AAA</a></li><li><a href="security-manager-howto.html">7) Security Manager</a></li><li><a href="jndi-resources-howto.html">8) JNDI Resources</a></li><li><a href="jndi-datasource-examples-howto.html">9) JDBC DataSources</a></li><li><a href="class-loader-howto.html">10) Classloading</a></li><li><a href="jasper-howto.html">11) JSPs</a></li><li><a href="ssl-howto.html">12) SSL</a></li><li><a href="ssi-howto.html">13) SSI</a></li><li><a href="cgi-howto.html">14) CGI</a></li><li><a href="proxy-howto.html">15) Proxy Support</a></li><li><a href="mbeans-descriptor-howto.html">16) MBean Descriptor</a></li><li><a href="default-servlet.html">17) Default Servlet</a></li><li><a href="cluster-howto.html">18) Clustering</a></li><li><a href="balancer-howto.html">19) Load Balancer</a></li><li><a href="connectors.html">20) Connectors</a></li><li><a href="monitoring.html">21) Monitoring and Management</a></li><li><a href="logging.html">22) Logging</a></li><li><a href="apr.html">23) APR/Native</a></li><li><a href="virtual-hosting-howto.html">24) Virtual Hosting</a></li><li><a href="aio.html">25) Advanced IO</a></li><li><a href="extras.html">26) Additional Components</a></li><li><a href="maven-jars.html">27) Mavenized</a></li><li><a href="security-howto.html">28) Security Considerations</a></li><li><a href="windows-service-howto.html">29) Windows Service</a></li><li><a href="windows-auth-howto.html">30) Windows Authentication</a></li><li><a href="jdbc-pool.html">31) Tomcat's JDBC Pool</a></li><li><a href="web-socket-howto.html">32) WebSocket</a></li></ul><p><strong>Reference</strong></p><ul><li><a href="RELEASE-NOTES.txt">Release Notes</a></li><li><a href="config/index.html">Configuration</a></li><li><a href="api/index.html">Tomcat Javadocs</a></li><li><a href="servletapi/index.html">Servlet Javadocs</a></li><li><a href="jspapi/index.html">JSP 2.2 Javadocs</a></li><li><a href="elapi/index.html">EL 2.2 Javadocs</a></li><li><a href="http://tomcat.apache.org/connectors-doc/">JK 1.2 Documentation</a></li></ul><p><strong>Apache Tomcat Development</strong></p><ul><li><a href="building.html">Building</a></li><li><a href="changelog.html">Changelog</a></li><li><a href="http://wiki.apache.org/tomcat/TomcatVersions">Status</a></li><li><a href="developers.html">Developers</a></li><li><a href="architecture/index.html">Architecture</a></li><li><a href="funcspecs/index.html">Functional Specs.</a></li><li><a href="tribes/introduction.html">Tribes</a></li></ul></td><!--RIGHT SIDE MAIN BODY--><td width="80%" valign="top" align="left" id="mainBody"><h1>Security Considerations</h1><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Table of Contents"><!--()--></a><a name="Table_of_Contents"><strong>Table of Contents</strong></a></font></td></tr><tr><td><blockquote>
22<ul><li><a href="#Introduction">Introduction</a></li><li><a href="#Non-Tomcat_settings">Non-Tomcat settings</a></li><li><a href="#Default_web_applications">Default web applications</a></li><li><a href="#Security_manager">Security manager</a></li><li><a href="#server.xml">server.xml</a><ol><li><a href="#server.xml/General">General</a></li><li><a href="#Server">Server</a></li><li><a href="#Listeners">Listeners</a></li><li><a href="#Connectors">Connectors</a></li><li><a href="#Host">Host</a></li><li><a href="#Context">Context</a></li><li><a href="#Valves">Valves</a></li><li><a href="#Realms">Realms</a></li><li><a href="#Manager">Manager</a></li></ol></li><li><a href="#System_Properties">System Properties</a></li><li><a href="#web.xml">web.xml</a></li><li><a href="#General">General</a></li></ul>
23</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
24 <p>Tomcat is configured to be reasonably secure for most use cases by
25 default. Some environments may require more, or less, secure configurations.
