Re: Tomcat host header redirect issue

On 30/07/2026 13:43, Anushka sur wrote:
> Hi Christopher,
> 
> Have pasted the whole server.xml file

If you aren't going to bother following the advice you have been given 
more than a week ago, there isn't much point you asking here for help.

https://lists.apache.org/thread/v1o3zdprpcry19zny2oqqj9nocj8vnp2

You need *TWO* Host elements.

You only have a single certificate, so the TLS configuration won't be an 
issue here.

Mark


> 
> 
> <?xml version="1.0" encoding="UTF-8"?>
> <Server port="8005" shutdown="SHUTDOWN">
> 
> <Listener className="org.apache.catalina.startup.VersionLoggerListener" />
> <Listener className="org.apache.catalina.core.AprLifecycleListener"
> SSLEngine="on" />
> <Listener
> className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
> <Listener
> className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
> <Listener
> className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
> 
> <!-- Application Context (sanitized path) -->
> <Context path="/app/context" docBase="app_folder" reloadable="true" />
> 
> <GlobalNamingResources>
> <Resource
> name="UserDatabase"
> auth="Container"
> type="org.apache.catalina.UserDatabase"
> description="User database"
> factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
> pathname="conf/tomcat-users.xml" />
> </GlobalNamingResources>
> 
> <Service name="Catalina">
> 
> <!-- SSL Connector (all sensitive info masked) -->
> <Connector
> protocol="org.apache.coyote.http11.Http11NioProtocol"
> port="8083"
> connectionTimeout="20000"
> maxThreads="200"
> scheme="https"
> secure="true"
> SSLEnabled="true"
> keystoreFile="/***/***/sanitized_cert.pfx"
> keystorePass="********"
> keystoreType="PKCS12"
> clientAuth="false"
> sslProtocol="TLS" />
> 
> <Engine name="Catalina" defaultHost="localhost">
> 
> <Realm className="org.apache.catalina.realm.LockOutRealm">
> <Realm
> className="org.apache.catalina.realm.UserDatabaseRealm"
> resourceName="UserDatabase" />
> </Realm>
> 
> <Host
> name="localhost"
> appBase="webapps"
> unpackWARs="true"
> autoDeploy="true">
> 
> <Valve
> className="org.apache.catalina.valves.AccessLogValve"
> directory="logs"
> prefix="localhost_access_log"
> suffix=".txt"
> pattern="%h %l %u %t &quot;%r&quot; %s %b" />
> 
> </Host>
> 
> </Engine>
> </Service>
> </Server>
> 
> On Wed, 29 Jul, 2026, 19:33 Christopher Schultz, <
> [email protected]> wrote:
> 
>> Anushka,
>>
>> On 7/23/26 2:03 AM, Anushka sur wrote:
>>> We tested by intercepting the request to
>>> https://sdcoradb5.hdfc.com:8083/ORDS and modifying only the HTTP Host
>>> header to bing.com while sending the request to the same Tomcat server.
>> The
>>> application still processed the request instead of rejecting it with a
>> 4xx
>>> response.
>>
>> Please post your <Engine> element and *all* <Host> elements from your
>> server.xml file. Also, all <Connector> elements.
>>
>> In fact, post the whole file, redacting any specific values that contain
>> sensitive information.
>>
>> -chris
>>
>>> On Thu, 23 Jul, 2026, 00:47 Christopher Schultz, <
>>> [email protected]> wrote:
>>>
>>>> Anushka,
>>>>
>>>> On 7/21/26 6:15 AM, Anushka sur wrote:
>>>>> As you suggested, we created a dedicated virtual host in the |
>>>>> server.xml| file. However, even after adding the virtual host
>>>>> configuration, the issue still persists.
>>>>>
>>>>> For example, when we access the application using:
>>>>>
>>>>> |https://sdcoradb5.hdfc.com:8083/ORDS <
>> https://sdcoradb5.hdfc.com:8083/
>>>>> ORDS>|
>>>>
>>>> Can you be very clear about what you mean, here?
>>>>
>>>> If you make a request to sdcoradb5.hdfc.com:8083 using e.g. curl,
>>>> presumably you will get a response from your application.
>>>>
>>>> If you make a request to bing.com using e.g. curl, then it will
>>>> obviously contact Bing and not go to your application at all.
>>>>
>>>> Where does the "redirect" come into the picture? Note that "redirect"
>>>> has a very specific meaning in the context of HTTP / web applications.
>>>>
>>>> -chris
>>>>
>>>>
>>>> ---------------------------------------------------------------------
>>>> To unsubscribe, e-mail: [email protected]
>>>> For additional commands, e-mail: [email protected]
>>>>
>>>>
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: [email protected]
>> For additional commands, e-mail: [email protected]
>>
>>
>