${1:`substitute(Filename(\'\', \'Page Title\'), \'^.\', \'\\u&\', \'\')`}

Setting	Value
",o[l],"	"),f(a,l,u[l],i.getOption(l)),a.push("

Changelog

Tomcat 9.0.109 (remm)

Catalina

+ Remove a number of unnecessary packages from the catalina-deployer.jar. + (markt) +
+ 69781: Fix concurrent access issues in the session + FileStore implementation that were causing lost sessions + when the store was used with the PersistentValve. Based on + pull request #882 by Aaron Ogburn. (markt) +
+ Fix handling of QSA and QSD flags in + RewriteValve. (markt) +

Coyote

+ 69762: Additional overflow fix for HPACK decoding of + integers. Pull request #880 by Chenjp. (markt) +
+ Ensure keys are handed out to OpenSSL even if PEMFile + fails to process it, with appropriate logging. (remm) +
+ Add new ML-DSA key algorithm to PEMFile + and improve reporting when reading a key fails. (remm) +
+ Fix possible early timeouts for network operations caused by a spurious + wake-up of a waiting thread. Found by Coverity Scan. (markt) +

Cluster

+ Handle spurious wake-ups during leader election for + NonBlockingCoordinator. (markt) +
+ Handle spurious wake-ups during sending of messages by + RpcChannel. (markt) +

Other

+ Review logging and include the full stack trace and exception message + by default rather then just the exception message when logging an error + or warning in response to an exception. (markt) +
+ Add escaping to log formatters to align with JSON formatter. (markt) +
+ Update Checkstyle to 11.0.0. (markt) +

2025-08-06 Tomcat 9.0.108 (remm)

Catalina

+ Fix bloom filter population for archive indexing when using a packed + WAR containing one or more JAR files. (markt) +

Coyote

+ 69748: Add missing call to set keep-alive timeout when using + HTTP/1.1 following an async request, which was present for AJP. + (remm/markt) +
+ 69762: Fix possible overflow during HPACK decoding of + integers. Note that the maximum permitted value of an HPACK decoded + integer is Integer.MAX_VALUE. (markt) +
+ Update the HTTP/2 overhead documentation - particularly the code + comments - to reflect the deprecation of the PRIORITY frame + and clarify that a stream reset always triggers an overhead increase. + (markt) +

Cluster

+ Add enableStatistics configuration attribute for the + DeltaManager, defaulting to true. (remm) +

Web applications

+ Manager and Host Manager. Provide the Manager and Host Manager web + applications with a dedicated favicon file rather than using the one + from the ROOT web application which might not be present or may + represent something entirely different. Pull requests #876 + and #878 by Simon Arame. +

Other

+ Update Checkstyle to 10.26.1. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2025-07-04 Tomcat 9.0.107 (remm)

Catalina

+ Ensure application configured welcome files override the defaults when + configuring an embedded web application programmatically. (markt) +
+ Allow the default servlet to set the content length when the content + length is known, no content has been written and a Writer + is being used. (markt) +
+ 69717: Correct a regression in the fix for CVE-2025-49125 + that prevented access to PreResources and PostResources when mounted + below the web application root with a path that was terminated with a + file separator. (remm/markt) +
+ 69731: Fix an issue that meant that the value of + maxParameterCount applied was smaller than intended for + multipart uploads with non-file parts when the parts were processed + before query string parameters. (markt) +
+ Align size tracking for multipart requests with FileUpload's use of + long. (schultz) +

Coyote

+ 69710: Increase the default for maxPartCount + from 10 to 50. Update the documentation to + provide more details on the memory requirements to support multi-part + uploads while avoiding a denial of service risk. (markt) +
+ 69713: Correctly handle an HTTP/2 data frame that includes + padding when the headers include a content-length. (remm/markt) +
+ Correctly collect statistics for HTTP/2 requests and avoid counting one + request multiple times. Based on pull request #868 by + qingdaoheze. (markt) +
+ Fix JMX value for keepAliveCount on the endpoint. Also add + the value of useVirtualThreads in JMX. (remm) +
+ Improve stability of APR/native connector. (markt) +
+ 69728: Remove incorrect warning when HTTP/2 is used with + optional certificate verification and improve the warnings when a web + application tries to use CLIENT-CERT with either HTTP/2 or a JSSE + implementation of TLS 1.3. (markt) +
+ When setting the initial HTTP/2 connection limit, apply those limits + earlier. (markt) +

Jasper

+ Remove IMPL_OBJ_START from EL grammar for + IDENTIFIER. (markt) +
+ Remove the INSTANCEOF and FUNCTIONSUFFIX + definitions from the EL grammar as both are unused. (markt) +

Web applications

+ Documentation. Provide more explicit guidance regarding the security + considerations for enabling write access to the web application via + WebDAV, HTTP PUT requests or similar. (markt) +
+ Documentation. Add a section on reverse proxies to the security + considerations page. (markt) +

Other

+ Update UnboundID to 7.0.3. (markt) +
+ Update Checkstyle to 10.25.1. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations provided by tak7iji. (markt) +

2025-06-10 Tomcat 9.0.106 (remm)

Catalina

+ Add support for the java:module namespace which mirrors + the java:comp namespace. (markt) +
+ Support parsing of multiple path parameters separated by ; + in a single URL segment. Based on pull request #860 by Chenjp. + (markt) +
+ Added support for limiting the number of parameters in HTTP requests through + the new ParameterLimitValve. The valve allows configurable + URL-specific limits on the number of parameters. (dsoumis) +
+ 69699: Encode redirect URL used by the rewrite valve with + the session id if appropriate, and handle cross context with different + session configuration when using rewrite. (remm) +
+ #863: Add support for comments at the end of lines in text + rewrite map files to align behaviour with Apache httpd. Pull request + provided by Chenjp. (markt) +
+ 69706: Fix saved request serialization issue in FORM + introduced when allowing infinite session timeouts. (remm) +
+ Expand the path checks for Pre-Resources and Post-Resources mounted at a + path within the web application. (markt) +

Coyote

+ #861: Refactor TaskQueue to use the new interface + RetryableQueue which enables better integration of custom + Executors which provide their own + BlockingQueue implementation. Pull request provided by + Paulo Almeida. (markt) +
+ Provide finer grained control of multi-part request processing via two + new attributes on the Connector element. + maxPartCount limits the total number of parts in a + multi-part request and maxPartHeaderSize limits the size of + the headers provided with each part. Add support for these new + attributes to the ParameterLimitValve. (markt) +

Jasper

+ 69696: Mark the JSP wrapper for reload after a failed + compilation. (remm) +

Web applications

+ 69694: Improve error reporting of deployment tasks done + using the manager webapp when a copy operation fails. (remm) +

Other

+ Add thread name to webappClassLoader.stackTraceRequestThread message. + Patch provided by Felix Zhang. (schultz) +
+ Update the internal fork of Apache Commons FileUpload to 1.6.0 + (2025-06-05). (markt) +
+ Update EasyMock to 5.6.0. (markt) +
+ Update Checkstyle to 10.25.0. (markt) +
+ #858: Extend improvements to CVE-2024-56337 protection to + service.bat. Pull request provided by Markus Hoffrogge. + (markt) +
+ Use the full path when the installer for Windows sets calls + icacls.exe to set file permissions. (markt) +
+ Improvements to Japanese translations provided by tak7iji. (markt) +

2025-05-13 Tomcat 9.0.105 (remm)

Catalina

+ 69588: Enable allowLinking to be set on + PreResources, JarResources and + PostResources. If not set explicitly, the setting will be + inherited from the Resources. (markt) +
+ 69633: Add support for Filters using context root mappings. + (markt) +
+ #843: Fix off by one validation logic for partial PUT ranges + and associated test case. Submitted by Chenjp. (remm) +
+ Replace the unused buffer in + org.apache.catalina.connector.InputBuffer with a static, + zero length buffer. (markt) +
+ Refactor GCI servlet to access resources via the + WebResource API. (markt) +
+ 69662: Report name in exception message when a naming lookup + failure occurs. Based on code submitted by Donald Smith. (remm) +
+ Ensure that the FORM authentication attribute + authenticationSessionTimeout works correctly when sessions + have an infinite timeout when authentication starts. (markt) +
+ Provide a content type based on file extension when web application + resources are accessed via a URL. (markt) +

Coyote

+ Refactor the SavedRequestInputFilter so the buffered data + is used directly rather than copied. (markt) +

Jasper

+ 69635: Add support to javax.el.ImportHandler + for resolving inner classes. (markt) +
+ #842Add support for optimized execution of c:set and c:remove tags, when + activated via JSP servlet param useNonstandardTagOptimizations. + (jengebr) +
+ Fix an edge case compilation bug for JSP and tag files on case + insensitive file systems that was exposed by the test case for + 69635. (markt) +

Web applications

+ 68876: Documentation. Update the UML diagrams for server + start-up, request processing and authentication using PlantUML and + include the source files for each diagram. (markt) +

Other

+ Update Jacoco to 0.8.13. (remm) +
+ Explicitly set the locale to be used for Javadoc. For official releases, + this locale will be English (US) to support reproducible builds. +
+ Update Byte Buddy to 1.17.5. (markt) +
+ Update Checkstyle to 10.23.1. (markt) +
+ Update file extension to media type mappings to align with the current + list used by the Apache Web Server (httpd). (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations provided by tak7iji. (markt) +

2025-04-09 Tomcat 9.0.104 (remm)

Catalina

+ Fix use of SSS in SimpleDateFormat + pattern for AccessLogValve. (rjung) +
+ Process possible path parameters rewrite production in the rewrite + valve. (remm) +
+ 69643: Optimize directory listing for large amount of files. + Patch submitted by Loic de l'Eprevier. (remm) +

Other

+ Set sun.io.useCanonCaches in service.bat + Based on pull request #841 by Paul Lodge. (remm) +
+ The minimum Java version to build a release is now Java 22, mirroring + Tomcat 10.1. This removes the need for using a + java-ffm.home property. (remm) +

not released Tomcat 9.0.103 (remm)

Catalina

+ Return 400 if the amount of content sent for a partial PUT is + inconsistent with the range that was specified. (remm) +
+ Add a new RateLimiter implementation, + org.apache.catalina.util.ExactRateLimiter, that can be used + with org.apache.catalina.filters.RateLimitFilter to provide + rate limit based on the exact values configured. Based on pull request + #794 by Chenjp. (markt) +
+ Fix parsing of the time-taken token in the + ExtendedAccessLogValve. (remm) +
+ Fix invocation of the FFM OpenSSL code for setting a SSL engine and + FIPS mode. (remm) +
+ 69600: Add IPv6 local addresses (RFC 4193 and RFC 4291) to + the default internal proxies for the RemoteIpFilter and RemoteIpValve. + (markt) +
+ 69615: Improve integration with the not found class resources + cache for users who are using a custom web application class loader + and/or using reflection to dynamically add external repositories to the + web application class loader. (markt) +
+ Add a new initialisation parameter to the Default servlet - + allowPostAsGet - which controls whether a direct request + (i.e. not a forward or an include) for a static resource using the POST + method will be processed as if the GET method had been used. If not + allowed, the request will be rejected. The default behaviour of + processing the request as if the GET method had been used is unchanged. + (markt) +
+ 69623: Correct a long standing regression that meant that + calls to ClassLoader.getResource().getContent() failed when + made from within a web application with resource caching enabled. + (markt) +
+ 69634: Avoid NPE on JsonErrorReportValve. + (remm) +
+ Add missing throwable stack trace to + JsonErrorReportValve equivalent to the one from + ErrorReportValve. (remm) +
+ Improve the handling of %nn URL encoding in the + RewriteValve and document how %nn URL encoding may be used + with rewrite rules. (markt) +
+ Fix a potential exception when calling + WebappClassLoaderBase.getResource(""). (markt) +

Coyote

+ 69607: Allow failed initialization of MD5. Based on code + submitted by Shivam Verma. (remm) +
+ 69614: HTTP/2 priority frames with an invalid priority field + value should be ignored. (markt) +
+ Improve handling of unexpected errors during HTTP/2 processing. (markt) +
+ Add missing code to process an OpenSSL profile, such as + PROFILE=SYSTEM, using FFM. (remm) +
+ Simplify the process of using a custom SSLContext for an HTTPS enabled + connector. Based on pull request #805 by Hakky54. (markt) +

Jasper

+ Replace custom URL encoding provided by the JSP runtime library with + calls to java.net.URLEncoder.encode(). (markt) +
+ Add compiler using the Java Compiler API, supporting + exploded web applications. The compilerClassName to use is + org.apache.jasper.compiler.JavaCompiler. (remm) +
+ Add support for specifying Java 25 (with the value 25) as + the compiler source and/or compiler target for JSP compilation. If used + with an Eclipse JDT compiler version that does not support these values, + a warning will be logged and the default will be used. + (markt) +

Cluster

+ Fix resetting cross context sessions in the + ReplicationValve. (remm) +

Web applications

+ Documentation. Add a link to the Log4j documentation that describes how + to use Log4j rather than JULI for Tomcat's internal logging. (markt) +
+ Documentation. Document the runtime attributes available to web + applications via the Request or the ServletContext. Based on pull + request #832 by usmazat. (markt) +

Other

+ Revert JSign to 6.0 to avoid a file locking issue. (markt) +
+ Update to NSIS 3.11. (markt) +
+ Update to ByteBuddy 1.17.4. (markt) +
+ Update to Checkstyle 10.21.4. (markt) +
+ Update to SpotBugs to 4.9.3. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations provided by tak7iji. (markt) +

2025-03-06 Tomcat 9.0.102 (remm)

Catalina

+ Weak etags in the If-Range header should not match as + strong etags are required. (remm) +

not released Tomcat 9.0.101 (remm)

Catalina

+ When looking up class loader resources by resource name, the resource + name should not start with '/'. If the resource name does start with + '/', Tomcat is lenient and looks it up as if the '/' was not present. + When the web application class loader was configured with external + repositories and names starting with '/' were used for lookups, it was + possible that cached 'not found' results could effectively hide lookup + results using the correct resource name. (markt) +
+ Enable the JNDIRealm to validate credentials provided to + HttpServletRequest.login(String username, String password) + when the realm is configured to use GSSAPI authentication. (markt) +
+ Fix a bug in the JRE compatibility detection that incorrectly identified + Java 19 and Java 20 as supporting Java 21 features. (markt) +
+ Improve the checks for exposure to and protection against CVE-2024-56337 + so that reflection is not used unless required. The checks for whether + the file system is case sensitive or not have been removed. (markt) +
+ Avoid scenarios where temporary files used for partial PUT would not + be deleted. (remm) +
+ 69602: Fix regression in releases from 12-2024 that were too + strict and rejected weak etags in the If-Range header. + (remm) +

Coyote

+ 69575: Avoid using compression if a response is already + compressed using compress, deflate or + zstd. (remm) +
+ Use Transfer-Encoding for compression rather than + Content-Encoding if the client submits a TE + header containing gzip. (remm) +
+ Fix a race condition in the handling of HTTP/2 stream reset that could + cause unexpected 500 responses. (markt) +

Cluster

+ 69598: Add detection of service account token changes to the + KubernetesMembershipProvider implementation and reload the + token if it changes. Based on a patch by Miroslav Jezbera. (markt) +

Other

+ Add makensis as an option for building the Installer for + Windows on non-Windows platforms. (rjung/markt) +
+ Update Byte Buddy to 1.17.1. (markt) +
+ Update Checkstyle to 10.21.3. (markt) +
+ Update SpotBugs to 4.9.1. (markt) +
+ Update JSign to 7.1. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2025-02-17 Tomcat 9.0.100 (remm)

Catalina

+ 69576: Avoid possible failure initializing + JreCompat due to uncaught exception introduced for the + check for CVE-2024-56337. (remm) +

Other

+ Add org.apache.juli.JsonFormatter to format log as one + line JSON documents. (remm) +

2025-02-10 Tomcat 9.0.99 (remm)

Catalina

+ Add tableName configuration on the + DataSourcePropertyStore that may be used by the WebDAV + Servlet. (remm) +
+ Improve HTTP If headers processing according to RFC 9110. Based on pull + request #796 by Chenjp. (remm/markt) +
+ Allow readOnly attribute configuration on the + Resources element and allow configure the + readOnly attribute value of the main resources. The + attribute value will also be used by the default and WebDAV Servlets. + (remm) +
+ 69285: Optimise the creation of the parameter map for + included requests. Based on sample code and test cases provided by John + Engebretson. (markt) +
+ 69527: Avoid rare cases where a cached resource could be set + with 0 content length, or could be evicted immediately. (remm) +
+ Fix possible edge cases (such as HTTP/1.0) with trying to detect + requests without body for WebDAV LOCK and PROPFIND. (remm) +
+ 69528: Add multi-release JAR support for the + bloom archiveIndexStrategy of the + Resources. (remm) +
+ Improve checks for WEB-INF and META-INF in + the WebDAV servlet. Based on a patch submitted by Chenjp. (remm) +
+ Add a check to ensure that, if one or more web applications are + potentially vulnerable to CVE-2024-56337, the JVM has been configured to + protect against the vulnerability and to configure the JVM correctly if + not. Where one or more web applications are potentially vulnerable to + CVE-2004-56337 and the JVM cannot be correctly configured or it cannot + be confirmed that the JVM has been correctly configured, prevent the + impacted web applications from starting. (markt) +
+ Remove unused session to client map from + CrawlerSessionManagerValve. Submitted by Brian Matzon. + (remm) +
+ When using the WebDAV servlet with serveSubpathOnly set to + true, ensure that the destination for any requested WebDAV + operation is also restricted to the sub-path. (markt) +
+ Generate an appropriate Allow HTTP header when the Default + servlet returns a 405 (method not allowed) response in response to a + DELETE request because the target resource cannot be + deleted. Pull request #802 provided by Chenjp. (markt) +
+ Refactor creation of RequestDispatcher instances so that + the processing of the provided path is consistent with normal request + processing. (markt) +
+ Add encodedReverseSolidusHandling and + encodedSolidusHandling attributes to Context to provide + control over the handling of the path used to created a + RequestDispatcher. (markt) +
+ Handle a potential NullPointerException after an + IOException occurs on a non-container thread during + asynchronous processing. (markt) +
+ Enhance lifecycle of temporary files used by partial PUT. (remm) +

Coyote

+ Don't log warnings for registered HTTP/2 settings that Tomcat does not + support. These settings are now silently ignored. (markt) +
+ Avoid a rare NullPointerException when recycling the + Http11InputBuffer. (markt) +
+ Lower the log level to debug for logging an invalid socket channel when + processing poller events for the NIO Connector as this may occur in + normal usage. (markt) +
+ Clean-up references to the HTTP/2 stream once request processing has + completed to aid GC and reduce the size of the HTTP/2 recycled request + and response cache. (markt) +
+ Add a new Connector configuration attribute, + encodedReverseSolidusHandling, to control how + %5c sequences in URLs are handled. The default behaviour is + unchanged (decode) keeping in mind that the + allowBackslash attribute determines how the decoded + URI is processed. (markt) +
+ 69545: Improve CRLF skipping for the available + method of the ChunkedInputFilter. (remm) +
+ Improve the performance of repeated calls to getHeader(). + Pull request #813 provided by Adwait Kumar Singh. (markt) +
+ 69559: Ensure that the Java 24 warning regarding the use of + sun.misc.Unsafe::invokeCleaner is only reported by the JRE + when the code will be used. (markt) +

Jasper

+ 69508: Correct a regression in the fix for 69382 + that broke JSP include actions if both the page attribute and the body + contained parameters. Pull request #803 provided by Chenjp. + (markt) +
+ 69521: Update the EL Parser to allow the full range of valid + characters in an EL identifier as defined by the Java Language + Specification. (markt) +
+ 69532: Optimise the creation of + ExpressionFactory instances. Patch provided by John + Engebretson. (markt) +

Web applications

+ Documentation. Expand the description of the security implications of + setting mapperContextRootRedirectEnabled and/or + mapperDirectoryRedirectEnabled to true. + (markt) +
+ Documentation. Better document the default for the + truststoreProvider attribute of a + SSLHostConfig element. (markt) +

Other

+ Update to Commons Daemon 1.4.1. (markt) +
+ Update the internal fork of Commons Pool to 2.12.1. (markt) +
+ Update Byte Buddy to 1.16.1. (markt) +
+ Update UnboundID to 7.0.2. (markt) +
+ Update Checkstyle to 10.21.2. (markt) +
+ Update SpotBugs to 4.9.0. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Chinese translations by leeyazhou. (markt) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2024-12-09 Tomcat 9.0.98 (remm)

Catalina

+ Add option to serve resources from subpath only with WebDAV Servlet like + with DefaultServlet. (michaelo) +
+ Add special handling for the protocols attribute of + SSLHostConfig in storeconfig. (remm) +
+ 69442: Fix case sensitive check on content-type + when parsing request parameters. (remm) +
+ Refactor duplicate code for extracting media type and subtype from + content-type into a single method. (markt) +
+ Compatibility of generated embedded code with components where + constructors or property related methods throw a checked exception. + (remm) +
+ The previous fix for inconsistent resource metadata during concurrent + reads and writes was incomplete. (markt) +
+ 69444: Ensure that the + javax.servlet.error.message request attribute is set when + an application defined error page is called. (markt) +
+ Avoid quotes for numeric values in the JSON generated by the status + servlet. (remm) +
+ Add strong ETag support for the WebDAV and default servlet, which can + be enabled by using the useStrongETags init parameter with + a value set to true. The ETag generated will be a SHA-1 + checksum of the resource content. (remm) +
+ Use client locale for directory listings. (remm) +
+ 69439: Improve the handling of multiple + Cache-Control headers in the ExpiresFilter. + Based on pull request #777 by Chenjp. (markt) +
+ 69447: Update the support for caching classes the web + application class loader cannot find to take account of classes loaded + from external repositories. Prior to this fix, these classes could be + incorrectly marked as not found. (markt) +
+ 69466: Rework handling of HEAD requests. Headers explicitly + set by users will not be removed and any header present in a HEAD + request will also be present in the equivalent GET request. There may be + some headers, as per RFC 9110, section 9.3.2, that are present in a GET + request that are not present in the equivalent HEAD request. (markt) +
+ 69471: Log instances of CloseNowException caught + by ApplicationDispatcher.invoke() at debug level rather + than error level as they are very likely to have been caused by a client + disconnection or similar I/O issue. (markt) +
+ Add a test case for the fix for 69442. Also refactor + references to application/x-www-form-urlencoded. Based on + pull request #779 by Chenjp. (markt) +
+ 69476: Catch possible ISE when trying to report PUT failure + in the DefaultServlet. (remm) +
+ Add support for RateLimit + header fields for HTTP (draft) in the RateLimitFilter. + Based on pull request #775 provided by Chenjp. (markt) +
+ #787: Add regression tests for 69478. Pull request + provided by Thomas Krisch. (markt) +
+ The default servlet now rejects HTTP range requests when two or more of + the requested ranges overlap. Based on pull request #782 + provided by Chenjp. (markt) +
+ Enhance Content-Range verification for partial PUT requests handled by + the default servlet. Provided by Chenjp in pull request #778. + (markt) +
+ Harmonize DataSourceStore lookup in the global resources + to optionally avoid the comp/env prefix which is usually + not used there. (remm) +
+ As required by RFC 9110, the HTTP Range header will now + only be processed for GET requests. Based on pull request + #790 provided by Chenjp. (markt) +
+ Deprecate the useAcceptRanges initialisation parameter for + the default servlet. It will be removed in Tomcat 12 onwards where it + will effectively be hard coded to true. (markt) +
+ Add DataSource based property storage for the + WebdavServlet. (remm) +

Coyote

+ Align encodedSolidusHandling with the Servlet + specification. If the pass-through mode is used, any + %25 sequences will now also be passed through to avoid + errors and/or corruption when the application decodes the path. (markt) +

Jasper

+ Further optimise EL evaluation of method parameters. Patch provided by + Paolo B. (markt) +
+ Follow-up to the fix for 69381. Apply the optimisation for + method lookup performance in expression language to an additional + location. (markt) +

Web applications

+ Documentation. Remove references to the ResourceParams + element. Support for ResourceParams was removed in Tomcat + 5.5.x. (markt) +
+ Documentation. 69477: Correct name of attribute for + RemoteIPFilter. The attribute is + internalProxies rather than + allowedInternalProxies. Pull request #786 provided + by Jorge Díaz. (markt) +
+ Examples. Fix broken links when Servlet Request Info example is called + via a URL that includes a pathInfo component. (markt) +
+ Examples. Expand the obfuscation of session cookie values in the request + header example to JSON responses. (markt) +
+ Examples. Add the ability to delete session attributes in the servlet + session example. (markt) +
+ Examples. Add a hard coded limit of 10 attributes per session for the + servlet session example. (markt) +
+ Examples. Add the ability to delete session attributes and add a hard + coded limit of 10 attributes per session for the JSP form authentication + example. (markt) +
+ Examples. Limit the shopping cart example to only allow adding the + pre-defined items to the cart. (markt) +
+ Examples. Remove JSP calendar example. (markt) +

Other

+ 69465: Fix warnings during native image compilation using the + Tomcat embedded JARs. (markt) +
+ Update Tomcat's fork of Commons DBCP to 2.13.0. (markt) +
+ Update EasyMock to 5.5.0. (markt) +
+ Update Checkstyle to 10.20.2. (markt) +
+ Update BND to 7.1.0. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Korean translations. (markt) +
+ Improvements to Chinese translations. (markt) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2024-11-09 Tomcat 9.0.97 (remm)