26 This page is to provide a single point of reference for configuration
27 options that may impact security and to offer some commentary on the
28 expected impact of changing those options. The intention is to provide a
29 list of configuration options that should be considered when assessing the
30 security of a Tomcat installation.</p>
31
32 <p><strong>Note</strong>: Reading this page is not a substitute for reading
33 and understanding the detailed configuration documentation. Fuller
34 descriptions of these attributes may be found in the relevant documentation
35 pages.</p>
36 </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Non-Tomcat settings"><!--()--></a><a name="Non-Tomcat_settings"><strong>Non-Tomcat settings</strong></a></font></td></tr><tr><td><blockquote>
37 <p>Tomcat configuration should not be the only line of defense. The other
38 components in the system (operating system, network, database, etc.) should
39 also be secured.</p>
40 <p>Tomcat should not be run under the root user. Create a dedicated user for
41 the Tomcat process and provide that user with the minimum necessary
42 permissions for the operating system. For example, it should not be possible
43 to log on remotely using the Tomcat user.</p>
44 <p>File permissions should also be suitable restricted. Taking the Tomcat
45 instances at the ASF as an example (where auto-deployment is disabled and
46 web applications are deployed as exploded directories), the standard
47 configuration is to have all Tomcat files owned by root with group Tomcat
48 and whilst owner has read/write priviliges, group only has read and world
49 has no permissions. The exceptions are the logs, temp and work directory
50 that are owned by the Tomcat user rather than root. This means that even if
51 an attacker compromises the Tomcat process, they can't change the
52 Tomcat configuration, deploy new web applications or modify existing web
53 applications. The Tomcat process runs with a umask of 007 to maintain these
54 permissions.</p>
55 <p>At the network level, consider using a firewall to limit both incoming
56 and outgoing connections to only those connections you expect to be
57 present.</p>
58 </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Default web applications"><!--()--></a><a name="Default_web_applications"><strong>Default web applications</strong></a></font></td></tr><tr><td><blockquote>
59 <p>Tomcat ships with a number of web applications by default.
60 Vulnerabilities have been discovered in these applications in the past.
61 Applications that are not required should be removed so the system will not
62 be at risk if another vulnerability is discovered.</p>
63 </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Security manager"><!--()--></a><a name="Security_manager"><strong>Security manager</strong></a></font></td></tr><tr><td><blockquote>
64 <p>Enabling the security manager causes web applications to be run in a
65 sandbox, significantly limiting a web application's ability to perform
66 malicious actions such as calling System.exit(), establishing network
67 connections or accessing the file system outside of the web application's
68 root and temporary directories. However, it should be noted that there are
69 some malicious actions, such as triggering high CPU consumption via an
70 infinite loop, that the security manager cannot prevent.</p>
71
72 <p>Enabling the security manager is usually done to limit the potential
73 impact, should an attacker find a way to compromise a trusted web
74 application . A security manager may also be used to reduce the risks of
75 running untrusted web applications (e.g. in hosting environments) but it
76 should be noted that the security manager only reduces the risks of
77 running untrusted web applications, it does not eliminate them. If running
78 multiple untrusted web applications, it is recommended that each web
79 application is deployed to a separate Tomcat instance (and ideally separate
80 hosts) to reduce the ability of a malicious web application impacting the
81 availability of other applications.</p>
82
83 <p>Tomcat is tested with the security manager enabled; but the majority of
84 Tomcat users do not run with a security manager, so Tomcat is not as well
