Re: Tomcat host header redirect issue

Johan Compagner <[email protected]> Thu, 23 Jul 2026 11:44:14 +0000
Newsgroups	gmane.comp.jakarta.tomcat.user
Message-ID	<AM9P190MB134747B1D0F005D7A3E30D04B5C02@AM9P190MB1347.EURP190.PROD.OUTLOOK.COM>
--_000_AM9P190MB134747B1D0F005D7A3E30D04B5C02AM9P190MB1347EURP_
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

I guess these are the test:

curl https://tomcat.apache.org<https://tomcat.apache.org/>

If you do that then you get the normal home page
But if you do this:

curl -H "Host: bing.com" https://tomcat.apache.org<https://tomcat.apache.or=
g/>

You get:

Requested host does not match any Subject Alternative Names (SANs) on TLS c=
ertificate [cfa0deb905f8070b97e4b80fad764e4406e3f683af1bdc71809112e39a6cf45=
8] in use with this connection.

Visit https://www.fastly.com/documentation/guides/concepts/errors/#routing-=
errors for more information.

If you do this with google:

curl -H "Host: www.bing.com" https://www.google.com<https://www.google.com/=
>

You get some error page i think
If you hit a cloudfare backed website:

curl -H "Host: www.bing.com" https://www.servoy.com<https://www.servoy.com/=
>

<html>
<head><title>403 Forbidden</title></head>
<body>
<center><h1>403 Forbidden</h1></center>
<hr><center>cloudflare</center>
</body>
</html>

Its already intercepted by cloudfare
So it is always quite different then what you get, but you will almost neve=
r get the actual page..


________________________________
Van: Christopher Schultz <[email protected]>
Verzonden: woensdag 22 juli 2026 21:17
Aan: [email protected] <[email protected]>
Onderwerp: Re: Tomcat host header redirect issue

Anushka,

On 7/21/26 6:15 AM, Anushka sur wrote:
> As you suggested, we created a dedicated virtual host in the |
> server.xml| file. However, even after adding the virtual host
> configuration, the issue still persists.
>
> For example, when we access the application using:
>
> |https://eur03.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fsdco=
radb5.hdfc.com%3A8083%2FORDS&data=3D05%7C02%7Cjcompagner%40servoy.com%7C8ff=
2ae0ec22c480facd108dee825ddd0%7C057cbaf335604bfd8935be6a76c7d87b%7C1%7C0%7C=
639203446493271686%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIw=
LjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&s=
data=3DqLdOR5mwP%2BFY0rDz2z2Q05NX%2Bk8GPbRvMeCRf74ZkYc%3D&reserved=3D0 <htt=
ps://eur03.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fsdcoradb5.=
hdfc.com%3A8083%2F&data=3D05%7C02%7Cjcompagner%40servoy.com%7C8ff2ae0ec22c4=
80facd108dee825ddd0%7C057cbaf335604bfd8935be6a76c7d87b%7C1%7C0%7C6392034464=
93300338%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMC=
IsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=3Dx6V=
VzEBswZCiBJjYXJ9Wyl0enGb7ZBbY2oITpfzbXCc%3D&reserved=3D0
> ORDS>|

Can you be very clear about what you mean, here?

If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
presumably you will get a response from your application.

If you make a request to bing.com using e.g. curl, then it will
obviously contact Bing and not go to your application at all.

Where does the "redirect" come into the picture? Note that "redirect"
has a very specific meaning in the context of HTTP / web applications.

-chris


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]


--_000_AM9P190MB134747B1D0F005D7A3E30D04B5C02AM9P190MB1347EURP_--