Catalina

+ Add support for the new Servlet API method + HttpServletResponse.sendEarlyHints(). (markt) +
+ 55470: Add debug logging that reports the class path when a + ClassNotFoundException occurs in the digester or the web + application class loader. Based on a patch by Ralf Hauser. (markt) +
+ 69374: Properly separate between table header and body + in DefaultServlet's listing. (michaelo) +
+ 69373: Make DefaultServlet's HTML listing + file last modified rendering better (flexible). (michaelo) +
+ Improve HTML output of DefaultServlet. (michaelo) +
+ Refactor RateLimitFilter to use FilterBase as + the base class. The primary advantage for doing this is less code to + process init-param values. (markt) +
+ 69370: DefaultServlet's HTML listing + uses incorrect labels. (michaelo) +
+ Avoid NPE in CrawlerSessionManagerValve for partially + mapped requests. (remm) +
+ Add missing WebDAV Lock-Token header in the response when + locking a folder. (remm) +
+ Invalid WebDAV lock requests should be rejected with 400. (remm) +
+ Fix regression in WebDAV when attempting to unlock a collection. (remm) +
+ Verify that destination is not locked for a WebDAV copy operation. + (remm) +
+ Send 415 response to WebDAV MKCOL operations that include + a request body since this is optional and unsupported. (remm) +
+ Enforce DAV: namespace on WebDAV XML elements. (remm) +
+ Do not allow a new WebDAV lock on a child resource if a parent + collection is locked (RFC 4918 section 6.1). (remm) +
+ WebDAV DELETE should remove any existing lock on + successfully deleted resources. (remm) +
+ Remove WebDAV lock null support in accordance with RFC 4918 section 7.3 + and annex D. Instead a lock on a non existing resource will create an + empty file locked with a regular lock. (remm) +
+ Rewrite implementation of WebDAV shared locks to comply with RFC 4918. + (remm) +
+ Implement WebDAV If header using code from the Apache + Jackrabbit project. (remm) +
+ Add PropertyStore interface in the WebDAV Servlet, + to allow implementation of dead properties storage. The store used + can be configured using the propertyStore init parameter + of the WebDAV servlet by specifying the class name of the store. A + simple non persistent implementation is used if no custom store is + configured. (remm) +
+ Implement WebDAV PROPPATCH method using the newly added + PropertyStore, and update PROPFIND to support + it. (remm) +
+ Cache not found results when searching for web application class loader + resources. This addresses performance problems caused by components such + as java.sql.DriverManager which, in some circumstances, + will search for the same class repeatedly. In a large web application + this can cause performance problems. The size of the cache can be + controlled via the new notFoundClassResourceCacheSize on + the StandardContext. (markt) +
+ Stop after INITIALIZED state should be a noop since it is + possible for subcomponents to be in FAILED after init. + (remm) +
+ Fix incorrect web resource cache size calculations when there are + concurrent PUT and DELETE requests for the + same resource. (markt) +
+ Add debug logging for the web resource cache so the current size can be + tracked as resources are added and removed. (markt) +
+ Replace legacy WebDAV opaquelocktoken: scheme for lock + tokens with urn:uuid: as recommended by RFC 4918, and + remove secret init parameter. (remm) +
+ Concurrent reads and writes (e.g. GET and PUT + / DELETE) for the same path caused corruption of the + FileResource where some of the fields were set as if the + file exists and some were set as if it does not. This resulted in + inconsistent metadata. (markt) +
+ 69415: Ensure that the ExpiresFilter only sets + cache headers on GET and HEAD requests. Also + skip requests where the application has set Cache-Control: + no-store. (markt) +
+ 69419: Improve the performance of + ServletRequest.getAttribute() when there are multiple + levels of nested includes. Based on a patch provided by John + Engebretson. (markt) +
+ All applications to send an early hints informational response by + calling HttpServletResponse.sendError() with a status code + of 103. (schultz) +

Coyote

+ Return null SSL session id on zero length byte array returned from the + SSL implementation. (remm) +
+ Skip OpenSSLConf with BoringSSL since it is unsupported. (remm) +
+ Create the HttpParser in Http11Processor + if it is not present on the AbstractHttp11Protocol + to provide better lifecycle robustness for regular HTTP/1.1. The new + behavior was introduced on a previous refactoring to improve HTTP/2 + performance. (remm) +
+ OpenSSLContext will now throw a + KeyManagementException if something is known to have gone + wrong in the init method, which is the behavior + documented by javax.net.ssl.SSLContext.init. This makes + error handling more consistent. (remm) +

Jasper

+ Add back tag release method as deprecated in the runtime for compat + with old generated code. (remm) +
+ 69399: Fix regression caused by the improvement + 69333 which caused the tag release to be called + when using tag pooling, and to be skipped when not using it. + Patch submitted by Michal Sobkiewicz. (remm) +
+ 69381: Improve method lookup performance in expression + language. When the required method has no arguments there is no need to + consider casting or coercion and the method lookup process can be + simplified. Based on pull request #770 by John Engebretson. + (markt) +
+ 69382: Improve the performance of the JSP include action by + re-using results of relatively expensive method calls in the generated + code rather than repeating them. Patch provided by John Engebretson. + (markt) +
+ 69398: Avoid unnecessary object allocation in + PageContextImpl. Based on a suggestion by John Engebretson. + (markt) +
+ 69406: When using StringInterpreterEnum, do not + throw an IllegalArgumentException when an invalid + Enum is encountered. Instead, resolve the value at runtime. + Patch provided by John Engebretson. (markt) +
+ 69429: Optimise EL evaluation of method parameters for + methods that do not accept any parameters. Patch provided by John + Engebretson. (markt) +

Other

+ Switch from DigiCert ONE to ssl.com eSigner for code signing. (markt) +
+ Update Byte Buddy to 1.15.10. (markt) +
+ Update CheckStyle to 10.20.0. (markt) +
+ Improvements to German translations. (remm) +

2024-10-08 Tomcat 9.0.96 (remm)

Catalina

+ Ensure that the Jakarta Authentication CallbackHandler only + creates one GenericPrincipal in the Subject. + (markt) +
+ If the Jakarta Authentication process fails with an Exception, + explicitly set the HTTP response status to 500 as the + ServerAuthContext may not have set it. (markt) +
+ When persisting the Jakarta Authentication provider configuration, + create any necessary parent directories that don't already exist. + (markt) +
+ Correct the logic used to detect errors when deleting temporary files + associated with persisting the Jakarta Authentication provider + configuration. (markt) +
+ When processing Jakarta Authentication callbacks, don't overwrite a + Principal obtained from the PasswordValidationCallback with + null if the CallerPrincipalCallback does not + provide a Principal. (markt) +
+ Avoid store config backup loss when storing one configuration more than + once per second. (remm) +
+ 69359: WebdavServlet duplicates + getRelativePath() method from super class with + incorrect Javadoc. (michaelo) +
+ 69360: Inconsistent DELETE behavior between + WebdavServlet and DefaultServlet. + (michaelo) +
+ Make WebdavServlet properly return the Allow + header when deletion of a resource is not allowed. (michaelo) +
+ Add log warning if non wildcard mappings are used with the + WebdavServlet. (remm) +
+ 69361: Ensure that the order of entires in a multi-status + response to a WebDAV is consistent with the order in which resources + were processed. (markt) +
+ 69362: Provide a better multi-status response when deleting a + collection via WebDAV fails. Empty directories that cannot be deleted + will now be included in the response. (markt) +
+ 69363: Use getPathPrefix() consistently in the + WebDAV servlet to ensure that the correct path is used when the WebDAV + servlet is mounted at a sub-path within the web application. (markt) +

Coyote

+ 69316: Ensure that + FastHttpDateFormat#getCurrentDate() (used to generate Date + headers for HTTP responses) generates the correct string for the given + input. Prior to this change, the output may have wrong by one second in + some cases. Pull request #751 provided by Chenjp. (markt) +
+ Add server and serverRemoveAppProvidedValues + to the list of attributes the HTTP/2 protocol will inherit from the + HTTP/1.1 connector it is nested within. (markt) +
+ Avoid possible crashes when using Apache Tomcat Native, caused by + destroying SSLContext objects through GC after APR has been terminated. + (remm) +
+ Improve HTTP/2 handling of trailer fields for requests. Trailer fields + no longer need to be recieved before the headers of the subsequent + stream nor are trailer fields for an in progress stream swallowed if the + Connector is paused before the trailer fields are received. (markt) +
+ Ensure the request and response are not recycled too soon for an HTTP/2 + stream when a stream level error is detected during the processing of + incoming HTTP/2 frames. This could lead to incorrect processing times + appearing in the access log. (markt) +

Jasper

+ 69333: Remove unnecessary code from generated JSPs. (markt) +
+ 69338: Improve the performance of processing expressions that + include AND or OR operations with more than two operands and expressions + that use not empty. (markt) +
+ 69348: Reduce memory consumption in ELContext by + using lazy initialization for the data structure used to track lambda + arguments. (markt) +

Web applications

+ The manager webapp will now be able to access certificates again when + OpenSSL is used. (remm) +

Other

+ Update Byte Buddy to 1.15.3. (markt) +
+ Update CheckStyle to 10.18.2. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +
+ Improvements to Chinese translations by Ch_jp. (markt) +

2024-09-17 Tomcat 9.0.95 (remm)

Coyote

+ Fix 69320, a regression in the fix for 69302 that + meant the HTTP/2 processing was likely to be broken for all clients once + any client sent an HTTP/2 reset frame. (markt) +

2024-09-10 Tomcat 9.0.94 (remm)

Catalina

+ Improve performance of + ApplicationHttpRequest.parseParameters(). Based on sample + code and test cases provided by John Engebretson. (markt) +

Coyote

+ Correct a regression in the fix for non-blocking reads of chunked + request bodies that caused InputStream.available() to + return a non-zero value when there was no data to read. In some + circumstances this could cause a blocking read to block waiting for more + data rather than return the data it had already received. (markt) +
+ Add a new attribute cookiesWithoutEquals to the + Rfc6265CookieProcessor. The default behaviour is unchanged. + (markt) +
+ Ensure that Tomcat sends a TLS close_notify message after receiving one + from the client when using the OpenSSLImplementation. + (markt) +
+ 69301: Fix trailer headers replacing non-trailer headers when + writing response headers to the access log. Based on a patch and test + case provided by hypnoce. (markt) +
+ 69302: If an HTTP/2 client resets a stream before the request + body is fully written, ensure that any ReadListener is + notified via a call to ReadListener.onErrror(). (markt) +

Jasper

+ Switch the TldScanner back to logging detailed scan + results at debug level rather than trace level. (markt) +

WebSocket

+ If a blocking message write exceeds the timeout, don't attempt the write + again before throwing the exception. (markt) +
+ An EncodeException being thrown during a message write should not + automatically cause the connection to close. The application should + handle the exception and make the decision whether or not to close the + connection. (markt) +

Web applications

+ Documentation. Align the logging configuration documentation with the + current defaults. (markt) +

jdbc-pool

+ 69255: Correct a regression in the fix for 69206 + that meant exceptions executing statements were wrapped in an + java.lang.reflect.UndeclaredThrowableException rather than + the application seeing the original SQLException. Fixed + by pull request #744 provided by Michael Clarke. (markt) +
+ 69279: Correct a regression in the fix for 69206 + that meant that methods that previously returned a null + ResultSet were returning a proxy with a null delegate. + Fixed by pull request #745 provided by Huub de Beer. (markt) +

Other

+ Exclude the tomcat-coyote-ffm.jar from JAR scanning by + default. (markt) +
+ Change the default log handler level to ALL so log messages + are not dropped by default if a logger is configured to use trace + (FINEST) level logging. (markt) +
+ Update Hamcrest to 3.0. (markt) +
+ Update EasyMock to 5.4.0. (markt) +
+ Update Byte Buddy to 1.15.0. (markt) +
+ Update CheckStyle to 10.18.0. (markt) +
+ Update the internal fork of Apache Commons BCEL to 6.10.0. (markt) +
+ Improvements to Spanish translations by Fernando. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2024-08-06 Tomcat 9.0.93 (remm)

Coyote

+ Correct regressions in the refactoring that added recycling of the + coyote request and response to the HTTP/2 processing. (markt) +

not released Tomcat 9.0.92 (remm)

Catalina

+ Add support for RFC 8297 (Early Hints). Applications can use this + feature by casting the HttpServletResponse to + org.apache.catalina.connector.Reponse and then calling the + method void sendEarlyHints(). This method will be added to + the Servlet API (removing the need for the cast) in Servlet 6.2 onwards. + (markt) +
+ 69214: Do not reject a CORS request that uses POST but does + not include a content-type header. Tomcat now correctly + processes this as a simple CORS request. Based on a patch suggested by + thebluemountain. (markt) +
+ Refactor SpnegoAuthenticator so it uses + Subject.callAs() rather than Subject.doAs() + when the available. (markt) +

Coyote

+ Add OpenSSL integration using the FFM API rather than Tomcat Native. + OpenSSL support may be enabled by adding the + org.apache.catalina.core.OpenSSLLifecycleListener + listener on the Server element when using Java 22 + or later. (remm) +
+ Ensure that HTTP/2 stream input buffers are only created when there is a + request body to be read. (markt) +
+ Refactor creation of HttpParser instances from the Processor level to + the Protocol level since the parser configuration depends on the + protocol and the parser is, otherwise, stateless. (markt) +
+ Align HTTP/2 with HTTP/1.1 and recycle the container internal request + and response processing objects by default. This behaviour can be + controlled via the new discardRequestsAndResponses + attribute on the HTTP/2 upgrade protocol. (markt) +

jdbc-pool

+ 69206: Ensure statements returned from Statement + methods executeQuery(), getResultSet() and + getGeneratedKeys() are correctly wrapped before being + returned to the caller. Based on pull request #742 provided by + Michael Clarke. +

Other

+ Fix packaging regression with missing osgi information following + addition of the test-only build target. (remm) +
+ Update Tomcat Native to 1.3.1. (markt) +
+ Update Byte Buddy to 1.14.18. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2024-07-08 Tomcat 9.0.91 (remm)

Catalina

+ Allow JAASRealm to use the configuration source to load a + configured configFile, for easier use with testing. (remm) +
+ Add missing algorithm callback to the JAASCallbackHandler. + (remm) +
+ 69131: Expand the implementation of the filter + value of the Authenticator attribute allowCorsPreflight, so + that it applies to all requests that match the configured URL patterns + for the CORS filter, rather than only applying if the CORS filter is + mapped to /*. (markt) +

Coyote

+ Improve the algorithm used to identify the IP address to use to unlock + the acceptor thread when a Connector is listening on all local + addresses. Interfaces that are configured for point to point connections + or are not currently up are now skipped. (markt) +
+ 69121: Ensure that the onComplete() event is + triggered if AsyncListener.onError() dispatches to a target + that throws an exception. (markt) +
+ Following the trailer header field refactoring, -1 is no + longer an allowed value for maxTrailerSize. Adjust + documentation accordingly. (remm) +

Jasper

+ Update the optimisation in jakarta.el.ImportHandler so it + is aware of new classes added to the java.lang package in + Java 23. (markt) +
+ Ensure that an exception in toString() still results in an + ELException when an object is coerced to a String using + ExpressionFactory.coerceToType(). (markt) +
+ Add support for specifying Java 24 (with the value 24) as + the compiler source and/or compiler target for JSP compilation. If used + with an Eclipse JDT compiler version that does not support these values, + a warning will be logged and the default will used. + (markt) +
+ 69135: When using include directives in a tag file packaged + in a JAR file, ensure that context relative includes are processed + correctly. (markt) +
+ 69135: When using include directives in a tag file packaged + in a JAR file, ensure that file relative includes are processed + correctly. (markt) +
+ 69135: When using include directives in a tag file packaged + in a JAR file, ensure that file relative includes are are not permitted + to access files outside of the /META_INF/tags/ directory + nor outside of the JAR file. (markt) +

Web applications

+ Fix status servlet detailed view of the connectors when using automatic + port. (remm) +

Other

+ Add test-only build target to allow running only the + testsuite, supporting Java versions down to the minimum supported + to run Tomcat. (rjung) +
+ Update UnboundID to 7.0.1. (markt) +
+ Update to SpotBugs 4.8.6. (markt) +
+ Remove cglib dependency as it is not required by the version of EasyMock + used by the unit tests. (markt) +
+ Update EasyMock to 5.3.0. This adds a test dependency on Byte-Buddy + 1.14.17. (markt) +
+ Improvements to Czech translations by Vladimír Chlup. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +
+ Improvements to Chinese translations by fangzheng. (markt) +

2024-06-19 Tomcat 9.0.90 (remm)

Catalina

+ Add support for shallow copies when using WebDAV. (markt) +
+ Deprecate the WebdavFixFilter as it is no longer required. + (markt) +
+ 69066: Fix regression in SPNEGO authenticator when + processing Base64. Submitted by Daniel Lyko. (remm) +
+ Update minimum recommended version of Tomcat Native to 1.3.0. Pull + request #728 provided by Dimitrios Soumis. (markt) +
+ The system property + org.apache.catalina.connector.RECYCLE_FACADES will now + default to true if not specified, which will in turn set + the default value for the discardFacades connector + attribute, thus causing facade objects to be discarded by default. + (remm) +
+ Add RealmBase.getPrincipal(GSSName, GSSCredential, GSSContext) + for retrieving extended/additional information from an established + GSS context. (michaelo) +
+ Correct a regression in the fix for 68721 that caused some + instances of LinkageError to be reported as + ClassNotFoundException. (markt) +
+ Ensure that static resources deployed via a JAR file remain accessible + when the context is configured to use a bloom filter. Based on pull + request #730 provided by bergander. (markt) +
+ Introduce reference counting so the AprLifecycleListener + is more robust. This particularly targets more complex embedded + configurations with multiple server instances with independent + lifecycles where more than one server instance requires the + AprLifecycleListener. (markt) +

Coyote

+ 69068: Ensure read timouts are triggered for asynchronous, + non-blocking reads when using HTTP/2. (markt) +
+ 69133: Add task queue size configuration on the + Connector element, similar to the Executor + element, for consistency. (remm) +
+ Make counting of active HTTP/2 streams per connection more robust. + (markt) +
+ Add support for TLS 1.3 client initiated re-keying. (markt) +

Jasper

+ 68546: Small additional optimisation for initial loading of + Servlet code generated for JSPs. Based on a suggestion by Dan Armstrong. + (markt) +

Web applications

+ Add the ability to set a sub-title for the Manager web application main + page. This is intended to allow users with lots of instances to easily + distinguish them. Based on pull request #724 by Simon Arame. + (markt) +

Other

+ Revert Derby to 10.16.1.1 as that is the latest version of Derby that + runs on Java 17. (markt) +
+ Update to Commons Daemon 1.4.0. (markt) +
+ Update to Objenesis 3.4. (markt) +
+ Update to Checkstyle 10.17.0. (markt) +
+ Update to SpotBugs 4.8.5. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2024-05-07 Tomcat 9.0.89 (remm)

Catalina

+ Deprecate and remove sessionCounter (replaced by the + addition of the active session count and the expired session count, + as a reasonable approximation) and duplicates (which + does not represent a possible event in current implementations) + statistics from the session manager. (remm) +
+ 68890 Align output encoding of JSPs in the Manager webapp + with the XML declarations in those same files. (schultz) +
+ Update Basic authentication to implement the requirements of RFC 7617 + including the changing of the trimCredentials setting which + is now defaults to false. Note that the + trimCredentials setting will be removed in Tomcat 11. + (markt) +
+ Small performance optimization when logging cookies with no values. + (schultz) +
+ Correct error handling for asynchronous requests. If the application + performs an dispatch during AsyncListener.onError() the + dispatch is now performed rather than completing the request using the + error page mechanism. (markt) +
+ Fix WebDAV lock null (locks for non existing resources) thread safety + and removal. (remm) +
+ Add periodic checking for WebDAV locks expiration. (remm) +
+ Extend Asn1Parser to parse UTF8Strings. (michaelo) +

Coyote

+ Align non-secure and secure writes with NIO and skip the write attempt + when there are no bytes to be written. (markt) +
+ Allow any positive value for socket.unlockTimeout. If a + negative or zero value is configured, the default of 250ms + will be used. (mark) +
+ Reduce the time spent waiting for the connector to unlock. The previous + default of 10s was noticeably too long for cases where the unlock has + failed. The wait time is now 100ms plus twice + socket.unlockTimeout. (markt) +
+ Ensure that the onAllDataRead() event is triggered when the + request body uses chunked encoding and is read using non-blocking IO. + (markt) +
+ 68934: Add debug logging in the latch object when exceeding + maxConnections. (remm) +
+ Refactor trailer field handling to use a MimeHeaders + instance to store trailer fields. (markt) +
+ Ensure that multiple instances of the same trailer field are handled + correctly. (markt) +
+ Fix non-blocking reads of chunked request bodies. (markt) +
+ When an invalid HTTP response header was dropped, an off-by-one error + meant that the first header in the response was also dropped. Fix based + on pull request #710 by foremans. (markt) +

Jasper

+ Add support for specifying Java 23 (with the value 23) as + the compiler source and/or compiler target for JSP compilation. If used + with an Eclipse JDT compiler version that does not support these values, + a warning will be logged and the default will used. + (markt) +

WebSocket

+ 68884: Reduce the write timeout when writing WebSocket close + messages for abnormal closes. The timeout defaults to 50 milliseconds + and may be controlled using the + org.apache.tomcat.websocket.ABNORMAL_SESSION_CLOSE_SEND_TIMEOUT + property in the user properties collection associated with the WebSocket + session. (markt) +

Web applications

+ Examples: Improve performance of WebSocket chat application when + multiple clients disconnect at the same time. (markt) +
+ Examples: Increase the number of previous messages displayed when using + the WebSocket chat application. (markt) +
+ Examples: Improve performance of WebSocket snake application when + multiple clients disconnect at the same time. (markt) +

Other

+ Switch to using the Base64 encoder and decoder provided by the JRE + rather than the version provided by Commons Codec. The internal fork of + Commons Codec has been deprecated and will be removed in Tomcat 11. + (markt) +
+ Update NSIS to 3.10. (mark0t) +
+ Update UnboundID to 7.0.0. (markt) +
+ Update Checkstyle to 10.16.0. (markt) +
+ Update JaCoCo to 0.8.12. (markt) +
+ Update SpotBugs to 4.8.4. (markt) +
+ Update the internal fork of Apache Commons BCEL to 6.9.0. (markt) +
+ Update the internal fork of Apache Commons DBCP to 2.12.0. (markt) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2024-04-16 Tomcat 9.0.88 (remm)

Catalina

+ Add highConcurrencyStatus attribute to the + SemaphoreValve to optionally allow the valve to return an + error status code to the client when a permit cannot be acquired from + the semaphore. (remm) +
+ Add checking of the "age" of the running Tomcat instance since its + build-date to the SecurityListener, and log a warning if the server + is old. (schultz) +
+ When using the AsyncContext, throw an + IllegalStateException, rather than allowing an + NullPointerException, if an attempt is made to use the + AsyncContext after it has been recycled. (markt) +
+ Change the thread-safety mechanism for protecting StandardServer.services + from a simple synchronized lock to a ReentrantReadWriteLock to allow + multiple readers to operate simultaneously. Based upon a suggestion by + Markus Wolfe. (schultz) +
+ Improve Service connectors, Container children and Service executors + access sync using a ReentrantReadWriteLock. (remm) +
+ Improve handling of integer overflow if an attempt is made to upload a + file via the Servlet API and the file is larger than + Integer.MAX_VALUE. (markt) +
+ 68862: Handle possible response commit when processing read + errors. (remm) +

Coyote

+ Add threadsMaxIdleTime attribute to the endpoint, + to allow configuring the amount of time before an internal executor + will scale back to the configured minSpareThreads size. + (remm) +

Jasper

+ Handle the case where the JSP engine forwards a request/response to a + Servlet that uses an OutputStream rather than a + Writer. This was triggering an + IllegalStateException on code paths where there was a + subsequent attempt to obtain a Writer. (markt) +
+ Correctly handle the case where a tag library is packaged in a JAR file + and the web application is deployed as a WAR file rather than an + unpacked directory. (markt) +
+ Prevent the web application's ClassLoader from being pinned by the JSP + compiler if an application uses a custom XMLInputFactory. Based upon a + suggestion from Simon Niederberger. (schultz) +

Other

+ Update Checkstyle to 10.14.1. (markt) +
+ Update the internal fork of Apache Commons BCEL to 6.8.2. (markt) +
+ Update the internal fork of Apache Commons Codec to 1.16.1. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (remm) +
+ Improvements to Chinese translations by leeyazhou. (remm) +

2024-03-14 Tomcat 9.0.87 (remm)

Catalina

+ Minor performance improvement for building filter chains. Based on + ideas from pull request #702 by Luke Miao. (remm) +
+ Align error handling for Writer and + OutputStream. Ensure use of either once the response has + been recycled triggers a NullPointerException provided that + discardFacades is configured with the default value of + true. (markt) +
+ 68692: The standard thread pool implementations that are + configured using the Executor element now implement + ExecutorService for better support NIO2. (remm) +
+ 68495: When restoring a saved POST request after a successful + FORM authentication, ensure that neither the URI, the query string nor + the protocol are corrupted when restoring the request body. (markt) +
+ 68721: Workaround a possible cause of duplicate class + definitions when using ClassFileTransformers and the + transformation of a class also triggers the loading of the same class. + (markt) +
+ The rewrite valve should not do a rewrite if the output is identical + to the input. (remm) +
+ Add a new valveSkip (or VS) rule flag to the + rewrite valve to allow skipping over the next valve in the Catalina + pipeline. (remm) +

Coyote

+ Improve the HTTP/2 stream prioritisation process. If a stream uses all + of the connection windows and still has content to write, it will now be + added to the backlog immediately rather than waiting until the write + attempt for the remaining content. (markt) +
+ Correct a regression in the support for user provided + SSLContext instances that broke the + org.apache.catalina.security.TLSCertificateReloadListener. + (markt) +

Jasper

+ Add support for specifying Java 22 (with the value 22) as + the compiler source and/or compiler target for JSP compilation. If used + with an Eclipse JDT compiler version that does not support these values, + a warning will be logged and the default will used. + (markt) +

Cluster

+ Avoid updating request count stats on async. (remm) +

Other

+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +
+ 57130: Allow digest.(sh|bat) to accept password from a file + or stdin. (csutherl/schultz) +

2024-02-19 Tomcat 9.0.86 (remm)

Catalina

+ Correct JPMS and OSGi meta-data for tomcat-enbed-core.jar + by removing reference to org.apache.catalina.ssi package + that is no longer included in the JAR. Based on pull request + #684 by Jendrik Johannes. (markt) +
+ Fix ServiceBindingPropertySource so that trailing \r\n + sequences are correctly removed from files containing property values + when configured to do so. Bug identified by Coverity Scan. (markt) +
+ Add improvements to the CSRF prevention filter including the ability + to skip adding nonces for resource name and subtree URL patterns. (schultz) +
+ Review usage of debug logging and downgrade trace or data dumping + operations from debug level to trace. (remm) +
+ 68089: Further improve the performance of request attribute + access for ApplicationHttpRequest and + ApplicationRequest. (markt) +
+ 68559: Allow asynchronous error handling to write to the + response after an error during asynchronous processing. (markt) +

Coyote

+ Make asynchronous error handling more robust. Ensure that once a + connection is marked to be closed, further asynchronous processing + cannot change that. (markt) +
+ Make asynchronous error handling more robust. Ensure that once the call + to AsyncListener.onError() has returned to the container, + only container threads can access the AsyncContext. This + protects against various race conditions that would otherwise occur if + application threads continued to access the AsyncContext. +
+ Review usage of debug logging and downgrade trace or data dumping + operations from debug level to trace. In particular, most of the + HTTP/2 debug logging has been changed to trace level. (remm) +
+ Add support for user provided SSLContext instances + configured on SSLHostConfigCertificate instances. Based on + pull request #673 provided by Hakan Altındağ. (markt) +
+ Improve the Tomcat Native shutdown process to reduce the likelihood of a + JVM crash during Tomcat shutdown. (markt) +
+ Partial fix for 68558: Cache the result of converting to + String for request URI, HTTP header names and the request + Content-Type value to improve performance by reducing + repeated byte[] to String conversions. (markt) +
+ Improve error reporting to HTTP/2 clients for header processing errors + by reporting problems at the end of the frame where the error was + detected rather than at the end of the headers. (markt) +
+ Remove the remaining reference to a stream once the stream has been + recycled. This makes the stream eligible for garbage collection earlier + and thereby improves scalability. (markt) +

Jasper

+ 68546: Generate optimal size and types for JSP imports maps, + as suggested by John Engebretson. (remm) +
+ Review usage of debug logging and downgrade trace or data dumping + operations from debug level to trace. (remm) +