85 user-tested in this configuration. There have been, and continue to be,
86 bugs reported that are triggered by running under a security manager.</p>
87
88 <p>The restrictions imposed by a security manager are likely to break most
89 applications if the security manager is enabled. The security manager should
90 not be used without extensive testing. Ideally, the use of a security
91 manager should be introduced at the start of the development cycle as it can
92 be time-consuming to track down and fix issues caused by enabling a security
93 manager for a mature application.</p>
94 </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="server.xml"><strong>server.xml</strong></a></font></td></tr><tr><td><blockquote>
95 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="server.xml/General"><strong>General</strong></a></font></td></tr><tr><td><blockquote>
96 <p>The default server.xml contains a large number of comments, including
97 some example component definitions that are commented out. Removing these
98 comments makes it considerably easier to read and comprehend
99 server.xml.</p>
100 <p>If a component type is not listed, then there are no settings for that
101 type that directly impact security.</p>
102 </blockquote></td></tr></table>
103
104 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Server"><strong>Server</strong></a></font></td></tr><tr><td><blockquote>
105 <p>Setting the <strong>port</strong> attribute to <code>-1</code> disables
106 the shutdown port.</p>
107 <p>If the shutdown port is not disabled, a strong password should be
108 configured for <strong>shutdown</strong>.</p>
109 </blockquote></td></tr></table>
110
111 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Listeners"><strong>Listeners</strong></a></font></td></tr><tr><td><blockquote>
112 <p>The APR Lifecycle Listener is not stable if compiled on Solaris using
113 gcc. If using the APR/native connector on Solaris, compile it with the
114 Sun Studio compiler.</p>
115
116 <p>The Security Listener should be enabled and configured as appropriate.
117 </p>
118 </blockquote></td></tr></table>
119
120 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Connectors"><strong>Connectors</strong></a></font></td></tr><tr><td><blockquote>
121 <p>By default, an HTTP and an AJP connector are configured. Connectors
122 that will not be used should be removed from server.xml.</p>
123
124 <p>The <strong>address</strong> attribute may be used to control which IP
125 address the connector listens on for connections. By default, the
126 connector listens on all configured IP addresses.</p>
127
128 <p>The <strong>allowTrace</strong> attribute may be used to enable TRACE
129 requests which can be useful for debugging. Due to the way some browsers
130 handle the response from a TRACE request (which exposes the browser to an
131 XSS attack), support for TRACE requests is disabled by default.</p>
132
133 <p>The <strong>maxPostSize</strong> attribute controls the maximum size
134 of a POST request that will be parsed for parameters. The parameters are
135 cached for the duration of the request so this is limited to 2MB by
136 default to reduce exposure to a DOS attack.</p>
137
138 <p>The <strong>maxSavePostSize</strong> attribute controls the saving of
139 POST requests during FORM and CLIENT-CERT authentication. The parameters
140 are cached for the duration of the authentication (which may be many
141 minutes) so this is limited to 4KB by default to reduce exposure to a DOS
142 attack.</p>
143
144 <p>The <strong>maxParameterCount</strong> attribute controls the
145 maximum number of parameter and value pairs (GET plus POST) that can
146 be parsed and stored in the request. Excessive parameters are ignored.
147 If you want to reject such requests, configure a
148 <a href="config/filter.html">FailedRequestFilter</a>.</p>
149
150 <p>The <strong>xpoweredBy</strong> attribute controls whether or not the
151 X-Powered-By HTTP header is sent with each request. If sent, the value of
152 the header contains the Servlet and JSP specification versions, the full
153 Tomcat version (e.g. Apache Tomcat/7.0.0), the name of the JVM vendor and
154 the version of the JVM. This header is disabled by default. This header
155 can provide useful information to both legitimate clients and attackers.
