Re: Tomcat host header redirect issue

On 21/07/2026 11:15, Anushka sur wrote:
> Hi Mark,
> 
> As you suggested, we created a dedicated virtual host in the | 
> server.xml| file. However, even after adding the virtual host 
> configuration, the issue still persists.
> 
> For example, when we access the application using:
> 
> |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/ 
> ORDS>|
> 
> and replace |sdcoradb5.hdfc.com:8083 <http://sdcoradb5.hdfc.com:8083>| 
> with |bing.com <http://bing.com>|, the request is still being redirected 
> instead of being rejected.

Which is it? http or https?

> Could you please confirm whether our |server.xml| configuration is 
> correct, or if there are any additional settings or configurations that 
> need to be added to ensure only the intended host is accepted?

I could, if you had provided details of your settings. Screenshots will 
get rejected by the mailing list. It would be better to simply paste the 
contents of server.xml into a plain text email.

Mark


> 
> Any guidance would be greatly appreciated.
> 
> Thank you, Anushka Sur
> 
> In the screenshot..we have taken other instance for testing
> 
>   Screenshot for your reference:--
> 
> 
> 
> 
> On Thu, 16 Jul, 2026, 11:40 Anushka sur, <[email protected] 
> <mailto:[email protected]>> wrote:
> 
>     Sorry for the confusion..We are using tomcat version 9.0.110
> 
>     On Thu, 16 Jul, 2026, 11:26 Anushka sur, <[email protected]
>     <mailto:[email protected]>> wrote:
> 
>         Hi everyone,
> 
>         Thanks for the feedback. You are right — Tomcat 9.0.110 is very
>         old, and we will treat the upgrade as the first remediation step.
> 
>         We will check the issue on a newer supported Tomcat release and
>         verify whether the redirect problem is still reproducible there.
>         If it is fixed by the upgrade, we will proceed with the newer
>         version
> 
>         if not, as suggested by mark thomas we will create virtual host.
> 
>         Thanks for pointing this out.
> 
>         Best regards,
>         Anushka Sur
> 
>         On Thu, 16 Jul, 2026, 01:33 Christopher Schultz,
>         <[email protected]
>         <mailto:[email protected]>> wrote:
> 
>             Mark,
> 
>             On 7/15/26 9:56 AM, Mark Thomas wrote:
>              > 15 Jul 2026 11:10:41 Anushka sur <[email protected]
>             <mailto:[email protected]>>:
>              >
>              >> We have identified a VAPT issue in our Oracle APEX
>             application
>              >> deployed on
>              >> ORDS 24.1.11 running on Apache Tomcat 9.0.11.
>              >
>              > That is horribly out of date. You might want to check the
>             list of
>              > published CVEs for 9.0.x
> 
>             +1
> 
>             The real VAPT issue should be "holy @#$%&* your Tomcat
>             version is *how*
>             old?"
> 
>             -chris
> 
> 
>             ---------------------------------------------------------------------
>             To unsubscribe, e-mail: [email protected]
>             <mailto:[email protected]>
>             For additional commands, e-mail: users-
>             [email protected] <mailto:[email protected]>
>