WebSocket

+ Correct a regression in the fix for 66508 that could cause an + UpgradeProcessor leak in some circumstances. (markt) +
+ Review usage of debug logging and downgrade trace or data dumping + operations from debug level to trace. (remm) +
+ Ensure that WebSocket connection closure completes if the connection is + closed when the server side has used the proprietary suspend/resume + feature to suspend the connection. (markt) +

Web applications

+ Add support for responses in JSON format from the examples application + RequestHeaderExample. (schultz) +

Other

+ Update Checkstyle to 10.13.0. (markt) +
+ Update JSign to 6.0. (markt) +
+ Add strings for debug level messages. (remm) +
+ Update Tomcat Native to 1.3.0. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2024-01-09 Tomcat 9.0.85 (remm)

Catalina

+ 68378: Align extension to MIME type mappings in the global + web.xml with those in httpd by adding + application/vnd.geogebra.slides for ggs, + text/javascript for mjs and + audio/ogg for opus. (markt) +

Coyote

+ Refactor the VirtualThreadExecutor so that it can be used + by the NIO2 connector which was using platform threads even when + configured to use virtual threads. (markt) +
+ Correct a regression in the fix for 67675 that broke TLS key + file parsing for PKCS#8 format keys that do not specify an explicit + pseudo-random function and rely on the default. This typically affects + keys generated by OpenSSL 1.0.2. (markt) +
+ Allow multiple operations with the same name on introspected mbeans, + fixing a regression caused by the introduction of a second + addSslHostConfig method. (remm) +
+ Relax the check that the HTTP Host header is consistent with the host + used in the request line, if any, to make the check case insensitive + since host names are case insensitive. (markt) +
+ 68348: Add support for the partitioned attribute for cookies. + (markt) +

Web Applications

+ 68035: Additional fix to the Manager application to enable + the deployment of a web application located in a Host's + appBase where the web application is specified by a bare + (no path) WAR or directory name as shown in the documentation. (markt) +

Other

+ Update Checkstyle to 10.12.7. (markt) +
+ Update SpotBugs to 4.8.3. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2023-12-12 Tomcat 9.0.84 (remm)

Catalina

+ Background processes should not be run concurrently with lifecycle + operations of a container. (remm) +
+ Correct unintended escaping of XML in some WebDAV responses. The XML + list of support locks when provided in response to a PROPFIND request + was incorrectly XML escaped. (markt) +
+ 68227: Ensure that AsyncListener.onComplete() is + called if AsyncListener.onError() calls + AsyncContext.dispatch(). (markt) +
+ 68228: Use a 408 status code if a read timeout occurs during + HTTP request processing. Includes a test case based on code provided by + adwsingh. (markt) +

Jasper

+ 68119: Refactor the CompositeELResolver to + improve performance during type conversion operations. (markt) +

Web Applications

+ Examples. Improve the error handling so snakes associated with a user + that drops from the network are removed from the game. (markt) +

Other

+ Update UnboundID to 6.0.11. (markt) +
+ Update Checkstyle to 10.12.5. (markt) +
+ Update SpotBugs to 4.8.2. (markt) +
+ Update Derby to 10.17.1. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +
+ Improvements to Brazilian Portuguese translations by John William + Vicente. (markt) +
+ Improvements to Russian translations by usmazat and remm. (markt) +

2023-11-15 Tomcat 9.0.83 (remm)

Catalina

+ 67667: TLSCertificateReloadListener prints + unreadable rendering of X509Certificate#getNotAfter(). + (michaelo) +
+ The status servlet included in the manager webapp can now output + statistics as JSON, using the JSON=true URL parameter. + (remm) +
+ Optionally allow ServiceBindingPropertySource to trim a trailing newline + from a file containing a property-value. (schultz) +
+ 67793: Ensure the original session timeout is restored after + FORM authentication if the user refreshes a page during the FORM + authentication process. Based on a suggestion by Mircea Butmalai. + (markt) +
+ 67926: PEMFile prints unidentifiable string + representation of ASN.1 OIDs. (michaelo) +
+ 66875: Ensure that setting the request attribute + jakarta.servlet.error.exception is not sufficient to + trigger error handling for the current request and response. (markt) +
+ 68054: Avoid some file canonicalization calls introduced + by the fix for 65433. (remm) +
+ 68089: Improve performance of request attribute access for + ApplicationHttpRequest and ApplicationRequest. + (markt) +
+ Use a 400 status code to report an error due to a bad request (e.g. an + invalid trailer header) rather than a 500 status code. (markt) +
+ Ensure that an IOException during the reading of the + request triggers always error handling, regardless of whether the + application swallows the exception. (markt) +

Coyote

+ 66670: Add + SSLHostConfig#certificateKeyPasswordFile and + SSLHostConfig#certificateKeystorePasswordFile. (michaelo) +
+ When calling + SSLHostConfigCertificate.setCertificateKeystore(ks), + automatically call + setCertificateKeystoreType(ks.getType()). (markt) +
+ 67628: Clarify how the ciphers attribute of the + SSLHostConfig is used. (markt) +
+ 67666: Ensure TLS connectors using PEM files either work with + the TLSCertificateReloadListener or, in the rare case that + they do not, log a warning on Connector start. (markt) +
+ 67675: Support a wider range of KDF and ciphers for PEM files + than the combinations supported by the JVM by default. Specifically, + support the OpenSSL default of HmacSHA256 and DES-EDE3-CBC. (markt) +
+ 67927: Reloading TLS configuration can cause the Connector to + refuse new connections or the JVM to crash. (markt) +
+ 67934: If both Tomcat Native 1.2.x and 2.0.x are available, + prefer 1.2.x since it supports the APR/Native connector whereas 2.0.x + does not. (markt) +
+ 67938: Correct handling of large TLS client hello messages + that were causing the TLS handshake to fail. (markt) +
+ 68026: Convert selected MessageByte values to + String when first accessed to speed up subsequent accesses and reduce + garbage collection. (markt) +

Jasper

+ 68068: Performance improvement for EL. Based on a suggestion + by John Engebretson. (markt) +

Web applications

+ 68035: Correct a regression in the fix for 56248 + that prevented deployment via the Manager of a WAR or directory that was + already present in the appBase or a context file that was + already present in the xmlBase. (markt) +

Other

+ 67538: Make use of Ant's <javaversion /> task + to enfore the mininum Java build version. (michaelo) +
+ Update Checkstyle to 10.12.4. (markt) +
+ Update JaCoCo to 0.8.11. (markt) +
+ Update SpotBugs to 4.8.0. (markt) +
+ Update BND to 7.0.0. (markt) +
+ The minimum Java version required to build Tomcat has been raised to + Java 17. (markt) +

2023-10-13 Tomcat 9.0.82 (remm)

Coyote

+ 67670: Fix regression with HTTP compression after code + refactoring. (remm) +

jdbc-pool

+ 67664: Correct a regression in the clean-up of unnecessary + use of fully qualified class names in 9.0.81 that broke the jdbc-pool. + (markt) +

2023-10-10 Tomcat 9.0.81 (remm)

Catalina

+ 65770: Provide a lifecycle listener that will automatically + reload TLS configurations a set time before the certificate is due to + expire. This is intended to be used with third-party tools that + regularly renew TLS certificates. (markt) +
+ Fix handling of an error reading a context descriptor on deployment. + (remm) +
+ Fix rewrite rule qsd (query string discard) being ignored if qsa was + also use, while it should instead take precedence. (remm) +
+ 67472: Send fewer CORS-related headers when CORS is not + actually being engaged. (schultz) +
+ Improve handling of failures within recycle() methods. + (markt) +

Coyote

+ 67198: Ensure that the AJP connector attribute + tomcatAuthorization takes precedence over the + tomcatAuthentication attribute when processing an + auth_type attribute received from a proxy server. (markt) +
+ 67235: Fix a NullPointerException when an + AsyncListener handles an error with a dispatch rather than + a complete. (markt) +
+ When an error occurs during asynchronous processing, ensure that the + error handling process is only triggered once per asynchronous cycle. + (markt) +
+ Fix logic issue trying to match no argument method in IntropectionUtil. + (remm) +
+ Improve thread safety around readNotify and writeNotify in the NIO2 + endpoint. (remm) +
+ Avoid rare thread safety issue accessing message digest map. (remm) +
+ Improve statistics collection for upgraded connections under load. + (remm) +
+ Align validation of HTTP trailer fields with standard fields. (markt) +
+ Improvements to HTTP/2 overhead protection. (markt) +

Jasper

+ 67080: Improve performance of EL expressions in JSPs that use + implicit objects. Based on suggestions by John Engebretson, Anurag Dubey + and Christopher Schultz. (markt) +

Other

+ Update the internal fork of Apache Commons FileUpload to 7a8c324 + (2023-09-16, 1.x-SNAPSHOT). Due to significant refactoring in the 2.x + branch requiring additional Commons IO dependencies, Tomcat has switched + to tracking the 1.x branch. (markt) +
+ Add the Bundle-License header to the JAR manifest for all + Tomcat JARs. (markt) +
+ Update UnboundID to 6.0.10. (markt) +
+ Update Checkstyle to 10.12.3. (markt) +
+ Update Tomcat Native to 1.2.39 to pick up Windows binaries built with + OpenSSL 3.0.11. (markt) +
+ Update Commons Pool to 2.12.0. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +
+ Improvements to Russian translations by usmazat. (markt) +

2023-08-25 Tomcat 9.0.80 (markt)

Catalina

+ If an application or library sets both a non-500 error code and the + javax.servlet.error.exception request attribute, use the + provided error code during error page processing rather than assuming an + error code of 500. (markt) +
+ Update code comments and Tomcat output to use MiB for 1024 * 1024 bytes + and KiB for 1024 bytes rather than MB and kB. (martk) +
+ Avoid protocol relative redirects in FORM authentication. (markt) +

Web applications

+ Documentation. Update documentation to use MiB for 1024 * 1024 bytes and + KiB for 1024 bytes rather than MB and kB. (martk) +

Other

+ Improvements to Chinese translations. (lihan) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations by tak7iji. (markt) +

2023-08-15 Tomcat 9.0.79 (remm)

Catalina

+ Fix potential database connection leaks in + DataSourceUserDatabase identified by Coverity Scan. (markt) +
+ Make parsing of ExtendedAccessLogValve patterns more + robust. (markt) +
+ Fix failure trying to persist configuration for an internal credential + handler. (remm) +
+ 66680: When serializing a session during the session + presistence process, do not log a warning that null Principals are not + serializable. Pull request #638 provided by tsryo. (markt) +
+ Catch NamingException in JNDIRealm#getPrincipal. + It is used in Java up to 17 to signal closed connections. (fschumacher) +
+ 66822: Use the same naming format in log messages for + Connector instances as the associated ProtocolHandler instance. (markt) +
+ The parts count should also lower the actual + maxParameterCount used for parsing parameters if parts are + parsed first. (remm) +

Coyote

+ Refactor blocking reads and writes for the NIO connector to remove + code paths that could allow a notification from the Poller to be missed + resuting in a timeout rather than the expected read or write. (markt) +
+ Refactor waiting for an HTTP/2 stream or connection window update to + handle spurious wake-ups during the wait. (markt) +
+ Correct a regression introduced in 9.0.78 and use the correct + constant when constructing the default value for the + certificateKeystoreFile attribute of an + SSLHostConfigCertificate instance. (markt) +
+ Refactor HTTP/2 implementation to reduce pinning when using virtual + threads. (markt) +
+ Pass through ciphers referring to an OpenSSL profile, such as + PROFILE=SYSTEM instead of producing an error trying to + parse it. (remm) +
+ 66841: Ensure that AsyncListener.onError() is + called after an error during asynchronous processing with HTTP/2. + (markt) +
+ 66842: When using asynchronous I/O (the default for NIO and + NIO2), include DATA frames when calculating the HTTP/2 overhead count to + ensure that connections are not prematurely terminated. (markt) +
+ Correct a race condition that could cause spurious RST messages to be + sent after the response had been written to an HTTP/2 stream. (markt) +

WebSocket

+ 66681: Fix a NullPointerException when flushing + batched messages with compression enabled using + permessage-deflate. (markt) +

jdbc-pool

+ Fix the releaseIdleCounter does not increment when testAllIdle + releases them. Pull request #241 provided by Arun Chaitanya Miriappalli + (lihan) +
+ Fix the ConnectionState state will be inconsistent with actual + state on the connection when an exception occurs while writing. Pull request + #643 provided by Wenjun Xiao. (lihan) +

Other

+ Align documentation for maxParameterCount to match hard-coded defaults. + Contributed by Michal Sobkiewicz. (schultz) +
+ Update NSIS to 3.09. (markt) +
+ Update Checkstyle to 10.12.2. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations. Contributed by tak7iji and + Shirayuking. (markt) +
+ 66829: Fix quoting so users can use the _RUNJAVA + environment variable as intended on Windows when the path to the Java + executable contains spaces. (markt) +
+ Update Tomcat Native to 1.2.38 to pick up Windows binaries built with + OpenSSL 1.1.1v. (markt) +

2023-07-10 Tomcat 9.0.78 (remm)

Other

+ Correct properties for JSign dependency. (rjung) +

not released Tomcat 9.0.77 (remm)

Catalina

+ 59232: Add + org.apache.catalina.core.ContextNamingInfoListener, + a listener which creates context naming information environment entries. + (michaelo) +
+ 66665: Add + org.apache.catalina.core.PropertiesRoleMappingListener, + a listener which populates the context's role mapping from a properties + file. (michaelo) +
+ Fix an edge case where intra-web application symlinks would be followed + if the web applications were deliberately crafted to allow it even when + allowLinking was set to false. (markt) +
+ Add utlity config file resource lookup on Context to allow + looking up resources from the webapp (prefixed with + webapp:) and make the resource lookup API more visible. + (remm) +

Coyote

+ 66627: Restore the documented behaviour of + MessageBytes.getType() that it returns the type of the + original content rather than reflecting the most recent conversion. + (markt) +
+ 66635: Correct certificate logging on start-up so it + differentiates between keystore based keys/certificates and PEM file + based keys/certificates and logs the relevant information for each. + (markt) +

WebSocket

+ Improve handling of error conditions for the WebSocket server, + particularly during Tomcat shutdown. (markt) +
+ Correct a regression in the fix for 66574 that meant the + WebSocket session could return false for onOpen() before + the onClose() event had been completed. (markt) +

Web applications

+ Documentation. Expand the security guidance to cover the embedded use + case and add notes on the uses made of the java.io.tmpdir + system property. (markt) +
+ 66662: Documentation. Fix a typo in the name of the + algorithms attribute in the configuration section for + the Digest authentication valve. Pull request #629 provided by + gohilmca. (markt) +

Other

+ Include the Windows specific binary distributions in the files uploaded + to Maven Central. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations. Contributed by tak7iji. (markt) +
+ Update UnboundID to 6.0.9. (markt) +
+ Update Checkstyle to 10.12.1. (markt) +
+ Update BND to 6.4.1. (markt) +
+ Update JSign to 5.0. (markt) +

2023-06-09 Tomcat 9.0.76 (remm)

Catalina

+ Add RateLimitFilter which can be used to mitigate DoS and Brute Force + attacks. (isapir) +
+ Move the management of the utility executor from the + init()/destroy() methods of components to the + start()/stop() methods. (markt) +
+ Add org.apache.catalina.core.StandardVirtualThreadExecutor, + a virtual thread based executor that may be used with one or more + Connectors to process requests received by those Connectors using + virtual threads. This Executor requires a minimum Java version of Java + 21. (markt) +
+ 66513: Add a per session Semaphore to the + PersistentValve that ensures that, within a single Tomcat + instance, there is no more than one concurrent request per session. Also + expand the debug logging to include whether a request bypasses the Valve + and the reason if a request fails to obtain the per session Semaphore. + (markt) +
+ 66609: Ensure that the default servlet correctly escapes + file names in directory listings when using XML output. Based on pull + request #621 by Alex Kachanov. (markt) +
+ 66618: Add a numeric last modified field to the XML directory + listings produced by the default servlet to enable sorting in the XSLT. + Pull request #622 by Alex Kachanov. (markt) +
+ 66621: Attempts to lock a collection with WebDAV may + incorrectly fail if a child collection has an expired lock. (markt) +
+ 66622: Deprecate the xssProtectionEnabled + setting from the HttpHeaderSecurityFilter and change the + default value to false as support for the associated HTTP + header has been removed from all major browsers. (markt) +

Coyote

+ Update the HTTP/2 implementation to use the prioritization scheme + defined in RFC 9218 rather than the one defined in RFC 7540. + (markt) +
+ 66602: not sending WINDOW_UPDATE when dataLength is ZERO + on call SwallowedDataFramePayload. Pull request #619 by + ledefe. (lihan) +

WebSocket

+ 66548: Expand the validation of the value of the + Sec-Websocket-Key header in the HTTP upgrade request that + initiates a WebSocket connection. The value is not decoded but it is + checked for the correct length and that only valid characters from the + base64 alphabet are used. (markt) +

Other

+ Update to Commons Daemon 1.3.4. (markt) +
+ Improvements to French translations. (remm) +
+ Update Checkstyle to 10.12.0. (markt) +
+ Update the packaged version of the Apache Tomcat Native Library to + 1.2.37 to pick up the Windows binaries built with with OpenSSL 1.1.1u. + (markt) +

2023-05-10 Tomcat 9.0.75 (remm)

Catalina

+ 66567: Fix missing IllegalArgumentException + after the Tomcat code was converted to using URI instead of URL. (remm) +
+ Escape timestamp output in AccessLogValve if a + SimpleDateFormat is used which contains verbatim + characters that need escaping. (rjung) +
+ Change output of vertical tab in AccessLogValve from + \v to \u000b. (rjung) +
+ Improve performance of escaping in AccessLogValve + roughly by a factor of two. (rjung) +
+ Improve JsonAccessLogValve: support more patterns + like for headers and attributes. Those will be logged as sub objects. + (rjung) +
+ #613: Fix possible partial corrupted file copies when using + file locking protection or the manager servlet. Submitted + by Jack Shirazi. (remm) +

Coyote

+ Add support for a new character set, gb18030-2022 - + introduced in Java 21, to the character set caching mechanism. (markt) +
+ Fix an edge case in HTTP header parsing and ensure that HTTP headers + without names are treated as invalid. (markt) +
+ Deprecate the HTTP Connector settings rejectIllegalHeader + and allowHostHeaderMismatch as they have been removed in + Tomcat 11 onwards. (markt) +
+ 66591: Fix a regression introduced in the fix for + 66512 that meant that an AJP Send Headers was not sent for + responses where no HTTP headers were set. (markt) +

Jasper

+ 66582: Account for EL having stricter requirements for static + imports than JSPs when adding JSP static imports to the EL context. + (markt) +

WebSocket

+ 66574: Refactor WebSocket session close to remove the lock on + the SocketWrapper which was a potential cause of deadlocks + if the application code used simulated blocking. (markt) +
+ 66575: Avoid unchecked use of the backing array of a + buffer provided by the user in the compression transformation. (remm) +
+ Improve exception handling when flushing batched messages during + WebSocket session close. (markt) +
+ 66581: Update AsyncChannelGroupUtil to align it + with the current defaults for AsynchronousChannelGroup. Pull request + #612 by Matthew Painter. (markt) +

Other

+ Improvements to French translations. (remm) +
+ Improvements to Chinese translations. (lihan) +
+ Update Checkstyle to 10.10.0. (markt) +
+ Update Jacoco to 0.8.10. (markt) +

2023-04-18 Tomcat 9.0.74 (remm)

Catalina

+ 65995: Implement RFC 9239 and use + text/javascript as the media type for JavaScript rather + than application/javascript. (markt) +
+ Add an access log valve that uses a json format. Based on pull request + #539 provided by Thomas Meyer. (remm) +
+ Harden the FORM authentication process against DoS attacks by using a + reduced session timeout if the FORM authentication process creates a + session. The duration of this timeout is configured by the + authenticationSessionTimeout attribute of the FORM + authenticator. (markt) +
+ 66527: Correct the Javadoc for the + Tomcat.addWebapp() methods that incorrectly stated that the + docBase parameter could be a relative path. (markt) +
+ 66524 Correct eviction ordering in WebResource cache to + be LRU as intended. (schultz) +
+ Use server.xml to reduce the default value of + maxParameterCount from 10,000 to 1,000. If not configured + in server.xml, the default remains 10,000. (markt) +
+ Update Digest authentication support to align with RFC 7616. This adds a + new configuration attribute, algorithms, to the + DigestAuthenticator with a default of + SHA-256,MD5. (markt) +
+ Add support code for custom user attributes in RealmBase. + Based on code from #473 by Carsten Klein. (remm) +
+ Expand the set of HTTP request headers considered sensitive that should + be skipped when generating a response to a TRACE request. + This aligns with 11.0.x. (markt) +
+ 66541: Improve handling for cached resources for resources + that use custom URL schemes. The scheme specific equals() + and hashCode() algorithms, if present, will now be used for + URLs for these resources. This addresses a potential performance issue + with some OSGi custom URL schemes that can trigger potentially slow DNS + lookups in some configurations. Based on a patch provided by Tom + Whitmore. (markt) +
+ When using a custom session manager deployed as part of the web + application, avoid ClassNotFoundExceptions when validating + session IDs extracted from requests. (markt) +
+ 66543: Give StandardContext#fireRequestDestroyEvent + its own log message. (fschumacher) +
+ 66554: Initialize Random during server initialization to + avoid possible JVM thread creation in the webapp context on some + platforms. (remm) +
+ Make the server utility executor available to webapps using a Servlet + context attribute named + org.apache.tomcat.util.threads.ScheduledThreadPoolExecutor. (remm) +

Coyote

+ JSON filter should support specific escaping for common special + characters as defined in RFC 8259. Based on code submitted by + Thomas Meyer. (remm) +
+ 66511: Fix GzipOutputFilter (used for compressed + HTTP responses) when used with direct buffers. Patch suggested by Arjen + Poutsma. (markt) +
+ 66512: Align AJP handling of invalid HTTP response headers + (they are now removed from the response) with HTTP. (markt) +
+ 66530: Correct a regression in the fix for bug + 66442 that meant that streams without a response body did not + decrement the active stream count when completing leading to + ERR_HTTP2_SERVER_REFUSED_STREAM for some connections. + (markt) +
+ Refactor synchronization blocks locking on SocketWrapper to + use ReentrantLock to support users wishing to experiment + with project Loom. (markt) +

Jasper

+ 66536: Fix parsing of tag files that meant that tag + directives could be ignored for some tag files. (markt) +

Cluster

+ 66535: Redefine the maxValidTime attribute of + FarmWarDeployer to be the maximum time allowed between + receiving parts of a transferred file before the transfer is cancelled + and the associated resources cleaned-up. A new warning message will be + logged if the file transfer is cancelled. (markt) +

WebSocket

+ 66508: When using WebSocket with NIO2, avoid waiting for + a timeout before sending the close frame if an I/O error occurs during a + write. (markt) +

Other

+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations. Contributed by Shirayuking and + tak7iji. (markt) +
+ Improvements to Chinese translations. Contributed by totoo. (markt) +
+ Refactor code using MD5Encoder to use + HexUtils.toHexString(). (markt) +
+ 66507: Fix a bug that $JAVA_OPTS is not passed + to the jvm in catalina.sh when calling version. + Patch suggested by Eric Hamilton. (lihan) +
+ Update the internal fork of Commons DBCP to f131286 (2023-03-08, + 2.10.0-SNAPSHOT). This corrects a regression introduced in 9.0.71. + (markt) +
+ Improve the error messages if JRE_HOME or + JAVA_HOME are not set correctly. On windows, align the + handling of JRE_HOME and JAVA_HOME for the + start-up scripts and the service install script. (markt) +
+ Update UnboundID to 6.0.8. (markt) +
+ Update Checkstyle to 10.9.3. (markt) +
+ Update Jacoco to 0.8.9. (markt) +
+ Enhance PEMFile to load from an InputStream. Patch provided by + Romain Manni-Bucau. (schultz) +

2023-03-03 Tomcat 9.0.73 (remm)

General

+ Fix a bug that memory allocation is larger than limit in + SynchronizedStack to reduce memory footprint. (lihan) +

Catalina

+ Add support for txt: and rnd: rewrite map + types from mod_rewrite. Based on a pull request #591 + provided by Dimitrios Soumis. (remm) +
+ Provide a more appropriate response (501 rather than 400) when rejecting + an HTTP request using the CONNECT method. (markt) +
+ 66488: Correct a regression introduced in the fix for bug + 66196 that meant that the HTTP headers and/or request line + could get corrupted (one part overwriting another part) within a single + request. (markt) +

Coyote

+ Add a check for the validity of the scheme pseudo-header in HTTP/2. + (markt) +
+ 66482: Restore inline state after async operation in NIO2, + to account the fact that unexpected exceptions are sometimes thrown + by the implementation. Patch submitted by zhougang. (remm) +

2023-02-23 Tomcat 9.0.72 (remm)

Catalina

+ Allow a Valve to access cookies from a request that cannot be mapped to + a Context. (markt) +
+ Refactor uses of String.replaceAll() to use + String.replace() where regular expressions where not being + used. Pull request #581 provided by Andrei Briukhov. (markt) +
+ Add error report valve that allows redirecting to of proxying from an + external web server. Based on code and ideas from pull request + #506 provided by Max Fortun. (remm) +
+ 66470: Add the Shared Address Space defined by RFC 6598 + (100.64.0.0/10) to the regular expression used to identify internal + proxies for the RemoteIpFilter and + RemoteIpValve. (markt) +
+ 66471: Fix JSessionId secure attribute missing When + RemoteIpFilter determines that this request was submitted + via a secure channel. (lihan) +

Coyote

+ Log basic information for each configured TLS certificate when Tomcat + starts. (markt) +
+ 66442: When an HTTP/2 response must not include a body, + ensure that the end of stream flag is set on the headers frame and that + no data frame is sent. (markt) +
+ 66455: Fix the cause of a potential + ClassCastException when processing a + WINDOW_UPDATE frame on an HTTP/2 connection where the flow + control window for the overall connection has been exhausted. (markt) +
+ Fix a regression introduced in 9.0.65 that prevented HTTP/2 connections + from timing out when using a Connector configured with + useAsyncIO=true (the default for NIO and NIO2). (markt) +
+ Provided dedicated loggers + (org.apache.tomcat.util.net.NioEndpoint.certificate / + org.apache.tomcat.util.net.Nio2Endpoint.certificate / + org.apache.tomcat.util.net.AprEndpoint.certificate) for + logging of configured TLS certificates. (markt) +

Jasper

+ 66419: Fix calls from expression language to a method that + accepts varargs when only one argument was passed. (markt) +
+ 66441: Make imports of static fields in JSPs visible to any + EL expressions used on the page. (markt) +

Web applications

+ 66429: Documentation. Limit access to the documentation web + application to localhost by default. (markt) +
+ 66429: Examples. Limit access to the examples web application + to localhost by default. (markt) +

Other

+ Update BND to 6.4.0. (markt) +
+ Improvements to Korean translations. (woonsan) +
+ Update the packaged version of the Apache Tomcat Native Library to + 1.2.36 to pick up the Windows binaries built with with OpenSSL 1.1.1t. + (markt) +