156 </p>
157
158 <p>The <strong>server</strong> attribute controls the value of the Server
159 HTTP header. The default value of this header for Tomcat 4.1.x, 5.0.x,
160 5.5.x, 6.0.x and 7.0.x is Apache-Coyote/1.1. This header can provide
161 limited information to both legitimate clients and attackers.</p>
162
163 <p>The <strong>SSLEnabled</strong>, <strong>scheme</strong> and
164 <strong>secure</strong> attributes may all be independently set. These are
165 normally used when Tomcat is located behind a reverse proxy and the proxy
166 is connecting to Tomcat via HTTP or HTTPS. They allow Tomcat to see the
167 SSL attributes of the connections between the client and the proxy rather
168 than the proxy and Tomcat. For example, the client may connect to the
169 proxy over HTTPS but the proxy connects to Tomcat using HTTP. If it is
170 necessary for Tomcat to be able to distinguish between secure and
171 non-secure connections received by a proxy, the proxy must use separate
172 connectors to pass secure and non-secure requests to Tomcat. If the
173 proxy uses AJP then the SSL attributes of the client connection are
174 passed via the AJP protocol and separate connectors are not needed.</p>
175
176 <p>The <strong>ciphers</strong> attribute controls the ciphers used for
177 SSL connections. By default, the default ciphers for the JVM will be used.
178 This usually means that the weak export grade ciphers will be included in
179 the list of available ciphers. Secure environments will normally want to
180 configure a more limited set of ciphers.</p>
181
182 <p>The <strong>tomcatAuthentication</strong> attribute is used with the
183 AJP connectors to determine if Tomcat should authenticate the user or if
184 authentication can be delegated to the reverse proxy that will then pass
185 the authenticated username to Tomcat as part of the AJP protocol.</p>
186
187 <p>The <strong>allowUnsafeLegacyRenegotiation</strong> attribute provides
188 a workaround for
189 <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3555">
190 CVE-2009-3555</a>, a TLS man in the middle attack. This workaround applies
191 to the BIO connector. It is only necessary if the underlying SSL
192 implementation is vulnerable to CVE-2009-3555. For more information on the
193 current state of this vulnerability and the work-arounds available see the
194 <a href="http://tomcat.apache.org/security-7.html">Tomcat 7 security
195 page</a>.</p>
196
197 <p>The <strong>requiredSecret</strong> attribute in AJP connectors
198 configures shared secret between Tomcat and reverse proxy in front of
199 Tomcat. It is used to prevent unauthorized connections over AJP protocol.</p>
200 </blockquote></td></tr></table>
201
202 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Host"><strong>Host</strong></a></font></td></tr><tr><td><blockquote>
203 <p>The host element controls deployment. Automatic deployment allows for
204 simpler management but also makes it easier for an attacker to deploy a
205 malicious application. Automatic deployment is controlled by the
206 <strong>autoDeploy</strong> and <strong>deployOnStartup</strong>
207 attributes. If both are <code>false</code>, only Contexts defined in
208 server.xml will be deployed and any changes will require a Tomcat restart.
209 </p>
210
211 <p>In a hosted environment where web applications may not be trusted, set
212 the <strong>deployXML</strong> attribute to <code>false</code> to ignore any
213 context.xml packaged with the web application that may try to assign
214 increased privileges to the web application. </p>
215 </blockquote></td></tr></table>
216
217 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Context"><strong>Context</strong></a></font></td></tr><tr><td><blockquote>
218 <p>This applies to <a href="config/context.html">Context</a>
219 elements in all places where they can be defined:
220 <code>server.xml</code> file,
221 default <code>context.xml</code> file,
222 per-host <code>context.xml.default</code> file,
223 web application context file in per-host configuration directory
224 or inside the web application.</p>
225
226 <p>The <strong>crossContext</strong> attribute controls if a context is
227 allowed to access the resources of another context. It is
228 <code>false</code> by default and should only be changed for trusted web
229 applications.</p>
230
231 <p>The <strong>privileged</strong> attribute controls if a context is
232 allowed to use container provided servlets like the Manager servlet. It is
233 <code>false</code> by default and should only be changed for trusted web
234 applications.</p>
235
236 <p>The <strong>allowLinking</strong> attribute controls if a context is
237 allowed to use linked files. If enabled and the context is undeployed, the
238 links will be followed when deleting the context resources. To avoid this
239 behaviour, use the <strong>aliases</strong> attribute. Changing this
240 setting from the default of <code>false</code> on case insensitive
241 operating systems (this includes Windows) will disable a number of
242 security measures and allow, among other things, direct access to the
243 WEB-INF directory.</p>
244 </blockquote></td></tr></table>
245
246 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Valves"><strong>Valves</strong></a></font></td></tr><tr><td><blockquote>
