Re: Tomcat host header redirect issue

Anushka,

On 7/23/26 2:03 AM, Anushka sur wrote:
> We tested by intercepting the request to
> https://sdcoradb5.hdfc.com:8083/ORDS and modifying only the HTTP Host
> header to bing.com while sending the request to the same Tomcat server. The
> application still processed the request instead of rejecting it with a 4xx
> response.

Please post your <Engine> element and *all* <Host> elements from your 
server.xml file. Also, all <Connector> elements.

In fact, post the whole file, redacting any specific values that contain 
sensitive information.

-chris

> On Thu, 23 Jul, 2026, 00:47 Christopher Schultz, <
> [email protected]> wrote:
> 
>> Anushka,
>>
>> On 7/21/26 6:15 AM, Anushka sur wrote:
>>> As you suggested, we created a dedicated virtual host in the |
>>> server.xml| file. However, even after adding the virtual host
>>> configuration, the issue still persists.
>>>
>>> For example, when we access the application using:
>>>
>>> |https://sdcoradb5.hdfc.com:8083/ORDS <https://sdcoradb5.hdfc.com:8083/
>>> ORDS>|
>>
>> Can you be very clear about what you mean, here?
>>
>> If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
>> presumably you will get a response from your application.
>>
>> If you make a request to bing.com using e.g. curl, then it will
>> obviously contact Bing and not go to your application at all.
>>
>> Where does the "redirect" come into the picture? Note that "redirect"
>> has a very specific meaning in the context of HTTP / web applications.
>>
>> -chris
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [email protected]
>> For additional commands, e-mail: [email protected]
>>
>>
>