2023-01-13 Tomcat 9.0.71 (remm)

Catalina

+ 66388: Correct a regression in the refactoring that replaced + the use of the URL constructors. The regression broke + lookups for resources that contained one or more characters in their + name that required escaping when used in a URI path. (markt) +
+ 66392: Change the default value of AccessLogValve's + file encoding to UTF-8 and update documentation. (lihan) +
+ 66393: Align ExtendedAccessLogValve's x-P(XXX) with the + documentation. (lihan) +

Coyote

+ When resetting an HTTP/2 stream because the final response has been + generated before the request has been fully read, use the HTTP/2 error + code NO_ERROR so that client does not discard the response. + Based on a suggestion by Lorenzo Dalla Vecchia. (markt) +
+ 66196: Align HTTP/1.1 with HTTP/2 and throw an exception when + attempting to commit a response with an header value that includes one + or more characters with a code point above 255. (markt) +
+ 66385: Correct a bug in HTTP/2 where a non-blocking read for + a new frame with the NIO2 connector was incorrectly made using the read + timeout leading to unexpected stream closure. (markt) +

Jasper

+ 66370: Change the default of the + org.apache.el.GET_CLASSLOADER_USE_PRIVILEGED system + property to true unless the EL library is running on Tomcat + in which case the default remains false as the EL library + is already called from within a privileged block and skipping the + unnecessary privileged block improves performance. (markt) +
+ Add support for specifying Java 21 (with the value 21) as + the compiler source and/or compiler target for JSP compilation. If used + with an Eclipse JDT compiler version that does not support these values, + a warning will be logged and the default will used. + (markt) +

Other

+ Update the internal fork of Apache Commons BCEL to 2ee2bff (2023-01-03, + 6.7.1-SNAPSHOT). (markt) +
+ Update the internal fork of Apache Commons Codec to 3eafd6c (2023-01-03, + 1.16-SNAPSHOT). (markt) +
+ Update the internal fork of Apache Commons FileUpload to 34eb241 + (2023-01-03, 2.0-SNAPSHOT). (markt) +
+ Update the internal fork of Apache Commons DBCP to f131286 (2023-01-03, + 2.10.0-SNAPSHOT). (markt) +
+ Improvements to Japanese translations. Contributed by Shirayuking. + (markt) +
+ Improvements to Portuguese translations. Contributed by Guilherme + Custódio. (markt) +
+ Update Checkstyle to 10.6.0. (markt) +
+ Update Unboundid to 6.0.7. (markt) +
+ Update SpotBugs to 4.7.3. (markt) +

2022-12-05 Tomcat 9.0.70 (remm)

Catalina

+ Correct the default implementation of + HttpServletRequest.isTrailerFieldsReady() to return + true so it is consistent with the default implementation of + HttpServletRequest.getTrailerFields() and with the Servlet + API provided by the Jakarta EE project. (markt) +
+ Improve the behavior of the credential handler attribute that is set in + the Servlet context so that it actually reflects what is used during + authentication. (remm) +
+ 66359: Update javadoc for RemoteIpValve and RemoteIpFilter with + correct protocolHeader default value of "X-Forwarded-Proto". + (lihan) +

Coyote

+ When an HTTP/2 stream was reset, the current active stream count was not + reduced. If enough resets occurred on a connection, the current active + stream count limit was reached and no new streams could be created on + that connection. (markt) +

Web applications

+ 66348: Update the JARs listed in the class loader + documentation and note which ones are optional. (markt) +
+ Documentation. Replace references in the application developer's guide + to CVS with more general references to a source code control system. + (markt) +

Other

+ Refactor code base to replace use of URL constructors. While they are + deprecated in Java 20 onwards, the reasons for deprecation are valid for + all versions so move away from them now. (markt) +
+ Update the internal fork of Apache Commons BCEL to b015e90 (2022-11-28, + 6.7.0-RC1). (markt) +
+ Update the internal fork of Apache Commons Codec to ae32a3f (2022-11-29, + 1.16-SNAPSHOT). (markt) +
+ Update to Commons Daemon 1.3.3. (markt) +
+ Update the internal fork of Apache Commons FileUpload to aa8eff6 + (2022-11-29, 2.0-SNAPSHOT). (markt) +
+ Improvements to Japanese translations. Contributed by Shirayuking and + tak7iji. (markt) +

2022-11-14 Tomcat 9.0.69 (remm)

Catalina

+ 66209: Add a configuration option to allow bloom filters used + to index JAR files to be retained for the lifetime of the web + application. Prior to this addition, the indexes were always flushed by + the periodic calls to WebResourceRoot.gc(). As part of this + addition, configuration of archive indexing moves from + Context to WebResourceRoot. Based on a patch + provided by Rahul Jaisimha. (markt) +
+ 66330: Correct a regression introduced when fixing + 62897 that meant any value configured for + skipMemoryLeakChecksOnJvmShutdown on the + Context was ignored and the default was always used. + (markt) +
+ 66331: Fix a regression in refactoring for Stack + on the SystemLogHandler which caught incorrect exception. + (lihan) +
+ 66338: Fix a regression that caused a nuance in refactoring + for ErrorReportValve. (lihan) +
+ Escape values used to construct output for the + JsonErrorReportValve to ensure that it always outputs valid + JSON. (markt) +

Coyote

+ Correct the date format used with the expires attribute of HTTP cookies. + A single space rather than a single dash should be used to separate the + day, month and year components to be compliant with RFC 6265. (markt) +
+ Include the name of the current stream state in the error message when a + stream is cancelled due to an attempt to write to the stream when it is + in a state that does not permit writes. (markt) +
+ NIO writes never return -1 so refactor CLOSED_NIO_CHANNEL + not to do so and remove checks for this return value. Based on + #562 by tianshuang. (markt) +
+ Remove unnecessary code that exposed the asyncTimeout to + components that never used it. (markt) +

Jasper

+ 66294: Make the use of a privileged block to obtain the + thread context class loader added to address 62080 optional + and disabled by default. This is now controlled by the + org.apache.el.GET_CLASSLOADER_USE_PRIVILEGED system + property. (markt) +
+ 66325: Fix concurrency issue in evaluation of expression + language containing lambda expressions. (markt) +

jdbc-pool

+ 66346: Ensure all JDBC pool JARs are reproducible. Pull + request #566 provided by John Neffenger. (markt) +

Other

+ Update to Commons Daemon 1.3.2. (markt) +
+ Improvements to Chinese translations. Contributed by DigitalCat and + lihan. (markt) +
+ Improvements to French translations. Contributed by Mathieu Bouchard. + (markt) +
+ Improvements to Japanese translations. Contributed by Shirayuking. + (markt) +

2022-10-07 Tomcat 9.0.68 (markt)

Catalina

+ Update the RewriteValve to perform pattern matching using + dotall mode to avoid unexpected behaviour if the URL includes encoded + line terminators. (markt) +

Coyote

+ 66276: Fix incorrect class cast when adding + a descendant of HTTP/2 streams. (lihan) +
+ 66281: Fix unexpected timeouts that may appear as client + disconnections when using HTTP/2 and NIO2. (markt) +
+ Enforce the requirement of RFC 7230 onwards that a request with a + malformed content-length header should always be rejected + with a 400 response. (markt) +

Jasper

+ 66277: Fix regressions in refactoring from Stack + ArrayDeque. +
+ Add support for specifying Java 20 (with the value 20) as + the compiler source and/or compiler target for JSP compilation. If used + with an Eclipse JDT compiler version that does not support these values, + a warning will be logged and the default will used. + (markt) +

Web applications

+ Documentation. Document the nonceRequestParameterName + attribute for the CsrfPreventionFilter. Based on + #553 by Mert Ülkgün. (markt) +

Other

+ Update Objenesis to 3.2. (markt) +
+ Update UnboundID to 6.0.6. (markt) +
+ Update Checkstyle to 10.3.4. (markt) +
+ Update JaCoCo to 0.8.8. (markt) +
+ Update SpotBugs to 4.7.2. (markt) +
+ Update JSign to 4.2. (markt) +
+ Update Derby to 10.16.1.1. (markt) +
+ Improvements to Chinese translations. (markt) +
+ Improvements to Czech translations. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations. Contributed by tak7iji and + Shirayuking. (markt) +
+ Improvements to Korean translations. (markt) +
+ Improvements to Spanish translations. (markt) +

2022-09-26 Tomcat 9.0.67 (remm)

Coyote

+ Fix a regression in refactoring for Hashtables which caused mbeans to + lose many of their attributes. (remm) +

not released Tomcat 9.0.66 (remm)

Catalina

+ Correct handling of HTTP TRACE requests where there are multiple + instances of an HTTP header with the same name. (markt) +
+ Implement the requirements of RFC 7231 and do not include sensitive + headers in responses to HTTP TRACE requests. (markt) +
+ Implement the clarification in RFC 9110 that the units in HTTP range + specifiers are case insensitive. (markt) +
+ Properly-escape role and group information when writing + MemoryUserDatabase to an XML file. (schultz) +
+ Move control of XML-export logic from individual support classes into + MemoryUserDatabase.save(). Deprecate and discontinue use of MemoryUser, + MemoryRole, and MemoryGroup classes. (schultz) +
+ 66183: When logging cookie values in an access log valve and + there are multiple cookies with the same name, log all cookie values + rather than just the first. Based on pull request #541 by Han + Li. (markt) +
+ 66184: Ensure that JULI root loggers have a default level of + INFO. Pull request #533 provided by Piotr P. + Karwasz. (markt) +
+ Improve handling of stack overflow errors when parsing SSI expressions. + (markt) +
+ 66120: Enable FORM authentication to work correctly if + session persistence and restoration occurs during the authentication + process. (markt) +
+ 66233: Include an error message when sending a 400 response + because a request has too many cookies. (markt) +
+ When web application deployment fails due to JARs with duplicate + fragment names, improve the error message by listing the JARs that + contain the duplicates. Based on pull request #535 by Mads + Rolsdorph. (markt) +
+ Replace logging thread for JULI's AsyncFileHandler with an + executor to protect against failure of the logging thread. Based on pull + request #545 by Piotr P. Karwasz. (markt) +

Coyote

+ Avoid potential NPE by skipping duplicate accept check when using a Unix + Domain Socket. Based on #532 by Han Li. (markt) +
+ Address an edge case in HTTP header parsing that allowed CRCRLF to be + used as a valid line terminator. (markt) +
+ Ensure HTTP/2 requests that include connection specific headers are + rejected. (markt) +
+ When processing HTTP/2 requests, allow a host header to be + used in place of an :authority header. (markt) +
+ When processing HTTP/2 requests, allow a host header and an + :authority header to be present providing they are + consistent. (markt) +
+ When processing HTTP/2 requests, reject requests containing multiple + host headers. (markt) +
+ Make parsing of invalid filename directives in + Content-Disposition headers more robust. Invalid filename + directives will now be ignored rather than triggering a 500 response. + (markt) +
+ 66194: Log HTTP/2 stream closures (usually caused by client + errors) via a UserDataHelper to broadly align it with the + behaviour of HTTP/1.1 for parsing issues and exceeding limits. (markt) +
+ 66236: Implement support for the special values zero and + minus one when configuring maxSavePostSize for a Connector + when used in conjunction with TLS renegotiation. (markt) +
+ 66240: Avoid int overflow when parsing octets by limiting + the maximum value to 255. Based on a PR #548 by Stefan Mayr. + (lihan) +
+ #550: Correctly handle case where a Servlet responds to a + request with an expectation with a 2xx response without reading the + request body. Pull request provided by Malay Shah. (markt) +
+ #551: Avoid potential IndexOutOfBoundsException by fixing + incorrect check when matching HTTP/2 preface. Submitted by 刘文章. + (lihan) +

Jasper

+ Improve handling of stack overflow errors when parsing EL expressions. + (markt) +
+ Correct parsing of integer and floating point literals in EL expressions + so that larger values are correctly parsed to BigInteger + and BigDecimal respectively. (markt) +
+ 66203: Log an error message when the JSP compiler is unable + to create the output directory for the generated code. (markt) +
+ 66235: Fix various issues with the bean resolver used for + Graal. (remm) +
+ Improve the performance of the ImportHandler in the + Expression Language implementation. This removes a previous optimisation + that is now detrimental rather than helpful. Pull request #547 + provided by rmannibucau. (markt) +
+ Improve handling of EL error messages so instances of Number are not + formatted in unexpected ways. (markt/kkolinko) +
+ Switch to using ELException rather than IllegalArgumentException when a + type conversion fails during an EL arithmetic operation. This is an EL + error so ELException seems more appropriate. (markt) +
+ 66246: Fix JspC generates invalid web.xml due to incorrect header. (lihan) +
+ Fix a bug in MethodExpression handling that triggered an + error when invoking a static method on an instance of the class rather + than directly on the class. (markt) +
+ Use BigInteger.remainder() rather than + BigInteger.mod() when performing the modulus operation for + instances of BigInteger as part of an EL expression. + (markt) +

Cluster

+ To aid future additions of new functionality, rather than throw an + IllegalArgumentException if a DeltaRequest is + passed an unrecognised action type, a warning message will now be + logged. (markt) +
+ 66120: Enable FORM authentication to work correctly if + session failover occurs during the authentication process. (markt) +

WebSocket

+ 62312: Add support for authenticating WebSocket clients with + an HTTP forward proxy when establishing a connection to a WebSocket + endpoint via a forward proxy that requires authentication. Based on a + patch provided by Joe Mokos. (markt) +

Other

+ Ensure that zip archives use UTC for file modification times to ensure + repeatable builds across time zones. (markt) +
+ Improvements to Chinese translations. (lihan) +
+ Improvements to Czech translations. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to German translations. (markt) +
+ Improvements to Japanese translations. Contributed by tak7iji and + Shirayuking. (markt) +
+ Improvements to Korean translations. Contributed by 수현. (markt) +
+ Improvements to Russian translations. (markt) +
+ Improvements to Spanish translations. (markt) +
+ Further automation to the build process to reduce the number of manual + steps that release managers must perform. (markt) +

2022-07-20 Tomcat 9.0.65 (remm)

Catalina

+ 66104: Avoid error message by not trying to clean up old + files from the logging directory before the directory has been created. + Based on #521 by HanLi. (markt) +

Coyote

+ Provide dedicated loggers + (org.apache.tomcat.util.net.NioEndpoint.handshake / + org.apache.tomcat.util.net.Nio2Endpoint.handshake) for TLS + handshake failures. (markt) +
+ Enable the use of the FIPS provider for TLS enabled Connectors when + using Tomcat Native 1.2.34 onwards built with OpenSSL 3.0.x onwards. + (markt) +
+ Deprecated the jvmRoute system property used to configure a + default value for the jvmRoute attribute of an Engine. + (markt) +
+ Fix duplicate Poller registration with HTTP/2, NIO and async IO that + could cause HTTP/2 connections to unexpectedly fail. (markt) +

Jasper

+ Add support for specifying Java 19 (with the value 19) as + the compiler source and/or compiler target for JSP compilation. If used + with an Eclipse JDT compiler version that does not support these values, + a warning will be logged and the default will used. + (markt) +

Web applications

+ Documentation. 62245: Include contextXsltFile + when discussing options for configuring directory listings. (markt) +
+ Examples. Fix CVE-2022-34305, a low severity XSS vulnerability in the + Form authentication example. (markt) +
+ Documentation. Expand the description of the useSendfile + attribute for HTTP/2 and reference the possibility of file locking when + using this feature on Windows operating systems. (markt) +

Other

+ Update to bnd 6.3.1. (markt) +
+ The minimum Ant version required to build Tomcat 9.0.x is now 1.10.2. + (markt) +
+ Add additional automation to the build process to reduce the number of + manual steps that release managers must perform. (schultz) +
+ Implement support for reproducible builds. Reproducible builds are + independent of operating system but require the same Ant version and + same JDK (vendor and version) to be used as associated version + information is embedded in a number of build outputs such as JAR file + manifests. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.34 to + improve the support for building with OpenSSL 3.0.x.(markt) +
+ Remove and/or update references to the removed + org.apache.tomcat.util.threads.res package. The + LocalStrings*.properties files in that package were moved + to org.apache.tomcat.util.threads package for consistency + with the rest of the Tomcat code base. +
+ 66134: The NSIS based Tomcat installer for Windows now + correctly handles the combination of TomcatAdminRoles + defined in a configuration file and selecting the Manager and/or + Host Manager web applications in the installer's GUI. (markt) +
+ Update the OWB module to Apache OpenWebBeans 2.0.27. (remm) +
+ Update the CXF module to Apache CXF 3.5.3. (remm) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations contributed by tak7iji. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.35 to + pick up Windows binaries built with OpenSSL 1.1.1q.(markt) +

2022-06-09 Tomcat 9.0.64 (remm)

Catalina

+ Update the memory leak protection code to support stopping application + created executor threads when running on Java 19 and later. (markt) +
+ Improve the error message if a required --add-opens option + is missing. (markt) +
+ Disable the memory leak correction code enabled by the Context attribute + clearReferencesObjectStreamClassCaches when running on a + JRE that includes a fix for the underlying memory leak. (markt) +
+ #515: Avoid deadlock on startup with some utility executor + configurations. Submitted by Han Li. (remm) +
+ 66068: Ensure that the changes made to a request by the + RemoteIPValve persist after the request is put into + asynchronous mode. (markt) +
+ Include the major version in the recommended version used for Tomcat + Native with the AprLifecycleListener. (markt) +

Coyote

+ Additional fix for 65118. Fix a potential + NullPointerException when pruning closed HTTP/2 streams + from the connection. (markt) +
+ 66076: When using TLS with non-blocking writes and the NIO + connector, ensure that flushing the buffers attempts to empty all of the + output buffers. (markt) +
+ 66084: Correctly calculate bytes written to a response. Pull + request #516 provided by aooohan HanLi. (markt) +
+ Correct a regression in the support added for encrypted PKCS#1 formatted + private keys in the previous release that broke support for unencrypted + PKCS#1 formatted private keys. (jfclere/markt) +
+ Remove support for NPN when using the Tomcat Native Connector as NPN was + never standardised and browser support for NPN was removed several years + ago. (markt) +

Jasper

+ Update ImportHandler optimisation for new classes + introduced in Java 19. (markt) +

Web applications

+ 66064: Update the building page in the documentation web + application to reflect changes in required Java version and source + repository. (markt) +
+ Documentation. Make the description of the HTTP/1.1 configuration + attributes that control the maximum allowed HTTP header size more + specific. (markt) +

Tribes

+ Increase the default buffer size for replication messages from 43800 to + 65536 bytes. This is expected to improve performance for large messages + when running on Linux based systems. (markt) +

Other

+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations contributed by Shirayuking and + tak7iji. (markt) +
+ Improvements to Chinese translations contributed by Dingzi2012. (markt) +

2022-05-16 Tomcat 9.0.63 (remm)

Catalina

+ 65736: Disable the forceString option for the + JNDI BeanFactory and replace it with an automatic search + for an alternative setter with the same name that accepts a + String. This is a security hardening measure. (markt) +
+ 65853: Refactor the CsrfPreventionFilter to make + it easier for sub-classes to modify the nonce generation and storage. + Based on suggestions by Marvin Fröhlich. (markt) +
+ 65991: Avoid NPE with SSLAuthenticator when + boundOnInit is used on a connector, during the check + for client certificate authentication availability. (remm) +
+ 66009: Use getSubjectX500Principal().toString() + rather than getSubjectX500Principal().getName(...) to + retrieve a certificate DN, to match the output of the deprecated + getSubjectDN().getName() that was used previously. (remm) +
+ Revert the change in 9.0.59 that added a mapping of + Shift_JIS for the ja locale to the default + mappings used by ServletResponse.setLocale() as it + caused regressions for applications using UTF-8. (markt) +
+ Provide a property source that sources values from Kubernetes service + bindings. Pull request #512 provided by Sumit Kulhadia and + Gareth Evans. (markt) +

Coyote

+ #501: Add new maxHttpRequestHeaderSize and + maxHttpResponseHeaderSize attributes which allow setting + the maximum HTTP header sizes independently. If not specified, the + value of the maxHttpHeaderSize connector attribute will + be used. Submitted by Zhongming Hua. (remm) +
+ The root cause of the Linux kernel duplicate accept bug has been + identified along with the version of the kernel that includes the fix. + The error message displayed when this bug occurs has been updated to + reflect this new information and to advise users to update to a version + of the OS that uses kernel 5.10 or later. Thanks to Christopher Gual for + the research into this issue. (markt) +
+ 66023: Improve the fix for 65726 and support HTTP + upgrade with a request body for a wider set of use cases. (markt) +
+ Add support for encrypted PKCS#1 formatted private keys when configuring + the internal, in memory key store. Based on #511. + (jfclere/markt) +
+ Remove the prestartminSpareThreads attribute of the + StandardThreadExecutor since all core threads are always + started by default making this attribute meaningless. Pull request + #510 provided by Aooohan. (markt) +

Webapps

+ 66008: In the documentation web application, clarify the + recommendation for the use the trimSpaces option for Jasper + in production environments. (markt) +
+ Update the documentation web application to state that the + EncryptInterceptor does not provide sufficient protection + to run Tomcat clustering over an untrusted network. This is + CVE-2022-29885. (markt) +

Other

+ Improvements to French translations. (remm) +
+ Improvements to German translations contributed by Thomas Hoffmann. + (markt) +
+ Improvements to Japanese translations contributed by Shirayuking. + (markt) +
+ Improvements to Korean translations. (woonsan) +
+ Update to Commons Daemon 1.3.1. This fixes a known regression in 1.3.0 + when configuring the Windows service with custom scripts as described in + 66055. (markt) +
+ Update to JSign 4.1. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.33 to + pick up Windows binaries built with OpenSSL 1.1.1o.(markt) +

2022-04-01 Tomcat 9.0.62 (remm)

Catalina

+ Effectively disable the + WebappClassLoaderBase.getResources() method as it is not + used and if something accidentally exposes the class loader this method + can be used to gain access to Tomcat internals. (markt) +

not released Tomcat 9.0.61 (remm)

Catalina

+ Harden the CredentialHandler implementations by switching to a + constant-time implementation for credential comparisons. (schultz/markt) +

Coyote

+ Use a constant for the default TLS cipher suite. This will allow + skipping setting it in some cases (for example, it does not make + sense for OpenSSL TLS 1.3). (remm) +
+ #487: Improve logging of unknown settings frames. Pull request + by Thomas Hoffmann. (remm) +
+ 65975: Add a warning if a TLS virtual host is configured with + optional certificate authentication and the containing connector is also + configured to support HTTP/2 as HTTP/2 does not permit optional + certificate authentication. (markt) +
+ 65975: Add a warning if a TLS virtual host is configured for + TLS 1.3 with a JSSE implementation and a web application is configured + for CLIENT-CERT authentication. CLIENT-CERT + authentication requires post-handshake authentication (PHA) when used + with TLS 1.3 but the JSSE TLS 1.3 implementation does not support PHA. + (markt) +
+ Improve the recycling of Processor objects to make it more robust. + (markt) +

Jasper

+ 65959: Serialize Function as String[] rather Class[]. (remm) +

Web applications

+ 65952: Align --add-opens configuration for jsvc + with the current Tomcat scripts. (markt) +
+ Correct the AJP and HTTP/1.1 Connector configuration pages in the + documentation web application to show which attributes are applicable to + all Connectors and which are implementation specific. (markt) +

Other

+ Correct a spelling mistake in the German translations. Thanks to Thomas + Hoffmann. (markt) +
+ 65951: Use the tomcat.output property for OSGi bundle + manifest paths. (isapir) +
+ Update to Commons Daemon 1.3.0. (markt) +
+ Update to Checkstyle 10.0. (markt) +
+ Update to SpotBugs 4.6.0. (markt) +
+ Expand the spotbugs Ant task to also cover test code. + (markt) +
+ Update to bnd 6.2.0. (markt) +
+ Remove OSGi annotations dependency as it is no longer required with bnd + 6.2.0. (markt) +
+ Refactor the resource files for the Apache Tomcat installer for Windows + so that all the resource files are located in a single directory in the + source tree. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.32 to + pick up Windows binaries built with OpenSSL 1.1.1n.(markt) +
+ Improvements to Chinese translations contributed by 15625988003. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations contributed by tak7iji. (markt) +
+ Expand coverage of translations for jakarta.el package. + Based on #488 from Volodymyr Siedlecki. (markt) +

2022-03-14 Tomcat 9.0.60 (remm)

Catalina

+ 65921: The type substitution flag for the + rewrite valve should set the content type for the response, not the + request. (markt) +
+ #479: Enable the rewrite valve to redirect requests when the + original request cannot be mapped to a context. This typically happens + when no ROOT context is defined. Pull request by elkman. (markt) +
+ 65940: Fix NullPointerException if an exception + occurs during the destruction of a Servlet. (markt) +

Coyote

+ Fix regression introduced with 65757 bugfix which better + identified non request threads but which introduced a similar problem + when user code was doing sequential operations in a single thread. + Test case code submitted by Istvan Szekely. (remm) +
+ Fix potential thread-safety issue that could cause HTTP/1.1 request + processing to wait, and potentially timeout, waiting for additional + data when the full request has been received. (markt) +
+ Throw IOException rather than + IllegalStateException when the application attempts to + write to an HTTP/2 stream after the client has closed the stream. + (markt) +

Jasper

+ When resolving methods in EL expressions that use beans and/or static + fields, ensure that any custom type conversion is considered when + identifying the method to call. (markt) +

Web applications

+ Correct the name of the value attribute in the new + documentation of OpenSSLConfCmd elements. (rjung) +

2022-02-28 Tomcat 9.0.59 (remm)

Catalina

+ Add ha-api-*.jar and jaxws-rt-*.jar to the + list of JARs to skip when scanning for TLDs, web fragments and + annotations. (michaelo) +
+ Expand the default mappings used by + ServletResponse.setLocale() to include a mapping from the + ja locale to the Shift_JIS encoding. (markt) +
+ 65806: Improve the handling of session ID generation when the + default algorithm for SecureRandom (SHA1PRNG) + is not supported by the configured providers as will be the case for a + FIPS compliant configuration. (markt) +
+ #464: Fall back to the class loader used to load JULI when the + thread context class loader is not set. In a normal Tomcat + configuration, this will be the system class loader. Based on a pull + request by jackshirazi. (markt) +
+ #469: Include the Java Annotations API in the classes that + Tomcat will not load from web applications. Pull request provided by + ppkarwasz. (markt) +
+ #472: Add support for additional user attributes to + TomcatPrincipal and GenericPrincipal. + Patch provided by Carsten Klein. (michaelo) +
+ Fix a potential StringIndexOutOfBoundsException exception + when generating a WebDAV multi-status response after an error during a + copy or delete. Report the paths relative to the server root for any + resources with an error. (markt) +
+ Improve the format of WebDAV XML responses to make them easier for + humans to read. The change ensures that there is always a line break + before starting a new element. (markt) +
+ Improve validation of the Destination header for WebDAV + MOVE and COPY requests. (markt) +