247 <p>It is strongly recommended that an AccessLogValve is configured. The
248 default Tomcat configuration includes an AccessLogValve. These are
249 normally configured per host but may also be configured per engine or per
250 context as required.</p>
251
252 <p>Any administrative application should be protected by a
253 RemoteAddrValve. (Note that this Valve is also available as a Filter.)
254 The <strong>allow</strong> attribute should be used to limit access to a
255 set of known trusted hosts.</p>
256
257 <p>The default ErrorReportValve includes the Tomcat version number in the
258 response sent to clients. To avoid this, custom error handling can be
259 configured within each web application. Alternatively, the version number
260 can be changed by creating the file
261 CATALINA_BASE/lib/org/apache/catalina/util/ServerInfo.properties with
262 content as follows:</p>
263 <div align="left"><table cellspacing="4" cellpadding="0" border="0"><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#ffffff" height="1"><pre>
264server.info=Apache Tomcat/7.0.x
265 </pre></td><td bgcolor="#023264" width="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr><tr><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td><td bgcolor="#023264" width="1" height="1"><img src="./images/void.gif" alt="" width="1" height="1" vspace="0" hspace="0" border="0"></td></tr></table></div>
266 <p>Modify the values as required. Note that this will also change the version
267 number reported in some of the management tools and may make it harder to
268 determine the real version installed. The CATALINA_HOME/bin/version.bat|sh
269 script will still report the version number.</p>
270
271 <p>The default ErrorReportValve can display stack traces and/or JSP
272 source code to clients when an error occurs. To avoid this, custom error
273 handling can be configured within each web application.</p>
274 </blockquote></td></tr></table>
275
276 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Realms"><strong>Realms</strong></a></font></td></tr><tr><td><blockquote>
277 <p>The MemoryRealm is not intended for production use as any changes to
278 tomcat-users.xml require a restart of Tomcat to take effect.</p>
279
280 <p>The JDBCRealm is not recommended for production use as it is single
281 threaded for all authentication and authorization options. Use the
282 DataSourceRealm instead.</p>
283
284 <p>The UserDatabaseRealm is not intended for large-scale installations. It
285 is intended for small-scale, relatively static environments.</p>
286
287 <p>The JAASRealm is not widely used and therefore the code is not as
288 mature as the other realms. Additional testing is recommended before using
289 this realm.</p>
290
291 <p>By default, the realms do not implement any form of account lock-out.
292 This means that brute force attacks can be successful. To prevent a brute
293 force attack, the chosen realm should be wrapped in a LockOutRealm.</p>
294 </blockquote></td></tr></table>
295
296 <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Manager"><strong>Manager</strong></a></font></td></tr><tr><td><blockquote>
297 <p>The manager component is used to generate session IDs.</p>
298
299 <p>The default <strong>entropy</strong> value has been shown to generate predictable values
300 under certain conditions. For more secure session generation, this should
301 be set to a long string. This is done automatically if the APR/native
302 library is installed; a random value will be obtained from the APR/native
303 library.</p>
304
305 <p>The class used to generate random session IDs may be changed with
306 the <strong>randomClass</strong> attribute.</p>
307
308 <p>The length of the session ID may be changed with the
309 <strong>sessionIdLength</strong> attribute.</p>
310 </blockquote></td></tr></table>
311 </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="System Properties"><!--()--></a><a name="System_Properties"><strong>System Properties</strong></a></font></td></tr><tr><td><blockquote>
312 <p>Setting <strong>org.apache.catalina.connector.RECYCLE_FACADES</strong>
313 system property to <code>true</code> will cause a new facade object to be
314 created for each request. This reduces the chances of a bug in an
315 application exposing data from one request to another.</p>
316
317 <p>The <strong>
318 org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH</strong> and
319 <strong>org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH</strong>
320 system properties allow non-standard parsing of the request URI. Using