Coyote

+ Correct a regression in the fix for 65454 that meant that + minSpareThreads and maxThreads settings were + ignored when the Connector used an internal executor. (markt) +
+ 65776: Improve the detection of the Linux duplicate accept + bug and reduce (hopefully avoid) instances of false positives. (markt) +
+ 65848: Revert the change that attempted to align the + behaviour of client certificate authentication with NIO or NIO2 with + OpenSSL for TLS between MacOS and Linux/Windows as the root cause was + traced to configuration differences. (markt) +
+ #467: When system time moves backwards (e.g. after clock + correction), ensure that the cached formatted current date used for + HTTP headers tracks this change. Pull request provided by zhenguoli. + (markt) +

Jasper

+ #474: Prevent a tag file from corrupting the ELContext of the + calling page. Pull request provided by Dmitri Blinov. (markt) +
+ Minor optimisation of serialization for FunctionMapperImpl + in response to pull request #476. (markt) +

Web applications

+ Remove the applet example from the example web application as applets + are no longer supported in any major browser. (markt) +
+ Refactor a small number of pages in the examples web application to + avoid an issue with reproducible builds due to differences in file + ordering across different operating systems with Ant's zip task. (markt) +
+ Better documentation for the protocol attribute of the + JNDIRealm. (markt) +
+ Clarify the settings described in the documentation web application to + configure a cluster using static membership. (markt) +
+ Add information on the OpenSSLConf and + OpenSSLConfCmd elements to the HTTP SSL configuration page + in the documentation web applications. (markt) +

jdbc-pool

+ Use LF line endings for text files in JARs to support reproducible + builds across different operating systems. (markt) +

Other

+ Switch to building with Java 11 and using --release to + target Java 8. Once back-ported to all currently supported branches, + this will reduce the number of Java versions developers need to juggle. + (markt) +
+ Use LF line endings for text files in JARs to support reproducible + builds across different operating systems. (markt) +
+ Fix dependencies for individual test targets in Ant build file. Based on + #468 provided by Totoo chenyonghui. (markt) +
+ Update the OWB module to Apache OpenWebBeans 2.0.26. (remm) +
+ Revert the cherry-pick of JavaDoc fix from DBCP applied in 9.0.57 that + broke the DataSourceMXBean by using a type that isn't + supported by MXBeans. (markt) +

2022-01-20 Tomcat 9.0.58 (remm)

Coyote

+ Correct a regression in the fix for 65785 that broke HTTP/2 + server push. (markt) +

not released Tomcat 9.0.57 (remm)

Catalina

+ Add additional locking to DataSourceUserDatabase to provide + improved protection for concurrent modifications. (markt) +
+ Add recycling check in the input and output stream isReady to try to + give a more informative ISE when the facade has been recycled. (remm) +
+ Remove the deprecated JmxRemoteLifecycleListener. (markt) +
+ Make the calculation of the session storage location more robust when + using file based persistent storage. (markt) +

Coyote

+ 65726: Implement support for HTTP/1.1 upgrade when the + request includes a body. The maximum permitted size of the body is + controlled by maxSavePostSize. (markt) +
+ Restore pre-starting of minSpareThreads lost in the fix for + 65454. (markt) +
+ Revert the previous fix for 65714 and implement a more + comprehensive fix. (markt) +
+ 65757: Missing initial IO listener notification on Servlet + container dispatch to another container thread. (remm) +
+ Expand the fix for 65757 so that rather than just checking if + processing is happening on a container thread, the check is now if + processing is happening on the container thread currently allocated to + this request/response. (markt) +
+ Improve the fix for RST frame ordering added in 9.0.56 to avoid a + potential deadlock on some systems in non-default configurations. + (markt) +
+ 65767: Add support for certificates that use keys encrypted + using PBES2. Based on a pull request provided by xiezhaokun. (markt) +
+ Refactor testing whether a String is a valid HTTP token. (markt) +
+ 65785: Perform additional validation of HTTP headers when + using HTTP/2. (markt) +
+ When a Connector or Endpoint is paused, ensure that only new connections + and new requests on existing connections are stopped while allowing in + progress requests to run to completion. (markt) +
+ Explicitly release ByteBuffer instances associated with pooled channels + when stopping the NioEndpoint and Nio2Endpoint. (markt) +
+ Narrow the scope of the logging of invalid cookie headers to just the + invalid cookie rather than the whole cookie header. (markt) +

Jasper

+ 65724: Fix missing messages for some + PropertyNotWritableExceptions caused by a typo in the name + used for a resource string. (markt) +
+ Add support for specifying Java 18 (with the value 18) as + the compiler source and/or compiler target for JSP compilation. If used + with an Eclipse JDT compiler version that does not support these values, + a warning will be logged and the default will used. + (markt) +

WebSocket

+ Add support for POJO WebSocket endpoints to the programmatic upgrade + that allows applications to opt to upgrade an HTTP connection to + WebSocket. (markt) +
+ 65763: Improve handling of WebSocket connection close if a + message write times out before the message is fully written. (markt) +

Other

+ Update the OWB module to Apache OpenWebBeans 2.0.25. (remm) +
+ Update the CXF module to Apache CXF 3.5.0. (remm) +
+ Improvements to Chinese translations contributed by zhnnn. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations contributed by Shirayuking, yoshy + and tak7iji. (markt) +
+ Improvements to Korean translations. (woonsan) +
+ Update SpotBugs to 4.5.2. (markt) +
+ Update the NSIS installer to 3.08. (markt) +
+ Update UnboundID to 6.0.3. (markt) +
+ Update CheckStyle to 9.2.1. (markt) +
+ Update BND to 6.1.0. (markt) +
+ Update OSGI annotations to 1.1.1. (markt) +

2021-12-02 Tomcat 9.0.56 (remm)

Catalina

+ Make SPNEGO authentication more robust for the case where the provided + credential has expired. (markt) +
+ 65684: Fix a potential NullPointerException when + using JULI. (markt) +
+ Document conditions under which the AprLifecycleListener + can be used to avoid JVM crashes. (michaelo) +
+ Refactor the AsyncFileHandler to reduce the possibility of + log messages being lost on shutdown. (markt) +
+ Refactor the AsyncFileHandler to remove the need for the + org.apache.juli.AsyncLoggerPollInterval. If set, this + property now has no effect. (markt) +
+ Add debug logging to the RestCsrfPreventionFilter. Based on + pull request #452 by Polina Georgieva. (markt) +
+ 65710: Implement a workaround for a JVM bug that can trigger + a file descriptor leak when using multi-part upload and the application + does not explicitly close an input stream for an uploaded file that was + cached on disk. (markt) +

Coyote

+ Improve error handling if APR/Native fails to attach TLS capabilities to + a TLS enabled client connection. (markt) +
+ Improve error handling if APR/Native fails to accept an incoming + connection. (markt) +
+ Provide protection against a known OS + bug that causes the acceptor to report an incoming connection more + than once. (markt) +
+ Avoid unnecessary duplicate read registrations for blocking I/O with the + NIO connector. (markt) +
+ 65677: Improve exception handling for errors during HTTP/1.1 + reads with NIO2. (markt) +
+ Refactor APR/native connector shutdown to remove a potential source of + JVM crashes on shutdown when sendfile is used. (markt) +
+ When an error occurs that triggers a stream reset, ensure that the first + RST frame sent to the client is the one associated with the + error that triggered the reset. (markt) +
+ 65714: Fix exceptions when the security manager is enabled + and the first request received after starting is an HTTP request to a + TLS enabled NIO2 connector. (markt) +
+ Ensure that using NIO or NIO2 with OpenSSL for TLS behaves the same way + on MacOS as it does on Linux and Windows when no trusted certificate + authorities are configured and reject all client certificates. (markt) +
+ Avoid a potential deadlock during the concurrent processing of incoming + HTTP/2 frames for a stream and that stream being reset. (markt) +

Other

+ Switch from Cobertura to JaCoCo for code coverage as Cobertura does not + support code coverage for code compiled for Java 11 onwards. It also + removes the need to use a single thread to run the tests. (markt) +

2021-11-10 Tomcat 9.0.55 (remm)

Catalina

+ Improve robustness of JNDIRealm for exceptions occurring when getting + the connection. Also add missing close when running into issues + getting the passord of a user. (remm) +
+ Add Javadoc comment which listeners must be nested within + Server elements only. (michaelo) +
+ Add support for custom caching strategies for web application resources. + This initial implementation allows control over whether or not a + resource is cached. (markt) +
+ Log warning if a listener is not nested inside a Server element + although it must have been. (michaelo) +

Coyote

+ Improve performance of Connector shutdown - primarily to reduce the time + it takes to run the test suite. (markt) +
+ Refactor the APR/native connector shutdown to reduce the possibility of + a JVM crash during the connector shutdown. (markt) +
+ #457: Add a toString() method to + MimeHeader to aid debugging. (dblevins) +
+ Add experimental OpenSSL support through the Panama API incubating in + Java 17, with support for OpenSSL 1.1+. This no longer requires + tomcat-native or APR. Please refer to the openssl-java17 + module from the main branch for more details. (remm) +
+ Fix APR connector stop so it correctly waits for the sendfile thread, if + any, to exit. (markt) +
+ Do not ignore the error condition if the APR connector is not able to + open a server socket as continuing in this case will trigger a JVM crash. + (markt) +
+ Fix a potential JVM crash when using the APR/Native connector with TLS. + A crash could occur if the connector was stopped whilst a connection was + performing a TLS handshake. (markt) +

Jasper

+ Regenerate the EL parser using JavaCC 7.0.10. (markt) +
+ Fix a bug that prevented the EL parser correctly parsing a literal Map + that used variables rather than literals for both keys and values. + (markt) +

WebSocket

+ Add a new method WsServerContainer.upgradeHttpToWebSocket() + to align with the new method that will be available from WebSocket 2.1 + onwards. (markt) +

Tribes

+ #454: Differentiate warning messages in + KubernetesMembershipProvider so that the missing attribute + is clear to the user. PR provided by Hal Deadman. (markt) +

2021-10-01 Tomcat 9.0.54 (remm)

Catalina

+ Provide the DataSource in the constructor of + DataSourceUserDatabase, since it is always global. (remm) +
+ Fix delete then create object manipulations with + DataSourceUserDatabase. (remm) +
+ 65553: Implement a work-around for a + JRE bug + that can trigger a memory leak when using the JNDI realm. (markt) +
+ 65586: Fix the bloom filter used to improve performance of + archive file look ups in the web resources implementation so it works + correctly for directory lookups whether or not the provided directory + name includes the trailing /. (markt) +
+ #451: Improve the usefulness of the thread name cache used in + JULI. Pull request provided by t-gergely. (markt) +

Coyote

+ 65563: Correct parsing of HTTP Content-Range + headers. Tomcat was incorrectly requiring an = character + after bytes. Fix based on pull request #449 by + Thierry Guérin. (markt) +
+ Correct a potential StackOverflowException with HTTP/2 and + sendfile. (markt) +
+ Further improvements in the management of the connection flow control + window. This addresses various bugs that caused streams to incorrectly + report that they had timed out waiting for an allocation from the + connection flow control window. (markt) +
+ 65577: Fix a AccessControlException reporting + when running an NIO2 connector with TLS enabled. (markt) +
+ Reclassify TLS ciphers that use AESCCM8 as medium security rather than + high security to align with recent changes in OpenSSL. (markt) +
+ Fix an issue that caused some Servlet non-blocking API reads of the HTTP + request body to incorrectly use blocking IO. (markt) +

Jasper

+ Fix the implementation of MethodExpression.getMethodInfo() + so that it returns the expected value rather than failing when the + method expression is defined with the parameter values in the expression + rather than the types being passed explicitly to + ExpressionFactory.createMethodExpression(). (markt) +

WebSocket

+ The internal upgrade handler should close the associated + WebConnection on destroy. (remm) +

Web applications

+ Clarify the JASPIC configuration options in the documentation web + application. (markt) +

Other

+ 65585: Update obsolete comments at the start of the + build.properties.default file. (markt) +

2021-09-10 Tomcat 9.0.53 (remm)

Catalina

+ Enable Tomcat to start if an (old) XML parser is configured that does + not support allow-java-encodings. A warning will be logged + if such an XML parser is detected. (markt) +
+ Change the behaviour of custom error pages. If an error occurs after the + response is committed, once the custom error page content has been added + to the response the connection is now closed immediately rather than + closed cleanly. i.e. the last chunk that marks the end of the response + body is no longer sent. This acts as an additional signal to the client + that the request experienced an error. (markt) +
+ 65479: When handling requests using JASPIC authentication, + ensure that PasswordValidationCallback.getResult() returns + the result of the password validation rather than always returning + false. Fixed via pull request #438 provided by + Robert Rodewald. (markt) +
+ Refactor the authenticators to delegate the check for preemptive + authentication to the individual authenticators where an authentication + scheme specific check can be performed. Based on pull request + #444 by Robert Rodewald. (markt) +
+ Improve the reusability of the UserDatabase by adding + intermediate concrete implementation classes and allowing to do + partial database updates on save. (remm) +
+ Add a UserDatabase implementation as a superset of the + DataSourceRealm functionality. (remm) +
+ Make sure the dynamic Principal returned by + UserDatabaseRealm stays up to date with the database + contents, and add an option to have it be static, similar to the other + realms. (remm) +
+ Add derby-*.jar to the list of JARs to skip when scanning + for TLDs, web fragments and annotations. (markt) +
+ #447. Correct JPMS metadata for catalina.jar. Pull request + provided by Hui Wang. (markt) +

Coyote

+ Correct a logic error that meant setting + certificateKeystoreFile to NONE did not have + the expected effect. NONE was incorrectly treated as a file + path. Patch provided by Mikael Sterner. (markt) +
+ 65505: When an HTTP header value is removed, ensure that the + order of the remaining header values is unchanged. (markt) +

WebSocket

+ 65506: Fix write timeout check that was using the read + timeout value. Patch submitted by Gustavo Mahlow. (remm) +

Web applications

+ Remove unnecessary Context settings from the examples web application. + (markt) +
+ Document default value for unpackWARs and related clean-up. + Pull request #439 provided by Robert Rodewald. (markt) +
+ Clarify the documentation of the compressionMinSize and + compressibleMimeType HTTP Connector + attributes. Pull request #442 provided by crisgeek. (markt) +

Other

+ Fix failing build when building on non-English locales. Pull request + #441 provided by Dachuan J. (markt) +
+ Update to JSign version 4.0 to enable code signing without the need for + the installation of additional client tools. (markt) +
+ Update the internal fork of Apache Commons BCEL to 40d5eb4 (2021-09-01, + 6.6.0-SNAPSHOT). Code clean-up only. (markt) +
+ Update the internal fork of Apache Commons Codec to fd44e6b (2021-09-01, + 1.16-SNAPSHOT). Minor refactoring. (markt) +
+ Add Apache Derby 10.14.2.0 to the testsuite dependencies, for JDBC + and DataSource testing. (remm) +
+ 65661: Update the internal fork of Apache Commons FileUpload + to 33d2d79 (2021-09-01, 2.0-SNAPSHOT). Refactoring and code clean-up. As + a result of Commons File Upload now using + java.nio.file.Files, applications using multi-part uploads + need to ensure that the JVM is configured with sufficient direct memory + to store all in progress multi-part uploads. (markt) +
+ Update the internal fork of Apache Commons Pool to 2.11.1 (2021-08-17). + Improvements, code clean-up and refactoring. (markt) +
+ Update the internal fork of Apache Commons DBCP to 2.9.0 (2021-08-03). + Improvements, code clean-up and refactoring. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.31 to + pick up Windows binaries built with OpenSSL 1.1.1l.(markt) +
+ Switch to the CDN as the primary download location for ASF dependencies. + (markt) +
+ Improvements to Chinese translations contributed by syseal, wolibo, + ZhangJieWen and DigitalFatCat. (markt) +
+ Improvements to Japanese translations contributed by tak7iji. (markt) +
+ Improvements to Korean translations. (woonsan) +

2021-08-06 Tomcat 9.0.52 (remm)

Catalina

+ 65476: Correct an error in some code clean-up that mean that + web application classes were not configured with the correct package. + (markt) +

not released Tomcat 9.0.51 (remm)

Catalina

+ 65411: Always close the connection when an uncaught + NamingException occurs to avoid connection locking. + Submitted by Ole Ostergaard. (remm) +
+ 65433: Correct a regression in the fix for 65397 + where a StringIndexOutOfBoundsException could be triggered + if the canonical path of the target of a symlink was shorter than the + canonical path of the directory in which the symlink had been created. + Patch provided by Cedomir Igaly. (markt) +
+ 65443: Refactor the CorsFilter to make it easier + to extend. (markt) +
+ To avoid unnecessary cache revalidation, do not add an HTTP + Expires header when setting adding an HTTP header of + CacheControl: private. (markt) +

Coyote

+ When writing an HTTP/2 response via sendfile (only enabled when + useAsyncIO is true) the connection flow control window was + sometimes ignored leading to various error conditions. sendfile now + checks both the stream and connection flow control windows before + writing. (markt) +
+ Add debug logging for writing an HTTP/2 response via sendfile. (markt) +
+ Correct bugs in the HTTP/2 connection flow control management that meant + it was possible for a connection to stall waiting for a connection flow + control window update that had already arrived. Any streams on that + connection that were trying to write when this happened would time out. + (markt) +
+ 65448: When using TLS with NIO, it was possible for a + blocking response write to hang just before the final TLS packet + associated with the response until the connection timed out at which + point the final packet would be sent and the connection closed. (markt) +
+ 65454: Fix a race condition that could result in a delay to + a new request. The new request could be queued to wait for an existing + request to finish processing rather than the thread pool creating a new + thread to process the new request. (markt) +
+ 65460: Correct a regression introduced in the previous + release in the change to reduce the number of small HTTP/2 window + updates sent for streams. A logic error meant that small window updates + for the connection were dropped. This meant that the connection flow + window slowly reduced over time until nothing could be sent. (markt) +

Web applications

+ 65404: Correct a regression in the fix for 63362 + that caused the server status page in the Manager web application to be + truncated if HTTP upgrade was used such as when starting a WebSocket + connection. (markt) +

Other

+ Improvements to Chinese translations contributed by ZhangJieWen and + chengzheyan. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations contributed by tak7iji. (markt) +
+ Improvements to Korean translations. (woonsan) +
+ Use of GraalVM native images no longer automatically disables JMX + support. JMX support may still be disabled by calling + org.apache.tomcat.util.modeler.Registry.disableRegistry(). + (markt) +

2021-07-02 Tomcat 9.0.50 (remm)

Jasper

+ Jakarta to Javax backport issue in tests. (remm) +

not released Tomcat 9.0.49 (remm)

Catalina

+ Refactor the RemoteIpValve to use the common utility method + for list to comma separated string conversion. (markt) +
+ Refactor JNDIRealm$JNDIConnection so its fields are + accessible to sub-classes of JNDIRealm. (markt) +
+ Fix serialization warnings in UserDatabasePrincipal + reported by SpotBugs. (markt) +
+ 65397: Calls to + ServletContext.getResourcePaths() no longer include + symbolic links in the results unless allowLinking has been + set to true. If a resource is skipped because of this + change, a warning will be logged as this typically indicates a + configuration issue. (markt) +

Coyote

+ 65368: Improve handling of clean closes of inbound TLS + connections. Treat them the same way as clean closes of non-TLS + connections rather than as unknown errors. (markt) +
+ Modify the HTTP/2 connector not to sent small updates for stream flow + control windows to the user agent as, depending on how the user agent is + written, this may trigger small writes from the user agent that in turn + trigger the overhead protection. Small updates for stream flow control + windows are now combined with subsequent flow control window updates for + that stream to ensure that all stream flow control window updates sent + from Tomcat are larger than overheadWindowUpdateThreshold. + (markt) +
+ Add additional debug logging to track the current state of the HTTP/2 + overhead count that Tomcat uses to detect and close potentially + malicious connections. (markt) +
+ Many HTTP/2 requests from browsers will trigger one overhead frame and + one non-overhead frame. Change the overhead calculation so that a + non-overhead frame reduces the current overhead count by 2 rather than + 1. This means that, over time, the overhead count for a well-behaved + connection will trend downwards. (markt) +
+ Change the initial HTTP/2 overhead count from -10 to + -10 * overheadCountFactor. This means that, regardless of + the value chosen for overheadCountFactor, when a connection + opens 10 overhead frames in a row will be required to trigger the + overhead protection. (markt) +
+ Increase the default overheadCountFactor from + 1 to 10 and change the reduction in overhead + count for a non-overhead frame from -2 to -20. + This allows for a larger range (0-20) to be used for + overheadCountFactor providing for finer-grained control. + (markt) +
+ Modify the parsing of HTTP header values that use the + 1#token to ignore empty elements as per RFC 7230 section 7 + instead of treating the presence of empty elements as an error. (markt) +
+ Expand the unit tests for HttpServlet.doHead() and correct + the flushing of the response buffer. The buffer used to behave as if it + was one byte smaller than the configured size. The buffer was flushed + (and the response committed if required) when the buffer was full. The + buffer is now flushed (and the response committed if required) if the + buffer is full and there is more data to write. (markt) +
+ Fix an issue where concurrent HTTP/2 writes (or concurrent reads) to the + same connection could hang and eventually timeout when async IO was + enabled (it is enabled by default). (markt) +

Jasper

+ 65390: Correct a regression in the fix for 65124 + and restore code that was removed in error leading to JSP compilation + failures in some circumstances. (markt) +
+ Update to the Eclipse JDT compiler 4.20. (markt) +
+ Add support for specifying Java 17 (with the value 17) as + the compiler source and/or compiler target for JSP compilation. If used + with an Eclipse JDT compiler version that does not support these values, + a warning will be logged and the latest supported version will used. + (markt) +
+ 65377: Update the Java code generation for JSPs not to use + the boxed primitive constructors as they have been deprecated in Java 9 + and marked for future removal in Java 16. valueOf() is now + used instead. (markt) +

WebSocket

+ Refactor the DigestAuthenticator to reuse a shared + SecureRandom instance rather than create a new one to + generate the cnonce if required. (markt) +

Web applications

+ 65385: Correct the link in the documentation web application + the Maven Central repository. (markt) +

Other

+ Update the OWB module to Apache OpenWebBeans 2.0.23. (remm) +
+ Update the CXF module to Apache CXF 3.4.4. (remm) +
+ 65369 / #422: Add the additional + --add-opens=... options required for running Tomcat on Java + 16 onwards to the service.bat script to align it with the + other start-up scripts. PR provided by MCMicS. (markt) +
+ Update JUnit to version 4.13.2. (markt) +
+ Update EasyMock to 4.3. (markt) +
+ Update Objenesis to 3.2. (markt) +
+ Update UnboundID to 6.0.0. (markt) +
+ Update CheckStyle to 8.43. (markt) +
+ Update SpotBugs to 4.2.3. (markt) +
+ Update OSGi annotations to 1.1.0. (markt) +

2021-06-15 Tomcat 9.0.48 (remm)

Coyote

+ Regression when generating reflection due to removed NIO classes + in 9.0.47. (remm) +

Other

+ Use JSign to integrate the build script with the code signing service to + enable release builds to be created on Linux as well as Windows. (markt) +

not released Tomcat 9.0.47 (remm)

Catalina

+ 65301: RemoteIpValve will now avoid getting + the local host name when it is not needed. (remm) +
+ 65308: NPE in JNDIRealm when no userRoleAttribute + is given. (fschumacher) +
+ #412: Add commented out, sample users for the Tomcat Manager app + to the default tomcat-users.xml file. Based on a PR by + Arnaud Dagnelies. (markt) +
+ #418: Add a new option, pass-through, to the + default servlet's useBomIfPresent initialization parameter + that causes the default servlet to leave any BOM in place when + processing a static file and not to use the BOM to determine the + encoding of the file. Based on a pull request by Jean-Louis Monteiro. + (markt) +
+ Add cookieName attribute to the SSO valve to configure the + SSO cookie name. (remm) +
+ #419: When processing POST requests of type + multipart/form-data for parts without a filename that are + added to the parameter map in String form, check the size of the part + before attempting conversion to String. Pull request provided by + tianshuang. (markt) +
+ 62912: Don't mutate an application provided content header if + it does not contain a charset. Also remove the outdated workaround for + the buggy Adobe Reader 9 plug-in for IE. (markt) +
+ AprLifecycleListener does not show dev version suffix for libtcnative + and libapr. (michaelo) +
+ Refactor principal handling in UserDatabaseRealm using + an inner class that extends GenericPrincipal. (remm) +
+ Enable the default doHead() implementation in + HttpServlet to correctly handle responses where the content + length needs to be represented as a long since it is larger than the + maximum value that can be represented by an int. (markt) +
+ Avoid synchronization on roles verification for the memory + UserDatabase. (remm) +
+ Fix the default doHead() implementation in + HttpServlet to correctly handle responses where the Servlet + calls ServletResponse.reset() and/or + ServletResponse.resetBuffer(). (markt) +
+ Fix the default doHead() implementation in + HttpServlet to correctly handle responses generated using + the Servlet non-blocking API. (markt) +

Coyote

+ 64943: Add support for Unix Domain Sockets to + org.apache.coyote.http11.Http11AprProtocol. Depends on + tomcat-native 1.2.26 and up. (minfrin) +
+ 65303: Fix a possible NullPointerException if + an error occurs on an HTTP/1.1 connection being upgraded to HTTP/2 or on + a pushed HTTP/2 stream. (markt) +
+ 65311: Fix a race condition in the + NioBlockingSelector that could cause a delay to select + operations. (markt) +
+ Simplify AprEndpoint socket bind for all platforms. (michaelo) +
+ Add back simplification of NIO block read and write, now better + validated in Tomcat 10. (remm) +
+ Optimize NIO selector handling for Java 11. (remm) +
+ 65340: Add missing check for a negative return value for + Hpack.decodeInteger in the HpackDecoder, + which could cause a NegativeArraySizeException exception. + Submitted by Thomas, and verified the fix is present in the donated + hpack code in a further update. (remm) +
+ Add debug logging for HTTP/2 HPACK header decoding. (markt) +
+ Correct parsing of HTTP headers consisting of a list of tokens so that a + header with an empty token is treated consistently regardless of whether + the empty token is at the start, middle or end of the list of tokens. + (markt) +
+ Remove support for the identity transfer encoding. The + inclusion of this encoding in RFC 2616 was an error that was corrected + in 2001. Requests using this transfer encoding will now receive a 501 + response. (markt) +
+ Process transfer encoding headers from both HTTP 1.0 and HTTP 1.1 + clients. (markt) +
+ Ensure that if the transfer encoding header contains the + chunked, that the chunked encoding is the + final encoding listed. (markt) +

Jasper

+ Review code used to generate Java source from JSPs and tags and remove + code found to be unnecessary. (markt) +
+ Refactor use of internal ChildInfo class to use compile + time type checking rather than run time type checking. (markt) +
+ 65358: Improve expression language method matching for + methods with varargs. Where multiple methods may match the provided + parameters, the method that requires the fewest varargs is preferred. + (markt) +
+ 65332: Add a commented out section in + catalina.policy that provides the necessary permissions to + compile JSPs with javac when running on Java 9 onwards with a security + manager. It is commented out as it will cause errors if used with + earlier Java versions. (markt) +

WebSocket

+ 65317: When using permessage-deflate, the + WebSocket connection was incorrectly closed if the uncompressed payload + size was an exact multiple of 8192. Based on a patch provided by Saksham + Verma. (markt) +
+ 65342: Correct a regression introduced with the fix for + 65262 that meant Tomcat's WebSocket implementation would only + work with Tomcat's implementation of the Java EE WebSocket API. (markt) +

Web applications

+ Improve the description of the maxConnections and + acceptCount attributes in the Connector section of the + documentation web application. (markt) +

Other

+ Improvements to French translations. (remm) +
+ Improvements to Korean translations. (woonsan) +
+ 65362: Correct a regression in the previous release. The + change to create OSGi Require-Capability sections in + manifests for Jakarta API JARs manually rather than with bnd annotations + did not add the necessary manual entries to the embedded JARs. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.30. Also + update the minimum recommended version to 1.2.30. (markt) +

2021-05-12 Tomcat 9.0.46 (markt)

Catalina

+ Allow APR connector creation using the listener with the flag and + the default HTTP/1.1 protocol. (rjung/remm) +
+ Expand coverage of unit tests for JNDIRealm using the UnboundID LDAP SDK + for Java. (markt) +
+ 65224: Ensure the correct escaping of attribute values and + search filters in the JNDIRealm. (markt) +
+ 65235: Add missing attributes to the MBean descriptor file + for the RemoteIpValve. (markt) +
+ 65244: HandlesTypes should include classes that use + the specified annotation types on fields or methods. (remm) +
+ 65251: Correct a regression introduced in 9.0.44 that meant + that the auto-deployment process may attempt a second, concurrent + deployment of a web application that is being deployed by the Manager + resulting in one of the deployments failing and errors being reported. + (markt) +
+ Improve the SSLValve so it is able to handle escaped + client certificate headers from Nginx. Based on a patch by Florent + Guillaume. (markt) +

Coyote

+ Ensure that all HTTP requests that contain an invalid character in the + protocol component of the request line are rejected with a 400 response + rather than some requests being rejected with a 505 response. (markt) +
+ When generating the error message for an HTTP request with an invalid + request line, ensure that all the available data is included in the + error message. (markt) +
+ 65272: Restore the optional HTTP feature that allows + LF to be treated as a line terminator for the request line + and/or HTTP headers lines as well as the standard CRLF. + This behaviour was previously removed as a side-effect of the fix for + CVE-2020-1935. (markt) +

Jasper

+ Review code used to generate Java source from JSPs and tags and remove + code found to be unnecessary. (markt) +
+ <servlet> entries in web.xml that include a + <jsp-file> element and a negative + <load-no-startup> element that is not the default + value of -1 will no longer be loaded at start-up. This + makes it possible to define a <jsp-file> that will + not be loaded at start-up. (markt) +
+ Allow the JSP configuration option + useInstanceManagerForTags to be used with Tags that are + implemented as inner classes. (markt) +

WebSocket

+ Refactor the way Tomcat passes path parameters to POJO end points to + simplify the code. (markt) +
+ 65262: Refactor the creation of WebSocket end point, decoder + and encoder instances to be more IoC friendly. Instances are now created + via the InstanceManager where possible. (markt) +

Web applications

+ 65235: Correct name of changeLocalName in the + documentation for the RemoteIpValve. (markt) +
+ 65265: Avoid getting the boot classpath when it is not + available in the Manager diagnostics. (remm) +

Other

+ Create OSGi Require-Capability sections in manifests for + Jakarta API JARs manually rather than via the + aQute.bnd.annotation.spi.ServiceConsumer annotation as this + triggers TCK failures for downstream consumers of the API JARs. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.28. + (markt) +
+ Update the OWB module to Apache OpenWebBeans 2.0.22. (remm) +
+ Update the CXF module to Apache CXF 3.4.3. (remm) +
+ Move SystemPropertySource to be a regular class to allow + more precise configuration if needed. The system property source will + still always be enabled. (remm) +
+ Improvements to Chinese translations. Provided by bytesgo. (mark) +
+ Improvements to French translations. (remm) +
+ Improvements to Korean translations. (woonsan) +

2021-04-06 Tomcat 9.0.45 (markt)

Catalina

+ Avoid NPE when a JNDI reference cannot be resolved in favor of a + NamingException. (remm) +
+ Avoid using reflection for setting properties on the webapp + classloader. Based on a patch submitted by Romain Manni-Bucau. (remm) +

Coyote

+ Improve consistency of OpenSSL error stack handling in the TLS engine, + and log all errors found as debug. (remm) +
+ Ensure that HTTP/2 streams are only recycled once as multiple attempts + to recycle an HTTP/2 stream may result in + NullPointerExceptions. (markt) +
+ Simplify the closing on an HTTP/2 stream when an error condition is + present. (markt) +
+ 64771: Prevent concurrent calls to + ServletInputStream.isReady() corrupting the input buffer. + (markt) +
+ 65179: Ensure that the connection level flow control window + from the client to the server is updated when handling DATA frames + received for completed streams else the flow control window may become + exhausted. (markt) +
+ 65203: Fix a regression introduced in 9.0.44 that meant that + an error during an asynchronous read broke all future asynchronous reads + associated with the same request instance. (markt) +
+ Disable keep-alive when inconsistent content delimitation is present in + a request. (remm) +

Jasper

+ Include the new org.apache.jasper.optimizations package in + the list of OSGi exported packages for the Jasper embedded JAR. Patch + provided by Sokratis Zappis. (markt) +
+ Add a new option for the trimSpaces configuration. + extended will attempt to remove leading and trailing + whitespace from template text and collapse sequences of whitespace and + newlines within template text into a single new line. Based on a pull + request by kamnani. (markt) +

Other

+ Implement the first phase of reproducible builds. Sequential builds on + the same machine now produce identical output provided that the Ant + property ant.tstamp.now is set. The minimum required Ant + version is now 1.9.10. (markt) +
+ Improvements to Chinese translations. Provided by Ruan Wenjun. (mark) +
+ Improvements to French translations. (remm) +
+ Improvements to Japanese translations. Provided by kfujino and + Shirayuking. (markt) +
+ Improvements to Korean translations. (woonsan) +
+ Update the packaged version of the Tomcat Native Library to 1.2.27. + (markt) +

2021-03-10 Tomcat 9.0.44 (markt)

Catalina

+ Revert an incorrect fix for a potential resource leak that broke + deployment via the Ant deploy task. (markt) +
+ Improve error message for failed ConfigurationSource lookups in the + Catalina implementation. (remm) +
+ 64938: Align the behaviour when null is passed + to the ServletResponse methods + setCharacterEncoding(), setContentType() and + setLocale() with the recent clarification from the Jakarta + Servlet project of the expected behaviour in these cases. (markt) +
+ 65135: Rename Context method + isParallelAnnotationScanning to + getParallelAnnotationScanning for consistency and ease + of use in JMX descriptors. (remm) +
+ Ensure that the AsyncListener.onError() event is triggered + when a I/O error occurs during non-blocking I/O. There were some cases + discovered where this was not happening. (markt) +
+ Make the non-blocking I/O error handling more robust by handling the + case where the application code swallows an IOException in + WriteListener.onWritePossible() and + ReadListener.onDataAvailable(). (markt) +
+ Correct syntax error in output of JsonErrorReportValve. + Pull request provided by Viraj Kanwade. (markt) +
+ Make the StandardContext.postWorkDirectory() protected + rather than private to help users wishing to customise the default + work directory behaviour. (markt) +

Coyote

+ 65118: Fix a potential NullPointerException when + pruning closed HTTP/2 streams from the connection. (markt) +
+ Avoid NullPointerException when a secure channel is closed before the + SSL engine was initialized. (remm) +
+ Ensure that the ReadListener's onError() event + is triggered if the client closes the connection before sending the + entire request body and the server is reading the request body using + non-blocking I/O. (markt) +
+ 65137: Ensure that a response is not corrupted as well as + incomplete if the connection is closed before the response is fully + written due to a write timeout. (markt) +
+ Related to bug 65131, make sure all errors from OpenSSL are + fully cleared, as there could be more than one error present after + an operation (confirmed in the OpenSSL API documentation). (remm) +
+ Make handling of OpenSSL read errors more robust when plain text data is + reported to be available to read. (markt) +
+ Correct handling of write errors during non-blocking I/O to ensure that + the associated AsyncContext was closed down correctly. + (markt) +

Web applications

+ 65136: Remove the restriction that prevented the Manager web + application deploying different web applications in parallel. This + required some refactoring, most notably to + HostConfig.check() and how it is used. (markt) +

Other

+ Update the OWB module to Apache OpenWebBeans 2.0.21. (remm) +
+ Update the CXF module to Apache CXF 3.4.2. (remm) +
+ Improvements to French translations. (remm) +
+ Improvements to Korean translations. (woonsan) +
+ Improvements to Brazilian Portuguese translations. Provided by Thiago. + (mark) +
+ Improvements to Russian translations. Provided by Azat. (mark) +
+ Improvements to Chinese translations. Provided by shawn. (mark) +
+ Update to bnd 5.3.0. (markt) +

2021-02-02 Tomcat 9.0.43 (markt)

Catalina

+ 65106: Fix the ConfigFileLoader handling of file URIs when + running under a security manager on some JREs. (markt) +

Coyote

+ Ensure that SNI provided host names are matched to SSL virtual host + configurations in a case insensitive manner. (markt) +
+ 65111: Free direct memory buffers in the APR connector. + (remm) +

not released Tomcat 9.0.42 (markt)

Catalina

+ 60781: Escape elements in the access log that need to be + escaped for the access log to be parsed unambiguously. + (fschumacher/markt) +
+ 64110: Add support for additional TLS related request + attributes that provide details of the protocols and ciphers requested + by a client in the initial TLS handshake. (markt) +
+ Let the RemoteCIDRValve inherit from + RequestFilterValve and support all of its features. + Especially add support for connector specific configuration + using addConnectorPort. (rjung) +
+ Add peerAddress to coyote request, which contains + the IP address of the direct connection peer. If a reverse proxy + sits in front of Tomcat and the protocol used is AJP or HTTP + in combination with the RemoteIp(Valve|Filter), + the peer address might differ from the remoteAddress. + The latter then contains the address of the client in front of the + reverse proxy, not the address of the proxy itself. + Support for the peer address has been added to the + RemoteAddrValve and RemoteCIDRValve with the new attribute + usePeerAddress. This can be used to restrict access + to Tomcat based on the reverse proxy IP address, which is especially + useful to harden access to AJP connectors. The peer address can also + be logged in the access log using the new %{peer}a + syntax. (rjung) +
+ Avoid uncaught InaccessibleObjectException on Java 16 trying to clear + references threads. (remm) +
+ 65033: Fix JNDI realm error handling when connecting to a + failed server when pooling was not enabled. (remm) +
+ 65047: If the AccessLogValve is unable to open + the access log file, include information on the current user in the + associated log message (markt) +

Coyote

+ Additional fix for 64830 to address an edge case that could + trigger request corruption with h2c connections. (markt) +
+ 64974: Improve handling of pipelined HTTP requests in + combination with the Servlet non-blocking IO API. It was possible that + some requests could get dropped. (markt) +
+ Add support for using Unix domain sockets for NIO when running + on Java 16 or later. This uses NIO specific + unixDomainSocketPath and + unixDomainSocketPathPermissions attributes. + Based on a PR submitted by Graham Leggett. (remm) +
+ 65001: Fix error handling for exceptions thrown from calls + to ReadListener and WriteListener. (markt) +
+ Avoid possible infinite loop in OpenSSLEngine.unwrap + when the destination buffers state is changed concurrently. (remm) +

Jasper

+ Add a new StringInterpreter interface that allows + applications to provide customised string attribute value to type + conversion within JSPs. This allows applications to provide a conversion + implementation that is optimised for the application. (markt) +
+ 64965: JspContextWrapper.findAttribute should + ignore expired sessions rather than throw an + IllegalStateException. (remm) +
+ Update to the Eclipse JDT compiler 4.18. (markt) +

Web applications

+ 65007: Clarify that the commands shown in the TLS + documentation for importing a signed TLS certificate from a certificate + authority are typical examples that may need to be adjusted in some + cases. (markt) +

Tribes

+ Work around DNS caching for the DNS provider of the cloud membership. + (jfclere) +

Other

+ Improvements to Chinese translations. Provided by leeyazhou and Yi Shen. + (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Korean translations. (woonsan) +
+ Update the packaged version of the Tomcat Native Library to 1.2.26. + (markt) +
+ Update the internal fork of Apache Commons Pool to 2.9.1-SNAPSHOT + (2021-01-15). (markt) +
+ Update the internal fork of Apache Commons DBCP to 2.9.0-SNAPSHOT + (2021-01-15). (markt) +
+ Migrate to new code signing service. (markt) +
+ Use java.nio.file.Path to test for one directory being a + sub-directory of another in a consistent way. (markt) +
+ Update to Commons Daemon 1.2.4. (markt) +
+ Improvements to Brazilian Portuguese translations. Provided by Rual + Zaninetti Rosa and Lucas. (markt) +
+ Improvements to Russian translations. Provided by Polina and Azat. + (markt) +
+ Update the NSIS Installer used to build the Windows installer to version + 3.06.1. (kkolinko) +

2020-12-08 Tomcat 9.0.41 (markt)

Catalina

+ 56181: Update the RemoteIpValve and RemoteIpFilter so that + calls to ServletRequest.getRemoteHost() are consistent with + the return value of ServletRequest.getRemoteAddr() rather + than always returning a value for the proxy. (markt) +
+ 56890: Align the behaviour of + ServletContext.getRealPath(String path) with the recent + clarification from the Servlet specification project. If the path + parameter does not start with / then Tomcat processes the + call as if / is appended to the beginning of the + provided path. (markt) +
+ 64080: Enhance the graceful shutdown feature. Includes a new + option for StandardService, + gracefulStopAwaitMillis, that allows a time to be + specified to wait for client connections to complete and close before + the Container hierarchy is stopped. (markt) +
+ 64921: Ensure that the LoadBalancerDrainingValve + uses the correct setting for the secure attribute for any session + cookies it creates. Based on a pull request by Andreas Kurth. (markt) +
+ 64947: Don't assume that the Upgrade header has + been set on the HttpServletResponse before any call is made + to HttpServletRequest.upgrade(). (markt) +
+ Ensure that values are not duplicated when manipulating the vary header. + Based on a pull request by Fredrik Fall. (markt) +

Coyote

+ 64944: Ensure that the bytesSent metric is correctly updated + when compression is enabled. (markt) +

WebSocket

+ 64951: Fix a potential file descriptor leak when WebSocket + connections are attempted and fail. Patch provided by Maurizio Adami. + (markt) +

Web applications

+ Correct a regression in the addition of the HTTP header security filter + to the examples web application that prevented the Servlet examples that + depend on the asynchronous API from functioning correctly. + (kkolinko/markt) +

Tribes

+ Start all core threads when starting the receiver and dispatch + interceptor. (kfujino) +

Other

+ Update the OWB module to Apache OpenWebBeans 2.0.20. (remm) +
+ Update the CXF module to Apache CXF 3.4.1. (remm) +
+ 64931: Implement validation of changelog.xml + file at build time. (kkolinko) +
+ Update to Maven Ant Resolver Tasks 1.3.0. (markt) +
+ 62695: Provide SHA-256 and SHA-512 checksums for files + published via Maven. (markt) +

2020-11-17 Tomcat 9.0.40 (markt)

Catalina

+ 55559: Add a new attribute, localJndiResource, + that allows a UserDatabaseRealm to obtain a UserDatabase instance from + the local (web application) JNDI context rather than the global JNDI + context. This option is only useful when the Realm is defined on the + Context. (markt) +
+ 64805: Correct imports used by JMXProxyServlet. + (markt) +
+ Fix JNDIRealm pooling problems retrying on another bad connection. Any + retries are made on a new connection, just like with the single + connection scenario. Also remove all connections from the pool after + an error. (remm) +
+ Remove the entry for org.apache.tomcat.util.descriptor.tld.LocalStrings + from tomcat-embed-core's GraalVM tomcat-resource.json. It no more part of the jar + since + Fix unwanted JPMS dependency of embed-core on embed-jasper. (mgrigorov) +
+ Add org.apache.coyote.http11.Http11Nio2Protocol to the list of classes which could be instantiated + via reflection in GraalVM. (mgrigorov) +
+ Add JsonErrorReportValve that extends the + ErrorReportValve that returns response as JSON instead of + HTML. (kfujino) +
+ Add GraalVM config for Tomcat JNI related classes. This makes it + possible to use the APR protocol in GraalVM native images. + To use it add the following to the native-image arguments: + -H:JNIConfigurationResources=META-INF/native-image/org.apache.tomcat.embed/tomcat-embed-core/tomcat-jni.json + (mgrigorov) +
+ JNDIRealm connections should only be created with the container + classloader as the thread context classloader, just like for the JAAS + realm. (remm) +
+ 64871: Log a warning if Tomcat blocks access to a file + because it uses symlinks. (markt) +
+ Rename JDBCStore to DataSourceStore + and remove bottlenecks for database backed session store. The + JDBCStore is deprecated but remains unchanged. Patch + submitted by Philippe Mouawad. (remm) +

Coyote

+ Refactor the HTTP/2 window update handling for padding in data frames to + ensure that the connection window is correctly updated after a data + frame with zero length padding is received. (markt) +
+ Fix processing of URIs with %nn encoded solidus characters when + encodedSolidusHandling was set to passthrough + and the encoded solidus was preceded by other %nn encoded characters. + Based on a pull request by willmeck. (markt) +
+ 63362: Add collection of statistics for HTTP/2, WebSocket and + connections upgraded via the HTTP upgrade mechanism. (markt) +
+ Restore exception catch around Poller.events, as it would cause + the NIO poller thread to exit. This is a regression caused when + the Poller.events method was refactored. (remm) +
+ Provide messages for some SocketTimeoutException instances + that did not have one. (markt) +
+ Avoid most of the thread pool use during NIO2 socket accept. Patch + submitted by Anil Gursel. (remm) +
+ Add additional debug logging for I/O issues when communicating with the + user agent. (markt) +
+ 64830: Fix concurrency issue in HPACK decoder. (markt) +
+ Fix a concurrency issue in the NIO connector that could cause newly + created connections to be removed from the poller. (markt) +

Jasper

+ 64784: Don't include the time the Java file was generated as + a comment when generating Java files for JSPs and/or tags if the Java + file was created during pre-compilation. This is to aid repeatable + builds. (markt) +
+ 64794: Security exception reading system property on + JspRuntimeLibrary use. (remm) +
+ Add support for specifying Java 16 (with the value 16) as + the compiler source and/or compiler target for JSP compilation. If used + with an ECJ version that does not support these values, a warning will + be logged and the latest supported version will used. (markt) +
+ Update to the Eclipse JDT compiler 4.17. (markt) +
+ 64849: Correct JPMS metadata for the Jakarta Expression + Language JARs to provide missing ServiceLoader information. (markt) +

WebSocket

+ 64848: Fix a variation of this memory leak when a write I/O + error occurs on a non-container thread. (markt) +

Web applications

+ 64799: Added missing resources to host-manager web app. (isapir) +
+ 64797: Align manager.xml template file in Host-Manager with + context.xml of real Manager web application. (isapir) +
+ Configure the examples web applications to set + SameSite=strict for all cookies, including session cookies, + created by the application. (markt) +
+ Configure the examples, Manager and Host Manager to use the HTTP header + security filter with default settings apart from no HSTS header. Based + on a suggestion by Debangshu Kundu. (markt) +

Other

+ Improvements to French translations. (remm) +
+ Improvements to Korean translations. (woonsan) +
+ Improvements to Russian translations. Provided by Azat. (markt) +
+ Align JPMS module names with current Jakarta EE expectations. (markt) +
+ 64870: Update to bnd 5.3.0-SNAPSHOT to work around a + JRE bug. + (markt) +

2020-10-09 Tomcat 9.0.39 (markt)

Catalina

+ The health check valve will now check the state of its associated + containers to report availability. (remm) +
+ Fix race condition when saving and recycling session in + PersistentValve. (kfujino) +
+ Deprecate the JDBCRealm. (markt) +
+ Correct numerous spellings throughout the code base. Based on a pull + request from John Bampton. (markt) +
+ 64715: Add PasswordValidationCallback to the JASPIC + implementation. Patch provided by Robert Rodewald. (markt) +
+ Allow using the utility executor for annotation scanning. Patch + provided by Jatin Kamnani. (remm) +
+ 64751: Correct the JPMS module descriptor so the embedded + JARs may be used with JPMS. (markt) +
+ When performing an incremental build, ensure bnd does not create + unwanted JPMS dependencies between embedded JARs. (markt) +
+ Add a bloom filter to speed up archive lookup and improve deployment + speed of applications with a large number of JARs. Patch + provided by Jatin Kamnani. (remm) +
+ Throw SQLException instead of + NullpointerException when failing to connect to the + database. (kfujino) +
+ 64735: Ensure that none of the methods on a + ServletContext instance always fail when running under a + SecurityManager. Pull request provided by Kyle Stiemann. (markt) +
+ 64765: Ensure that the number of currently processing threads + is tracked correctly when a web application is undeployed, long running + requests are being processed and + renewThreadsWhenStoppingContext is enabled for the web + application. (markt) +
+ Improve the error messages when running under JPMS without the necessary + options to enable reflection required by the memory leak prevention / + detection code. (markt) +
+ Add connection pooling to JNDI realm. (remm) +
+ When estimating the size of a resource in the static resource cache, + include a specific allowance for the path to the resource. Based on a + pull request by blueSky1825821. (markt) +

Coyote

+ Do not send an HTTP/2 PING frame to measure round-trip time when it is + known that the HTTP/2 connection is not in a good state. (markt) +
+ Ensure HTTP/2 timeouts are processed for idle connections. (markt) +
+ 64743: Correct a regression introduced in 9.0.37 that + caused a Connection: close header to be added to the + response if the Connector was configured with + maxSwallowSize=-1. (markt) +
+ When logging HTTP/2 debug messages, use consistent formatting for stream + identifiers. (markt) +
+ Correct some double counting in the code that tracks the number of + in-flight asynchronous requests. The tracking enables Tomcat to shutdown + gracefully when asynchronous processing is in use. (markt) +
+ Improve the error handling for the HTTP/2 connection preface when the + Connector is configured with useAsyncIO="true". + (markt) +
+ Refactor the handling of closed HTTP/2 streams to reduce the heap usage + associated with used streams and to retain information for more streams + in the priority tree. (markt) +
+ Don't send the Keep-Alive response header if the connection has been + explicitly closed. (markt) +
+ 64710: Avoid a BufferOverflowException if an + HTTP/2 connection is closed while the parser still has a partial HTTP/2 + frame in the input buffer. (markt) +

Jasper

+ Use lazy instantiation to improve the performance when working with + listeners added to the ELContext. Pull request provided by + Thomas Andraschko. (markt) +

Web applications

+ Configure the Manager and Host Manager applications to set + SameSite=strict for all cookies, including session cookies, + created by the application. (markt) +
+ Update the Manager How-To in the documentation web application to + clarify when a user may wish to deploy additional instances of the + Manager web application. (markt) +

Other

+ Update to Commons Daemon 1.2.3. This adds support to jsvc for + --enable-preview and native memory tracking (Procrun + already supported these features), adds some addition debug logging and + adds a new feature to Procrun that outputs the command to (re-)configure + the service with the current settings. (markt) +
+ When building, only rebuild JAR files (including OSGi and JPMS metadata) + if the contents has changed. (markt) +
+ Improvements to Chinese translations. Pull request provided by Yang + Yang. (markt) +
+ Expand coverage of Russian translations. Pull request provided by + Nikolay Gribanov. (markt) +
+ Update the OWB module to Apache OpenWebBeans 2.0.18. (remm) +
+ Update the CXF module to Apache CXF 3.4.0. (remm) +
+ Fix running service.bat when called from $CATALINA_HOME. + (markt) +
+ Complete the fix for 63815. Users wishing to use system + properties that require quoting with catalina.sh and the + debug option must use a JRE that includes the fix for JDK-8234808. + (markt) +
+ Improvements to Chinese translations. Provided by leeyazhou. (markt) +
+ Improvements to Czech translations. Provided by Dušan Hlaváč and Arnošt + Havelka. (markt) +
+ Improvements to French translations. (remm) +
+ Improvements to Korean translations. (woonsan) +
+ Improvements to Spanish translations. Provided by Andrewlanecarr. + (markt) +

2020-09-15 Tomcat 9.0.38 (markt)

Catalina

+ 64582: Pre-load the CoyoteOutputStream class to + prevent a potential exception when running under a security manager. + Patch provided by Johnathan Gilday. (markt) +
+ 64593: If a request is not matched to a Context, delay + issuing the 404 response to give the rewrite valve, if configured, an + opportunity to rewrite the request. (remm/markt) +
+ Change top package name for generated embedded classes to avoid + conflict with default host name on case insensitive filesystems. + (remm) +
+ Add missing code generation for remaining digester rules. (remm) +
+ Add a dedicated loader for generated code to avoid dynamic class + loading. (remm) +
+ Refactor the Default servlet to provide a single method that can be + overridden (generateETag()) should a custom entity tag + format be required. (markt) +
+ Improve the validation of entity tags provided with conditional + requests. Requests with headers that contain invalid entity tags will be + rejected with a 400 response code. Improve the matching algorithm used + to compare entity tags in conditional requests with the entity tag for + the requested resource. Based on a pull request by Sergey Ponomarev. + (markt) +
+ Correct the description of the storage format for salted hashes in the + Javadoc for MessageDigestCredentialHandler and refactor the + associated code for clarity. + Based on a patch provided by Milo van der Zee. (markt) +
+ Correct the path validation to allow the use of the file system root for + the docBase attribute of a Context. Note that + such a configuration should be used with caution. (markt) +
+ Added filtering expression for requests that are not supposed to use + session in PersistentValve. (kfujino) +
+ Use the correct method to calculate session idle time in + PersistentValve. (kfujino) +
+ Fix path used by the health check valve when it is not associated with + a Context. (remm) +
+ 64712: The JASPIC authenticator now checks the + ServerAuthModule for + jakarta.servlet.http.authType and, if present, uses the + value provided. Based on a patch by Robert Rodewald. (markt) +
+ 64713: The JASPIC authenticator now checks the value of + jakarta.servlet.http.registerSession set by the + ServerAuthModule when deciding whether or nor to register + the session. Based on a patch by Robert Rodewald. (markt) +