321 these options when behind a reverse proxy may enable an attacker to bypass
322 any security constraints enforced by the proxy.</p>
323
324 <p>The <strong>
325 org.apache.catalina.connector.Response.ENFORCE_ENCODING_IN_GET_WRITER
326 </strong> system property has security implications if disabled. Many user
327 agents, in breach of RFC2616, try to guess the character encoding of text
328 media types when the specification-mandated default of ISO-8859-1 should be
329 used. Some browsers will interpret as UTF-7 a response containing characters
330 that are safe for ISO-8859-1 but trigger an XSS vulnerability if interpreted
331 as UTF-7.</p>
332 </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="web.xml"><strong>web.xml</strong></a></font></td></tr><tr><td><blockquote>
333 <p>This applies to the default <code>conf/web.xml</code> file and
334 <code>WEB-INF/web.xml</code> files in web applications if they define
335 the components mentioned here.</p>
336
337 <p>The <a href="default-servlet.html">DefaultServlet</a> is configured
338 with <strong>readonly</strong> set to
339 <code>true</code>. Changing this to <code>false</code> allows clients to
340 delete or modify static resources on the server and to upload new
341 resources. This should not normally be changed without requiring
342 authentication.</p>
343
344 <p>The DefaultServlet is configured with <strong>listings</strong> set to
345 <code>false</code>. This isn't because allowing directory listings is
346 considered unsafe but because generating listings of directories with
347 thousands of files can consume significant CPU leading to a DOS attack.
348 </p>
349
350 <p><a href="config/filter.html">FailedRequestFilter</a>
351 can be configured and used to reject requests that had errors during
352 request parameter parsing. Without the filter the default behaviour is
353 to ignore invalid or excessive parameters.</p>
354 </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="General"><strong>General</strong></a></font></td></tr><tr><td><blockquote>
355 <p>BASIC and FORM authentication pass user names and passwords in clear
356 text. Web applications using these authentication mechanisms with clients
357 connecting over untrusted networks should use SSL.</p>
358
359 <p>The session cookie for a session with an authenticated user are nearly
360 as useful as the user's password to an attacker and in nearly all
361 circumstances should be afforded the same level of protection as the
362 password itself. This usually means authenticating over SSL and continuing
363 to use SSL until the session ends.</p>
364 </blockquote></td></tr></table></td></tr><tr class="noPrint"><td width="20%" valign="top" nowrap class="noPrint"></td><td width="80%" valign="top" align="left"><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="comments_section" id="comments_section"><strong>Comments</strong></a></font></td></tr><tr><td><blockquote><p class="notice"><strong>Notice: </strong>This comments section collects your suggestions
365 on improving documentation for Apache Tomcat.<br><br>
366 If you have trouble and need help, read
367 <a href="http://tomcat.apache.org/findhelp.html">Find Help</a> page
368 and ask your question on the tomcat-users
369 <a href="http://tomcat.apache.org/lists.html">mailing list</a>.
370 Do not ask such questions here. This is not a Q&amp;A section.<br><br>
371 The Apache Comments System is explained <a href="/tomcat-7.0-doc/comments.html">here</a>.
372 Comments may be removed by our moderators if they are either
373 implemented or considered invalid/off-topic.</p><script type="text/javascript"><!--//--><![CDATA[//><!--
374 var comments_shortname = 'tomcat';
375 var comments_identifier = 'http://tomcat.apache.org/tomcat-7.0-doc/security-howto.html';
376 (function(w, d) {
377 if (w.location.hostname.toLowerCase() == "tomcat.apache.org") {
378 d.write('<div id="comments_thread"><\/div>');
379 var s = d.createElement('script');
380 s.type = 'text/javascript';
381 s.async = true;
382 s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
383 (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
384 }
385 else {
386 d.write('<div id="comments_thread"><strong>Comments are disabled for this page at the moment.<\/strong><\/div>');
387 }
388 })(window, document);
389 //--><!]]></script></blockquote></td></tr></table></td></tr><!--FOOTER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><!--PAGE FOOTER--><tr><td colspan="2"><div align="center"><font color="#525D76" size="-1"><em>
390 Copyright &copy; 1999-2013, Apache Software Foundation
391 </em></font></div></td></tr></table></body></html>