Coyote

+ 57661: For requests containing the + Expect: 100-continue header, add optional support to delay + sending an intermediate 100 status response until the servlet reads the + request body, allowing the servlet the opportunity to respond without + asking for the request body. Based on a pull request by malaysf. (markt) +
+ Refactor the implementation of + ServletInputStream.available() to provide a more accurate + return value, particularly when end of stream has been reached. (markt) +
+ Refactor the stopping of the acceptor to ensure that the acceptor thread + stops when a connector is started immediately after it is stopped. + (markt) +
+ 64614: Improve compatibility with FIPS keystores. When a FIPS + keystore is configured and the keystore contains multiple keys, the + alias attribute will be ignored and the key used will be implementation + dependent. (jfclere) +
+ 64621: Improve handling HTTP/2 stream reset frames received + from clients. (markt) +
+ 64660: Avoid a potential NPE in the AprEndpoint if a socket + is closed in one thread at the same time as the poller is processing an + event for that socket in another. (markt) +
+ 64671: Avoid several potential NPEs introduced in the changes + in the previous release to reduce the memory footprint of closed HTTP/2 + streams. (markt) +
+ Refactor the HTTP/2 implementation to more consistently return a stream + closed error if errors occur after a stream has been reset by the + client. (markt) +
+ Improve handling of HTTP/2 stream level flow control errors and notify + the stream immediately if it is waiting for an allocation when the flow + control error occurs. (markt) +
+ Ensure that window update frames are sent for HTTP/2 connections to + account for DATA frames containing padding including when the associated + stream has been closed. (markt) +
+ Ensure that window update frames are sent for HTTP/2 connections and + streams to account for DATA frames containing zero-length padding. + (markt) +
+ 64710: Revert the changes to reduce the memory footprint of + closed HTTP/2 streams as they triggered multiple regressions in the form + of NullPointerExceptions. (markt) +
+ Ensure that the HTTP/2 overhead protection check is performed after + each HTTP/2 frame is processed. (markt) +

WebSocket

+ Requests received via proxies may be marked as using the ws + or wss protocol rather than http or + https. Ensure that such requests are not rejected. PR + provided by Ronny Perinke. (markt) +
+ 64848: Fix a potential issue where the write lock for a + WebSocket connection may not be released if an exception occurs during + the write. (markt) +
+ 64644: Add support for a read idle timeout and a write idle + timeout to the WebSocket session via custom properties in the user + properties instance associated with the session. Based on a pull request + by sakshamverma. (markt) +

Web applications

+ Remove the localization of the text output of the Manager application + list of contexts and the Host Manager application list of hosts so that + the output is more consistent. PR provided by Holomark. (markt) +
+ Clean-up / standardize the XSL files used to generate the documentation. + PR provided by John Bampton. (markt) +
+ 62723: Clarify the effects of some options for cluster + channelSendOptions. Patch provided by Mitch Claborn. + (schultz) +
+ Remove the out of date functional specification section from the + documentation web application. (markt) +
+ Extracted CSS styles from the Manager we application for better code + maintenance and replaced the GIF logo with SVG. (isapir) +
+ Add document for PersistentValve. (kfujino) +

Other

+ Correct a regression in the fix for 64540 and include + org.apache.tomcat.util.modeler.modules and + org.apache.tomcat.util.net.jsse in the list of exported + packages. (markt) +
+ Remove the local copy of javax.transaction.xa package which + is only used during compilation. The package is provided by the JRE from + Java 1.4 onwards so the local copy should be unnecessary. (markt) +
+ Improve the quality of the Japanese translations provided with Apache + Tomcat. Includes contributions from Yuki Shira. (markt) +
+ 64645: Use a non-zero exit code if the + service.bat does not complete normally. (markt) +
+ Update the internal fork of Apache Commons BCEL to 6.5.0. Code clean-up + only. (markt) +
+ Update the internal fork of Apache Commons Codec to 53c93d0 (2020-08-18, + 1.15-SNAPSHOT). Code clean-up. (markt) +
+ Update the internal fork of Apache Commons FileUpload to c25a4e3 + (2020-08-26, 2.0-SNAPSHOT). Code clean-up and RFC 2231 support. (markt) +
+ Update the internal fork of Apache Commons Pool to 2.8.1. Code clean-up + and improved abandoned pool handling. (markt) +
+ Update the internal fork of Apache Commons DBCP to 6d232e5 (2020-08-11, + 2.8.0-SNAPSHOT). Code clean-up various bug fixes. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.25. + (markt) +

2020-07-05 Tomcat 9.0.37 (markt)

Catalina

+ Remove the error message on start if java.io.tmpdir is + missing and add an explicit error message on application deployment when + the sole feature that depends on it (anti-resource locking) is + configured and can't be used. (markt) +
+ Implement a significant portion of the TLS environment variables for + the rewrite valve. (remm) +
+ 64506: Correct a potential race condition in the resource + cache implementation that could lead to + NullPointerExceptions during class loading. (markt) +
+ Add application/wasm to the media types recognised by + Tomcat. Based on a PR by Thiago Henrique Hüpner. (markt) +
+ Fix a bug in HttpServlet so that a 405 + response is returned for an HTTP/2 request if the mapped servlet does + implement the requested method rather than the more general + 400 response. (markt) +
+ Add generated classes using Tomcat embedded as an optional replacement + for the Catalina configuration files. (remm) +
+ 64541: Refactor the DTD used to validate + mbeans-descriptors.xml files to avoid issues when XML + entity expansion is limited or disabled. (markt) +

Coyote

+ Include a Connection: close HTTP header when committing a + response and it is known that the maxSwallowSize limit is + going to be exceeded. (markt) +
+ 64509: Correctly parse RFC 2109 version 1 cookies that use a + comma as a separator between cookies when using the RFC 6265 cookie + processor. Based on a patch by W J Carpenter. (markt) +
+ Fix the utility code that converted IPv6 addresses to a canonical form + to correctly handle input addresses that ended with a pair of colons. + Based on a patch by syarramsetty-skyhook. (markt) +
+ Correctly parse RFC 2109 version 1 cookies that have additional linear + white space around cookie attribute names and values when using the RFC + 6265 cookie processor. (markt) +
+ Once an HTTP/2 stream has been closed, ensure that the code that cleans + up references that are no longer required is called. (markt) +
+ Reduce the memory footprint of closed HTTP/2 streams. (markt) +
+ Ensure that the HTTP/1.1 processor is correctly recycled when a direct + connection to h2c is made. (markt) +

Cluster

+ 64560: Refactor the replication of a changed session ID for a + replicated session so that the list of changes associated with the + session is not reset when the session ID changes. (markt) +

WebSocket

+ 64563: Add additional validation of payload length for + WebSocket messages. (markt) +
+ Correct the calculation of payload length when four or more bytes are + required to represent the payload length. (markt) +

Other

+ 64498: Fix incorrect version format in OSGi manifests. Patch + provided by Raymond Augé. (markt) +
+ 64501: Refactor the handling of the deprecated + LOGGING_CONFIG environment variable to avoid using a POSIX + shell feature that is not available by default on Solaris 10. (markt) +
+ 64513: Remove bndlib from dependencies as it is not required. + Pull request provided by Raymond Augé. (markt) +
+ 64515: Bnd files don't need to be filtered (save some work). + Pull request provided by Raymond Augé. (markt) +
+ Update the OWB module to Apache OpenWebBeans 2.0.17. (remm) +
+ 64514: Fixes some missing class dependency issues in bootstrap + to address packaging/dependency concerns for JPMS and OSGi. Pull request + provided by Raymond Augé. (markt) +
+ 64521: Avoid moving i18n translations into classes dir since + they are packaged into separate jars. Pull request provided by Raymond + Augé. (markt) +
+ 64522: Package jars in effective dependency order. Pull + request provided by Raymond Augé. (markt) +
+ Store common build details in a shared build-defaults.bnd. Pull + request provided by Raymond Augé. (markt) +
+ 64532: Update to bnd 5.1.1. Pull request provided by Raymond + Augé. (markt) +
+ 64540: Switch from bndwrap task to bnd task, begin generating + a better manifest and make sure the resulting jar contents are correct. + Pull request provided by Raymond Augé. (markt) +
+ 64544: Add built libs to the bnd classpath for introspection. + Pull request provided by Raymond Augé. (markt) +
+ Improve the quality and expand the coverage of the French translations + provided with Apache Tomcat. (remm) +
+ 64548: Generate JPMS metadata. (rotty3000) +

2020-06-07 Tomcat 9.0.36 (markt)

Catalina

+ 64432: Correct a refactoring regression that broke handling + of multi-line configuration in the RewriteValve. Patch provided by Jj. + (markt) +
+ Fix use of multiple parameters when defining RewriteMaps. + (remm/fschumacher) +
+ Add the special internal rewrite maps for case modification and + escaping. (remm/fschumacher) +
+ Correct a regression in an earlier fix that broke the loading of + configuration files such as keystores via URIs on Windows. (markt) +
+ 64470: The default value of the solidus handling should + reflect the associated system property. (remm) +
+ Implement a few rewrite SSL env that correspond to Servlet request + attributes. (remm) +
+ 64442: Be more flexible with respect to the ordering of + groups, roles and users in the tomcat-users.xml file. + (fschumacher) +
+ 64493: Revert possible change of returned protocol + attribute value on the Connector. (remm) +

Coyote

+ Add support for ALPN on recent OpenJDK 8 releases. (remm) +
+ 64467: Improve performance of closing idle HTTP/2 streams. + (markt) +
+ Expose server certificate through the SSLSupport + interface. (remm) +
+ 64483: Log a warning if an AJP request is rejected because it + contains an unexpected request attribute. (markt) +
+ 64485: Fix possible resource leak getting last modified from + ConfigurationSource.Resource. (remm) +

Jasper

+ 64488: Ensure that the ImportHandler from the Expression + Language API is able to load classes from the Java runtime when running + under a SecurityManager. Based on a patch by Volodymyr Siedleck. (markt) +

WebSocket

+ Consistently throw a DeploymentException when an invalid + endpoint path is specified and catch invalid endpoint paths earlier. + (markt) +
+ Include the target URL in the log message when a WebSocket connection + fails. (markt) +

Other

+ Update the list of known Charsets in the + CharsetCache to include ISO-8859-16, added in + OpenJDK 15. (markt) +
+ Improve the quality and expand the coverage of the French translations + provided with Apache Tomcat. (remm) +
+ 64430: Add support for the CATALINA_OUT_CMD + environment variable that defines a command to which captured stdout and + stderr will be redirected. Patch provided by Harald Dunkel. (markt) +
+ Switch from the unsupported Maven Ant Tasks to the supported Maven + Resolver Ant Tasks to upload artifacts to the ASF Maven repository (and + from there to Maven Central). (markt) +
+ Update dependency on bnd to 5.1.0. (markt) +

2020-05-11 Tomcat 9.0.35 (markt)

Catalina

+ Reduce reflection use and remove AJP specific code in the Connector. + (remm/markt/fhanik) +
+ Rework the fix for 64021 to better support web applications + that use a custom class loader that loads resources from non-standard + locations. (markt) +
+ Remove redundant sole path/URI from error page message on SC_NOT_FOUND. + (michaelo) +
+ Log a warning if a CredentialHandler instance is added to + an instance of the CombinedRealm (or a sub-class) as the + CombinedRealm doesn't use a configured + CredentialHandler and it is likely that a configuration + error has occurred. (markt) +
+ Add more descriptive error message in DefaultServlet for SC_NOT_FOUND. + (michaelo) +
+ 59203: Before calling Thread.stop() (if + configured to do so) on a web application created thread that is not + stopped by the web application when the web application is stopped, try + interrupting the thread first. Based on a pull request by Govinda + Sakhare. (markt) +
+ 64309: Improve the regular expression used to search for + class loader repositories when bootstrapping Tomcat. Pull request + provided by Paul Muriel Biya-Bi. (markt) +
+ 64384: Fix multipart configuration ignoring some parameters + in some cases. (schultz) +
+ 64386: WebdavServlet does not send "getlastmodified" + property for resource collections. (michaelo) +
+ Remove reason phrase on WebDAV Multi-Status (207) response. (michaelo) +
+ 64398: Change default value separator for property + replacement to :- due to possible conflicts. The + syntax is now ${name:-default}. (remm) +
+ Improve validation of storage location when using FileStore. (markt) +

Coyote

+ Move SocketProperties mbean to its own type rather than + use a subType to improve robustness with tools. (remm) +
+ Include the problematic data in the error message when reporting that + the provided request line contains an invalid component. (markt) +
+ Improve the handling of requests that use an expectation. Do not disable + keep-alive where the response has a non-2xx status code but the request + body has been fully read. (rjung/markt) +
+ 64403: Ensure that compressed HTTP/2 responses are not sent + with a content length header appropriate for the original, uncompressed + response. (markt) +

Jasper

+ Remove redundant sole path/URI from error page message on SC_NOT_FOUND. + (michaelo) +
+ Add more descriptive error message in DefaultServlet for SC_NOT_FOUND. + (michaelo) +
+ 64373: When a tag file is packaged in a WAR and then that WAR + is unpacked in /WEB-INF/classes ensure that the tag file + can still be found. Patch provided by Karl von Randow. (markt) +
+ Ensure that the Jasper code that interfaces with the Eclipse Compiler + for Java (ECJ) enables Jasper to compile JSPs using ECJ 4.14 onwards + when the JSPs have inner classes. (markt) +

Web applications

+ Fix the saving of a Context configuration file via the scripting + interface of the Manager web application. (markt) +
+ Add a section to the TLS Connector documentation on different key store + types and how to configure them. (markt) +

Other

+ Update JUnit to version 4.13. (markt) +
+ Add missing entries to test class path in sample NetBeans configuration + files. Patch provided by Brian Burch. (markt) +
+ Refactor to use parameterized Collection constructors where + possible. Pull request provided by Lars Grefer. (markt) +
+ Refactor to use empty arrays with Collections.toArray(). + Pull request provided by Lars Grefer. (markt) +
+ Refactor loops with a condition to exit as soon as the condition is met. + Pull request provided by Lars Grefer. (markt) +
+ Refactor bulk addition to collections to use addAll() + rather than a loop. Pull request provided by Lars Grefer. (markt) +
+ Improve the quality and expand the coverage of the French translations + provided with Apache Tomcat. (remm) +
+ Expand the coverage of the Chinese translations provided with Apache + Tomcat. Contributions provided by winsonzhao, ZhangJieWen and Lee + Yazhou. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.24. + (markt) +
+ Refactor to use enhanced for loops where possible. Pull request by Lars + Grefer. (markt) +
+ Improve IDE support for IntelliJ IDEA. Patch provided by Lars Grefer. + (markt) +
+ Improve the quality of the Japanese translations provided with Apache + Tomcat. Includes contributions from Yoshy. (markt) +
+ Improve the coverage and quality of the Korean translations provided + with Apache Tomcat. (woonsan) +
+ Update dependency on bnd to 5.0.1. (markt) +

2020-04-08 Tomcat 9.0.34 (markt)

Catalina

+ Ensure all URL patterns provided via web.xml are %nn decoded + consistently using the encoding of the web.xml file where specified and + UTF-8 where no explicit encoding is specified. (markt) +
+ Allow a comma separated list of class names for the + org.apache.tomcat.util.digester.PROPERTY_SOURCE + system property. (remm) +
+ 64149: Avoid NPE when using the access log valve without + a pattern. (remm) +
+ 64226: Reset timezone after parsing a date since the date + format is reused. Test case submitted by Gary Thomas. (remm) +
+ 64247: Using a wildcard for jarsToSkip should + not override a possibly present jarsToScan. Based on code + submitted by Iridias. (remm) +
+ 64265: Fix ETag comparison performed by the default servlet. + The default servlet always uses weak comparison. (markt) +
+ Add support for default values when using ${...} property + replacement in configuration files. Based on a pull request provided by + Bernd Bohmann. (markt) +

Coyote

+ When configuring an HTTP Connector, warn if the encoding specified for + URIEncoding is not a superset of US-ASCII as required by + RFC7230. (markt) +
+ Avoid always retrieving the NIO poller selection key when processing + to reduce sync. (remm) +
+ 64240: Ensure that HTTP/0.9 requests that contain additional + data on the request line after the URI are treated consistently. Such + requests will now always be treated as HTTP/1.1. (markt) +
+ Expose the HTTP/2 connection ID and stream ID to applications via the + request attributes org.apache.coyote.connectionID and + org.apache.coyote.streamID respectively. (markt) +
+ Replace the system property + org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH + with the Connector attribute encodedSolidusHandling that + adds an additional option to pass the %2f sequence through + to the application without decoding it in addition to rejecting such + sequences and decoding such sequences. (markt) +
+ Expose the associated HttpServletRequest to the + CookieProcessor when generating a cookie header so the + header can be tailored based on the properties of the request, such as + the user agent, if required. Based on a patch by Lazar Kirchev. (markt) +

Jasper

+ Update to the Eclipse JDT compiler 4.15. (markt) +
+ Add support for specifying Java 14 (with the value 14) and + Java 15 (with the value 15) as the compiler source and/or + compiler target for JSP compilation. If used with an ECJ version that + does not support these values, a warning will be logged and the latest + supported version will used. (markt) +

Cluster

+ Refactor the creation of DeltaRequest objects to make it + simpler to use custom implementations. Based on a pull request provided + by Thomas Stock. (markt) +

Web applications

+ Correct the documentation web application to remove references to the + org.apache.catalina.STRICT_SERVLET_COMPLIANCE system + property changing the default for the URIEncoding attribute + of the Connector. (markt) +
+ Correct the documentation web application to remove references to the + org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH + system property changing how the sequence %5c is + interpreted in a URI. (markt) +

Other

+ Improve the quality and expand the coverage of the French translations + provided with Apache Tomcat. Contribution provided by Tom Bens. (remm) +
+ Expand the coverage of the Chinese translations provided with Apache + Tomcat. Contribution provided by Lee Yazhou. (markt) +
+ 64270: Set the documented default umask of 0027 + when using jsvc via daemon.sh and allow the umask used to + be configured via the UMASK environment variable as it is + when using catalina.sh. (markt) +
+ Update the OWB module to Apache OpenWebBeans 2.0.16. (remm) +
+ Update the CXF module to Apache CXF 3.3.6. (remm) +
+ Deprecated the LOGGING_CONFIG environment variable and + replace it with the CATALINA_LOGGING_CONFIG environment + variable to avoid clashes with other components that use + LOGGING_CONFIG. (markt) +

2020-03-16 Tomcat 9.0.33 (markt)

Coyote

+ 64210: Correct a regression in the improvements to HTTP + header validation that caused requests to be incorrectly treated as + invalid if a CRLF sequence was split between TCP packets. + Improve validation of request lines, including for HTTP/0.9 requests. + (markt) +

Other

+ 64206: Correct regression introduced in 9.0.31 that meant + that the HTTP port specified when using the Windows Installer was + ignored and 8080 was always used. (markt) +

not released Tomcat 9.0.32 (markt)

Catalina

+ Store config compatibility with HostWebXmlCacheCleaner listener. (remm) +
+ Modify the RewriteValve to use + ServletRequest.getServerName() to populate the + HTTP_HOST variable rather than extracting it from the + Host header as this allows HTTP/2 to be supported. (markt) +
+ Switch Tomcat embedded to loading MIME type mappings from a property + file generated from the default web.xml so the MIME type + mappings are consistent regardless of how Tomcat is started. (markt) +
+ Missing store config attributes for Resources elements. (remm) +
+ 64153: Ensure that the parent for the web application class + loader is set consistently. (markt) +
+ 64166: Ensure that the names returned by + HttpServletResponse.getHeaderNames() are unique. (markt) +
+ Rename org.apache.tomcat.util.digester.Digester$EnvironmentPropertySource + to + org.apache.tomcat.util.digester.EnvironmentPropertySource. + The old class is still available but deprecated. Patch provided by Bernd + Bohmann. (markt) +
+ Add new attribute persistAuthentication to both + StandardManager and PersistentManager to + support authentication persistence. Patch provided by Carsten Klein. + (markt) +
+ 64184: Avoid repeated log messages if a + MemoryUserDatabase is configured but the specified + configuration file is missing. (markt) +
+ 64189: Expose the web application version String as a + ServletContext attribute named + org.apache.catalina.webappVersion. (markt) +

Coyote

+ When the NIO or APR/native connectors were configured with + useAsyncIO="true" and a zero length read or write was + performed, the read/write would time out rather than return immediately. + (markt) +
+ 64141: If using a CA certificate, remove a default value + for the truststore file when not using a JSSE configuration. (remm) +
+ Improve robustness of OpenSSLEngine shutdown. Based on code submitted + by Manuel Dominguez Sarmiento. (remm) +
+ Add the TLS request attributes used by IIS to the attributes that an AJP + Connector will always accept. (markt) +
+ A zero length AJP secret will now behave as if it has not been + specified. (remm) +
+ 64188: If an error occurs while committing or flushing the + response when using a multiplexing protocol like HTTP/2 that requires + the channel to be closed but not the connection, just close the channel + and allow the other channels using the connection to continue. Based on + a suggestion from Alejandro Anadon. (markt) +
+ Correct the semantics of getEnableSessionCreation and + setEnableSessionCreation for OpenSSLEngine. + Pull request provided by Alexander Scheel. (markt) +
+ 64192: Correctly handle case where unread data is returned to + the read buffer when the read buffer is non empty. Ensure a gathering + TLS read stops once the provided ByteBuffers are full or no more data is + available. (markt) +
+ 64195: Revert simplification of NIO block read and write, + deferred to Tomcat 10. (remm) +
+ Allow async requests to complete cleanly when the Connector is paused + before complete() is called on a container thread. (markt) +

Jasper

+ Parameterize JSP version and API class names in localization messages to + allow simpler re-use between major versions. (markt) +
+ Ensure that TLD files listed in the jsp-config section of + web.xml that are registered in the + uriTldResourcePathMap with the URI specified in + web.xml are also registered with the URI in the TLD file if + it is different. Patch provided by Markus Lottmann. (markt) +

Cluster

+ Fix cloud environment lookup order and add a dedicated + DNS_MEMBERSHIP_SERVICE_NAME environment for use with the + DNS membership provider. Submitted by Bernd Bohmann. (remm) +
+ Allow configuring the DNSMembershipProvider using the + dns alias. Submitted by Bernd Bohmann. (remm) +

Web applications

+ Add to the documentation for the JmxRemoteLifecycleListener + the requirement to use + -Dcom.sun.management.jmxremote.registry.ssl=false if TLS is + not being used else clients will be unable to connect to the JMX server. + (markt) +
+ Expand the documentation for the address attribute of the + AJP Connector and document that the AJP Connector also supports the + ipv6v6only attribute with the APR/Native implementation. + (markt) +

Other

+ Expand the coverage of the French translations provided with Apache + Tomcat. (remm) +
+ Expand the coverage of the Chinese translations provided with Apache + Tomcat. Contribution provided by BoltzmannWxd. (markt) +
+ Update the OWB module to Apache OpenWebBeans 2.0.15. (remm) +
+ Update the CXF module to Apache CXF 3.3.5. (remm) +
+ Expand the coverage of the Korean translations provided with Apache + Tomcat. Contributions provided by B. Cansmile Cha. (markt) +
+ Expand the coverage of the French translations provided with Apache + Tomcat. (remm) +
+ 64190: Add support for specifying milliseconds (using + S, SS or SSS) in the timestamp + used by JULI's OneLineFormatter. (markt) +

2020-02-11 Tomcat 9.0.31 (markt)

Catalina

+ Do not store username and password as session notes during + authentication if they are not needed. (kkolinko) +
+ Avoid useless environment restore when not using GSSCredential + in JNDIRealm. (remm) +
+ 58577: Respect the argument-count when searching for MBean + operations to invoke via the JMXProxyServlet. (schultz) +
+ 63691: Skip all jar and directory scanning when the wildcard + pattern "*" or "*.jar" is set or added to + tomcat.util.scan.StandardJarScanFilter.jarsToSkip. (isapir) +
+ 64005: Correct a regression in the static resource caching + changes introduced in 9.0.28. Avoid a NullPointerException + when working with the URL provided for the root of a packed WAR. (markt) +
+ 64006: Provide default configuration source based on the + current directory if none has been set, for full compatibility with + existing code. (remm) +
+ 64008: Clarify/expand the Javadoc for the + Tomcat#addWebapp() and related methods. (markt) +
+ Deprecate the JmxRemoteLifecycleListener as the features it + provides are now available in the remote JMX capability included with + the JRE. This listener will be removed in Tomcat 10 and may be removed + from Tomcat 9.0.x some time after 2020-12-31. (markt) +
+ 64011: JNDIRealm no longer authenticates to LDAP. + (michaelo) +
+ 64021: Ensure that container provided SCIs are always loaded + before application provided SCIs. Note that where both the container and + the application provide the same SCI, it is the application provided SCI + that will be used. (markt) +
+ SCI definitions from JARs unpacked into WEB-INF/classes are + now handled consistently and will always be found irrespective of + whether the web application defines a JAR ordering or not. (markt) +
+ 64023: Skip null-valued session attributes when deserializing + sessions. (schultz) +
+ Do not throw a NullPointerException when an MBean or operation cannot + be found by the JMXProxyServlet. (schultz) +
+ 64067: Allow more than one parameter when defining RewriteMaps. + (fschumacher) +
+ 64074: InputStreams for directories obtained + from resource URLs now return a directory listing consistent with the + behaviour of FileURLConnection. In addition to restoring + the behaviour that was lost as a result of the introduction of + CachedResourceURLConnection, it expands the feature to + include packedWARs and to take account of resource JARs. (markt) +
+ Refactor recycle facade system property into a new connector attribute + named discardFacades. (remm) +
+ 64089: Add ${...} property replacement support + to XML external entity definitions. (markt) +
+ Deprecate MappingData.contextPath as it is unused. (markt) +
+ Fix a problem that meant that remote host, address and port information + could be missing in the access log for an HTTP/2 request where the + connection was closed unexpectedly. (markt) +

Coyote

+ Simplify NIO blocking read and write. (remm) +
+ Ensure that Servlet Asynchronous processing timeouts fire when requests + are made using HTTP/2. (markt) +
+ Fix the corruption of the TLS configuration when using the deprecated TLS + attributes on the Connector if the configuration has already been set + via the new SSLHostConfig and + SSLHostConfigCertificate elements. (markt) +
+ 63966: Switch the message shown when using HTTP to connect to + an HTTPS port from ISO-8859-1 to UTF-8. (markt) +
+ 64007: Cancel selection key in poller before wrapper close to + avoid possible deadlock. (remm) +
+ Add support for RFC 5915 formatted, unencrypted EC key files when using + a JSSE based TLS connector. (markt) +
+ Correct a regression introduced in 9.0.28 that meant invalid tokens in + the Transfer-Encoding header were ignored rather than + treated as an error. (markt) +
+ Rename the HTTP Connector attribute rejectIllegalHeaderName + to rejectIllegalHeader and expand the underlying + implementation to include header values as well as names. (markt) +
+ Disable (comment out in server.xml) the AJP/1.3 connector by default. + (markt) +
+ Change the default bind address for the AJP/1.3 connector to be the + loopback address. (markt) +
+ Rename the requiredSecret attribute of the AJP/1.3 + Connector to secret and add a new attribute + secretRequired that defaults to true. When + secretRequired is true the AJP/1.3 Connector + will not start unless the secret attribute is configured to + a non-null, non-zero length String. (markt) +
+ Add a new attribute, allowedRequestAttributesPattern to + the AJP/1.3 Connector. Requests with unrecognised attributes will be + blocked with a 403. (markt) +

Jasper

+ Update the performance optimisation for using expressions in tags that + depend on uninitialised tag attributes with implied scope to make the + performance optimisation aware of the new public class + (java.lang.Record) added in Java 14. (markt) +
+ 64097: Replace the faulty custom services lookup used for + ExpressionFactory implementations with + ServiceLoader. (markt) +
+ Add a META-INF/services entry to jasper-el.jar so that the + Expression Language implementation can be discovered via the services + API. (markt) +

Cluster

+ 64043: Ensure that session ID changes are replicated during + form-authentication. (kfujino) +

Web applications

+ 64000: In the examples web application, where a Servlet + example includes i18n support, the Locale used should be based on the + request locale and not the server locale. (markt) +
+ Add additional information on securing AJP/1.3 Connectors. (markt) +

Other

+ 63995: Ensure statements are closed when a pooled JDBC + connection is passivated in Tomcat's fork of Commons DBCP2. (markt) +

2019-12-12 Tomcat 9.0.30 (markt)

Catalina

+ 63681: Introduce RealmBase#authenticate(GSSName, GSSCredential) + and friends. (michaelo) +
+ 63964: Correct a regression in the static resource caching + changes introduced in 9.0.28. URLs constructed from URLs obtained from + the cache could not be used to access resources. (markt) +
+ 63970: Correct a regression in the static resource caching + changes introduced in 9.0.28. Connections to URLs obtained for JAR + resources could not be cast to JarURLConnection. (markt) +
+ 63937: Add a new attribute to the standard + Authenticator implementations, + allowCorsPreflight, that allows the + Authenticators to be configured to allow CORS preflight + requests to bypass authentication as required by the CORS specification. + (markt) +
+ 63939: Correct the same origin check in the CORS filter. An + origin with an explicit default port is now considered to be the same as + an origin without a default port and origins are now compared in a + case-sensitive manner as required by the CORS specification. (markt) +
+ 63981: Allow multiple calls to + Registry.disableRegistry() without the second and + subsequent calls triggering the logging of a warning. Based on a patch + by Andy Wilkinson. (markt) +
+ 63982: CombinedRealm makes assumptions about principal implementation + (michaelo) +
+ 63983: Correct a regression in the static resource caching + changes introduced in 9.0.28. A large number of file descriptors were + opened that could reach the OS limit before being released by GC. + (markt) +
+ 63987: Deprecate Realm.getRoles(Principal). (michaelo) +
+ Add a unit test for the session FileStore implementation + and refactor loops in FileStore to use the ForEach style. + Pull request provided by Govinda Sakhare. (markt) +
+ Moved server-side include (SSI) module into a separate JAR library. (schultz) +
+ Refactor FORM authentication to reduce duplicate code and to ensure that + the authenticated Principal is not cached in the session when caching is + disabled. This is the fix for CVE-2019-17563. (markt/kkolinko) +

Coyote

+ Fix endpoint closeSocket and destroySocket discrepancies, in particular + in the APR connector. (remm) +
+ Harmonize maxConnections default value to 8192 across all connectors. + (remm) +
+ 63931: Improve timeout handling for asyncIO to ensure that + blocking operations see a SocketTimeoutException if one + occurs. (remm/markt) +
+ 63932: By default, do not compress content that has a strong + ETag. This behaviour is configurable for the HTTP/1.1 and HTTP/2 + connectors via the new Connector attribute + noCompressionStrongETag. (markt) +
+ 63949: Fix non blocking write problems with NIO due to the + need for a write loop. (remm) +
+ Simplify regular endpoint writes by removing write(Non)BlockingDirect. + All regular writes will now be buffered for a more predictable + behavior. (remm) +
+ Send an exception directly to the completion handler when a timeout + exception occurs for the operation, and add a boolean to make sure the + completion handler is called only once. (remm/markt) +
+ When reporting / logging invalid HTTP headers encode any non-printing + characters using the 0xNN form. (markt) +

WebSocket

+ Ensure a couple of very unlikely concurrency issues are avoided when + writing WebSocket messages. (markt) +

Web applications

+ Fix the broken re-try link on the error page for the FORM authentication + example in the JSP section of the examples web application. (markt) +
+ Improvements to CsrfPreventionFilter: additional logging, allow the + CSRF nonce request parameter name to be customized. + (schultz) +
+ Correct the documentation for the maxConnections attribute + of the Connector in the documentation web application. + (markt) +
+ Add the ability to set and display session attributes in the JSP FORM + authentication example to demonstrate session persistence across + restarts for authenticated sessions. (markt) +

Other

+ Correct the fix for 63815 (quoting the use of + CATALINA_OPTS and JAVA_OPTS when used in shell + scripts to avoid the expansion of *) as it caused various + regressions, particularly with daemon.sh. (markt) +
+ Update the OWB module to Apache OpenWebBeans 2.0.13. (remm) +
+ Support Java 11 in Graal Native Images with Graal 19.3+. (remm) +
+ Expand the search made by the Windows installer for a suitable Java + installation to include the 64-bit JDK registry entries and the + JAVA_HOME environment variable. Pull request provided by + Alexander Norz. (markt) +
+ Expand the coverage of the Korean translations provided with Apache + Tomcat. (woonsan) +
+ Expand the coverage of the French translations provided with Apache + Tomcat. (remm) +
+ Expand the coverage of the Chinese translations provided with Apache + Tomcat. Contributions provided by lins and 磊. (markt) +
+ Update the internal fork of Apache Commons BCEL to ff6941e (2019-12-06, + 6.4.2-dev). Code clean-up only. (markt) +
+ Update the internal fork of Apache Commons Codec to 9637dd4 (2019-12-06, + 1.14-SNAPSHOT). Code clean-up and a fix for CODEC-265. (markt) +
+ Update the internal fork of Apache Commons FileUpload to 2317552 + (2019-12-06, 2.0-SNAPSHOT). Refactoring. (markt) +
+ Update the internal fork of Apache Commons Pool 2 to 6092f92 (2019-12-06, + 2.8.0-SNAPSHOT). Clean-up and minor refactoring. (markt) +
+ Update the internal fork of Apache Commons DBCP 2 to a36390 (2019-12-06, + 2.7.1-SNAPSHOT). Minor refactoring. (markt) +

2019-11-21 Tomcat 9.0.29 (markt)

Catalina

+ Refactor JMX remote RMI registry creation. This is the fix for + CVE-2019-12418. (remm) +
+ Improvement to CsrfPreventionFilter: expose the latest available nonce + as a request attribute; expose the expected nonce request parameter + name as a context attribute. + (schultz) +

Coyote

+ 63835: Add support for Keep-Alive response header. (michaelo) +
+ Correct a logic bug in the NioEndpoint timeout handling + that meant a write timeout could be handled as a read timeout. (markt) +

Web applications

+ Add a warning regarding potential poor performance of the HTTP and AJP + connectors if socket.txBufSize is configured with an + explicit value rather than using the JVM default. (markt) +

Other

+ Improve OWB module based using custom shade appender. (remm) +
+ Add security filter in OWB module in addition to the valve for more flexibility. (remm) +

not released Tomcat 9.0.28 (markt)

Catalina

+ Bad paths for URIs can cause exceptions on Windows due to its + path separator, so wrap using an IOException. (remm) +
+ 63832: Properly mark container as FAILED when a JVM error + occurs on stop. (remm) +
+ Add more details on the usage of RewriteMap + functionality in the RewriteValve. (fschumacher) +
+ 63836 Ensure that references to the Host object are cleared + once the Host instance is destroyed. (markt) +
+ Ensure that, when static resource caching is enabled for a web + application, all access to static files (including JSP files) goes via + the cache so that a consistent view of the static files is seen. Prior + to this change it was possible to see an updated last modified time but + the content would be that prior to the modification. (markt) +
+ 63905 Clean up Tomcat CSS. (michaelo) +
+ 63909: When the ExpiresFilter is used without a + default and the response is served by the Default Servlet, ensure that + the filter processes the response if the Default Servlet sets a 304 (Not + Found) status code. (markt) +

Coyote

+ Ensure that ServletRequest.isAsyncStarted() returns + false once AsyncContext.complete() or + AsyncContext.dispatch() has been called during + AsyncListener.onTimeout() or + AsyncListener.onError(). (markt) +
+ 63816 and 63817: Correctly handle I/O errors after + asynchronous processing has been started but before the container thread + that started asynchronous processing has completed processing the + current request/response. (markt) +
+ 63825: When processing the Expect and + Connection HTTP headers looking for a specific token, be + stricter in ensuring that the exact token is present. (markt) +
+ 63829: Improve the check of the Content-Encoding + header when looking to see if Tomcat is serving pre-compressed content. + Ensure that only a full token is matched and that the match is case + insensitive. (markt) +
+ 63864: Refactor parsing of the transfer-encoding + request header to use the shared parsing code and reduce duplication. + (markt) +
+ 63865: Add Unset option to same-site cookies + and pass through None value if set by user. Patch provided + by John Kelly. (markt) +
+ 63879: Remove stack trace from debug logging on socket + wrapper close. (remm) +
+ Add connection tracking on the connector endpoint to remove excessive + concurrency in the protocol handler when maintaining an association + between the socket wrapper and its current processor. (remm) +
+ 63894: Ensure that the configured values for + certificateVerification and + certificateVerificationDepth are correctly passed to the + OpenSSL based SSLEngine implementation. (remm/markt) +
+ Improve cleanup after errors when setting socket options. (remm) +
+ 63859: Do not perform a blocking read after a + CPING message is received by the AJP connector because, if + the JK Connector is configured with + ping_mode="I", the CPING message + will not always be followed by the start of a request. (markt) +
+ Properly calculate all dynamic parts of the ErrorReportValve response + on the fly in + org.apache.coyote.http2.TestHttp2InitialConnection. + (michaelo) +

Jasper

+ 63897: Capture the timestamp of a JSP for the purposes of + modification tracking before the JSP is compiled to prevent a race + condition if the JSP is modified during compilation. Patch provided by + Karl von Randow. (markt) +
+ Fix a race condition that could mean changes to a modified JSP were not + visible to end users. (markt) +

WebSocket

+ 63913: Wrap any NullPointerExceptions throw by + the Inflater or Deflater used by the + PerMessageDeflate extension in an IOException + so that the error can be caught and handled by the WebSocket error + handling mechanism. (markt) +

Web applications

+ Correct the description of the default value for the server attribute in + the security How-To. (markt) +

Other

+ 63815: Quote the use of CATALINA_OPTS and + JAVA_OPTS when used in shell scripts to avoid the expansion + of *. Note that any newlines present in + CATALINA_OPTS and/or JAVA_OPTS will no longer + removed. (markt) +
+ 63826: Remove commons-daemon-native.tar.gz and + tomcat-native.tar.gz from the binary zip distributions for + Windows since compiled versions of those components are already + included within the zip distributions. (markt) +
+ 63838: Suppress reflexive access warnings when running the + unit tests on the command line. (markt) +
+ Add missing charsets from the HPE JVM on HP-UX to pass unit tests in + org.apache.tomcat.util.buf.TestCharsetCache. (michaelo) +
+ Update the CXF module to Apache CXF 3.3.4. (remm) +
+ Expand the coverage and quality of the French translations provided + with Apache Tomcat. (remm) +
+ Expand the coverage and quality of the Japanese translations provided + with Apache Tomcat. Patch provided by motohashi.yuki. (markt) +
+ Expand the coverage and quality of the Simplified Chinese translations + provided with Apache Tomcat. Contributions provided by rpo130, Mason + Shen, leeyazhou, winsonzhao, qingshi huang, Lay, Shucheng Hou and + Yanming Zhou. (markt) +
+ Expand the coverage and quality of the Brazilian Portuguese translations + provided with Apache Tomcat. Patch provided by Danielamorais. (markt) +

2019-10-11 Tomcat 9.0.27 (markt)

Catalina

+ Correct a regression introduced in 9.0.25 that prevented configuration + files from being loaded from the class path. (markt) +

Coyote

+ Use URL safe base 64 encoding rather than standard base 64 encoding when + generating or parsing the HTTP2-Settings header as part of + an HTTP upgrade to h2c as required by RFC 7540. (markt) +
+ 63765: NIO2 should try to unwrap after TLS handshake to + avoid edge cases. (remm) +
+ 63766: Ensure Processor objects are recycled when processing + an HTTP upgrade connection that terminates before processing switches to + the Processor for the upgraded protocol. (markt) +
+ Fix a memory leak introduced by the HTTP/2 timeout refactoring in 9.0.23 + that could occur when HTTP/2 or WebSocket was used. (markt) +

Jasper

+ Update to the Eclipse JDT compiler 4.13. (markt) +
+ Add GraalVM specific ELResolver to avoid BeanInfo use in BeanElResolver + if possible, as it needs manual reflection configuration. (remm) +
+ 63781: When performing various checks related to the + visibility of classes, fields an methods in the EL implementation, also + check that the containing module has been exported. (markt) +

Web Socket

+ 63753: Ensure that the Host header in a Web + Socket HTTP upgrade request only contains a port if a non-default port + is being used. (markt) +
+ When running on Java 9 and above, don't attempt to instantiate WebSocket + Endpoints found in modules that are not exported. (markt) +

Web Applications

+ Add base GraalVM documentation. (remm) +
+ Add Javadoc for the Common Annotations API implementation. (markt) +
+ Correct various typos in the comments, error messages and Javadoc. Patch + provided by 康智冬. (markt) +

jdbc-pool

+ When connections are validated without an explicit validation query, + ensure that any transactions opened by the validation process are + committed. Patch provided by Pascal Davoust. (markt) +

Other

+ Deprecate org.apache.tomcat.util.compat.TLS. + Its functionality was only used for unit tests in + org.apache.tomcat.util.net.TesterSupport + and has been moved there. (rjung) +
+ 63759: When installing Tomcat with the Windows installer, + grant sufficient privileges to enable the uninstaller to execute when + user account control is active. (markt) +
+ Use a build property to define the minimum supported Java version and + use that build property to reduce the number of edits required to update + the minimum supported Java version. (markt) +
+ Update the OWB module to Apache OpenWebBeans 2.0.12. (remm) +
+ Update the CXF module to Apache CXF 3.3.3. (remm) +
+ 63767: Update to Commons Daemon 1.2.2. This corrects a + regression in Commons Daemon 1.2.0 and 1.2.1 that caused the Windows + Service to crash on start when running on an operating system that had + not been fully updated. (markt) +

2019-09-19 Tomcat 9.0.26 (markt)

Other

+ Re-tagged to ensure that the source file for the changelog did not + contain an XML byte order mark. (markt) +

not released Tomcat 9.0.25 (markt)

Catalina

+ Avoid a possible InvalidPathException when obtaining a URI + for a configuration file. (markt) +
+ 63684: Wrapper never passed to + RealmBase.hasRole() for given security constraints. + (michaelo) +
+ 63740: Ensure configuration files are loaded correctly when a + Host is configured with an xmlBase. Patch + provided by uk4sx. (markt) +
+ Avoid a potential NullPointerException on Service stop if a + Service is embedded directly (i.e. with no Server) in an application + and JNDI is enabled. Patch provided by S. Ali Tokmen. (markt) +
+ Add a new PropertySource implementation, + EnvironmentPropertySource, that can be used to do property + replacement in configuration files with environment variables. Based on + a pull request provided by Thomas Meyer. (markt) +

Coyote

+ 63682: Fix a potential hang when using the asynchronous + Servlet API to write the response body and the stream and/or connection + window reaches 0 bytes in size. (markt) +
+ 63690: Use the average of the current and previous sizes when + calculating overhead for HTTP/2 DATA and + WINDOW_UPDATE frames to avoid false positives as a result + of client side buffering behaviour that causes a small percentage of + non-final DATA frames to be smaller than expected. (markt) +
+ 63706: Avoid NPE accessing https port with plaintext. (remm) +
+ Correct typos in the names of the configuration attributes + overheadDataThreshold and + overheadWindowUpdateThreshold. (markt) +
+ If the HTTP/2 connection requires an initial window size larger than the + default, send a WINDOW_UPDATE to increase the flow control window for the + connection so that the initial size of the flow control window for the + connection is consistent with the increased value. (markt) +
+ 63710: When using HTTP/2, ensure that a + content-length header is not set for those responses with + status codes that do not permit one. (markt) +
+ 63737: Correct various issues when parsing the + accept-encoding header to determine if gzip encoding is + supported including only parsing the first header found. (markt) +

Jasper

+ 63724: Correct a regression introduced in 9.0.21 that broke + compilation of JSPs in some configurations. (markt) +

Web applications

+ Correct the source code links on the index page for the ROOT web + application to point to Git rather than Subversion. (markt) +
+ Fix various issues with the Javadoc generated for the documentation web + application to enable release builds to be built with Java 10 onwards. + (markt) +
+ 63733: Remove the documentation for the "Additional + Components" since they have been removed / merged into the core + Tomcat distribution for 9.0.5 onwards. (markt) +
+ 63739: Correct the invalid Automatic-Module-Name + manifest entries for the Tomcat provided JARs included in the Tomcat + embedded distribution. (markt) +
+ Fix a large number of Javadoc and documentation typos. Patch provided by + KangZhiDong. (markt) +
+ Spelling and formatting corrections for the cluster how-to. Pull request + provided by Bill Mitchell. (markt) +

Other

+ Expand the coverage and quality of the French translations provided + with Apache Tomcat. (remm) +
+ Expand the coverage and quality of the Simplified Chinese translations + provided with Apache Tomcat. Includes contributions by leeyazhou and + 康智冬. (markt) +
+ 62140: Additional usage documentation in comments for + catalina.[bat|sh]. (markt) +
+ Fix JSSE_OPTS quoting in catalina.bat. + Contributed by Peter Uhnak. (fschumacher) +
+ 63625: Update to Commons Daemon 1.2.1. This corrects several + regressions in Commons Daemon 1.2.1, most notably the Windows Service + crashing on start when using 32-bit JVMs. (markt) +
+ 63689: Correct a regression in the fix for 63285 + that meant that when installing a service, the service display name was + not set. (markt) +
+ When performing a silent install with the Windows Installer, ensure that + the registry entries are added to the 64-bit registry when using a + 64-bit JVM. (markt) +
+ Remove unused i18n messages and associated translations. Patch provided + by KangZhiDong. (markt) +
+ Expand the coverage and quality of the Korean translations provided + with Apache Tomcat. (woonsan) +

2019-08-17 Tomcat 9.0.24 (markt)

Coyote

+ Remove the code in the sendfile poller that ensured smaller pollsets + were used with older, no longer supported versions of Windows that + could not support larger pollsets. (markt) +

not released Tomcat 9.0.23 (markt)

Catalina

+ 57665: Add support for the X-Forwarded-Host + header to the RemoteIpFilter and RemoteIpValve. + (markt) +
+ 62496: Add option to write auth information (remote user/auth type) + to response headers. (michaelo) +
+ 63550: Only try the alternateURL in the + JNDIRealm if one has been specified. (markt) +
+ 63556: Mark request as forwarded in RemoteIpValve and + RemoteIpFilter (michaelo) +
+ 63579: Correct parsing of malformed OPTIONS requests and + reject them with a 400 response rather than triggering an internal error + that results in a 500 response. (markt) +
+ 63608: Align the implementation of the negative match feature + for patterns used with the RewriteValve with the + description in the documentation. (markt) +
+ 63627: Implement more fine-grained handling in + RealmBase.authenticate(GSSContext, boolean). (michaelo) +
+ If an unhandled exception occurs on a asynchronous thread started via + AsyncContext.start(Runnable), process it using the standard + error page mechanism. (markt) +
+ Discard large byte buffers allocated using setBufferSize when recycling + the request. (remm) +
+ Avoid a NullPointerException in the + CrawlerSessionManagerValve if no ROOT Context is deployed + and a request does not map to any of the other deployed Contexts. Patch + provided by Jop Zinkweg. (markt) +
+ 63636: Context.findRoleMapping() never called + in StandardWrapper.findSecurityReference(). (michaelo) +

Coyote

+ Refactor the APR poller to always use a single pollset now that the + Windows operating systems that required multiple smaller pollsets to be + used are no longer supported. (markt) +
+ 63524: Improve the handling of PEM file based keys and + certificates that do not include a full certificate chain when + configuring the internal, in-memory key store. Improve the handling of + PKCS#1 formatted private keys when configuring the internal, in-memory + key store. (markt) +
+ Add callback when finishing the set properties rule in the digester. + (remm) +
+ 63568: Avoid error when trying to set tcpNoDelay on socket + types that do not support it, which can occur when using the NIO + inherited channel capability. Submitted by František Kučera. (remm) +
+ 63570: Fix regression retrieving local address with + the NIO connector. Submitted by Aditya Kadakia. (remm) +
+ Correct parsing of invalid host names that contain bytes in the range + 128 to 255 and reject them with a 400 response rather than triggering an + internal error that results in a 500 response. (markt) +
+ 63571: Allow users to configure infinite TLS session caches + and/or timeouts. (markt) +
+ 63578: Improve handling of invalid requests so that 400 + responses are returned to the client rather than 500 responses. (markt) +
+ Fix h2spec test suite failure. It is an error if a Huffman encoded + string literal contains the EOS symbol. (jfclere) +
+ Connections that fail the TLS handshake will now appear in the access + logs with a 400 status code. (markt) +
+ Timeouts for HTTP/2 connections were not always correctly handled + leaving some connections open for longer than expected. (markt) +
+ 63650: Refactor initialisation for JSSE based TLS connectors + to enable custom JSSE providers that provide custom cipher suites to be + used. (markt) +
+ Expand the HTTP/2 excessive overhead protection to cover various forms + of abusive client behaviour and close the connection if any such + behaviour is detected. (markt) +
+ Fix a crash on shutdown with the APR/native connector when a blocking + I/O operation was still in progress when the connector stopped. (markt) +

Cluster

+ Avoid failing Kubernetes membership (and preventing startup) if the + stream cannot be opened, to get the same behavior as the DNS based + membership. The namespace is still a failure on startup but it is easy + to provide. (remm) +
+ Avoid non fatal NPEs with Tribes when JMX is not available. (remm) +
+ Make Kube environment optional for Kube memberships, for easier testing + and Graal training. A warn log will occur if the environment is not + present. (remm) +

Web applications

+ 63597: Update the custom 404 error page for the Host Manager + to take account of previous refactoring so that the page is used for + 404 errors rather than falling back to the default error page. (markt) +

Other

+ JNDI support for GraalVM native images. (remm) +
+ JSP runtime library support for GraalVM native images. (remm) +
+ java.util.logging configuration for GraalVM native images. (remm) +
+ Update Checkstyle to 8.22. (markt) +
+ 55969: Tighten up the security of the Apache Tomcat + installation created by the Windows installer. Change the default + shutdown port used by the Windows installer from 8005 to + -1 (disabled). Limit access to the chosen installation + directory to local administrators, Local System and Local Service. + (markt) +
+ 62696: The digital signature for the Windows installer now + uses SHA-256 for hashes. (markt) +
+ 63285: Add an option to service.bat so that when + installing a Windows service, the name of the executables used by the + Windows service may be changed to match the service name. This + makes the installation behaviour consistent with the Windows installer. + The original executable names will be restored when the Windows service + is removed. The renaming can be enabled by using the new + --rename option after the service name. (markt) +
+ 63310: Update to Commons Daemon 1.2.0. This provides improved + support for Java 11. This also changes the user configured by the + Windows installer for the Windows service from Local System + to the lower privileged Local Service. (markt) +
+ Expand the coverage and quality of the French translations provided + with Apache Tomcat. (remm) +
+ 63555: Add Automatic-Module-Name entries for + each of the Tomcat provided JARs included in the Tomcat embedded + distribution. (markt) +
+ 63567: Restore the passing of $LOGGING_MANAGER + to the jvm in catalina.sh when calling stop. + (markt) +
+ Correct broken OSGi data in JAR file manifests. (markt) +
+ Add "embed" to the Bundle-Name and + Bundle-Symbolic-Name for the Tomcat embedded WebSocket JAR + to align the naming with the other embedded JARs and to differentiate it + from the standard WebSocket JAR that does not include the API classes. + (markt) +
+ Update dependency on bnd to 4.2.0. (markt) +
+ Update the internal fork of Commons Codec to 3ebef4a (2018-08-01) to + pick up the fix for CODEC-134. (markt) +
+ Update the internal fork of Commons Pool2 to 796e32d (2018-08-01) to + pick up the changes Commons Pool2 2.7.0. (markt) +
+ Update the internal fork of Commons DBCP2 to 87d9e3a (2018-08-01) to + pick up the changes Commons DBCP2 2.7.0 and DBCP-555. (markt) +
+ 63648: Update the test TLS keys and certificates used in the + test suite to replace the keys and certificates that are about to + expire. (markt) +

2019-07-09 Tomcat 9.0.22 (markt)

Catalina

+ Improve parsing of Range request headers. (markt) +
+ Range headers that specify a range unit Tomcat does not recognise should + be ignored rather than triggering a 416 response. Based on a pull + request by zhanhb. (markt) +
+ When comparing a date from a If-Range header, an exact + match is required. Based on a pull request by zhanhb. (markt) +
+ Add an option to the default servlet to disable processing of PUT + requests with Content-Range headers as partial PUTs. The default + behaviour (processing as partial PUT) is unchanged. Based on a pull + request by zhanhb. (markt) +
+ Improve parsing of Content-Range headers. (markt) +
+ Update the recommended minimum Tomcat Native version to 1.2.23. (markt) +

Coyote

+ Remove a source of potential deadlocks when using HTTP/2 when the + Connector is configured with useAsyncIO as + true. (markt) +
+ 63523: Restore SSLUtilBase methods as protected to preserve + compatibility. (remm) +
+ Fix typo in UTF-32LE charset name. Patch by zhanhb via Github. + (fschumacher) +
+ Once a URI is identified as invalid don't attempt to process it further. + Based on a PR by Alex Repert. (markt) +
+ Fix to avoid the possibility of long poll times for individual pollers + when using multiple pollers with APR. (markt) +
+ Refactor the fix for 63205 so it only applies when using + PKCS12 keystores as regressions have been reported with some other + keystore types. (markt) +

Jasper

+ Include file names if SMAP processor is unable to delete or rename a + class file during SMAP generation. (markt) +
+ Update to the Eclipse JDT compiler 4.12. (markt) +

WebSocket

+ 63521: As required by the WebSocket specification, if a POJO + that is deployed as a result of the SCI scan for annotated POJOs is + subsequently deployed via the programmatic API ignore the programmatic + deployment. (markt) +

Other

+ Switch the check for terminal availability to test for stdin as using + stdout does not work when output is piped to another process. Patch + provided by Radosław Józwik. (markt) +
+ Add user buildable optional modules for easier CDI 2 and JAX-RS + support. Also include a new documentation page describing how + to use it. (remm) +

2019-06-07 Tomcat 9.0.21 (markt)

Catalina

+ 57287: Add file sorting to DefaultServlet (schultz) +
+ Fix --no-jmx flag processing, which was called after + registry initialization. (remm) +
+ Ensure that a default request character encoding set on a + ServletContext is used when calling + ServletRequest#getReader(). (markt) +
+ Make a best efforts attempt to clean-up if a request fails during + processing due to an OutOfMemoryException. (markt) +
+ Improve the BoM detection for static files handled by the default + servlet for the rarely used UTF-32 encodings. Identified by Coverity + Scan. (markt) +
+ Ensure that the default servlet reads the entire global XSLT file if + one is defined. Identified by Coverity Scan. (markt) +
+ Avoid potential NullPointerException when generating an + HTTP Allow header. Identified by Coverity Scan. (markt) +
+ Add Context.createInstanceManager() for easier framework + integration. (remm) +
+ Add utility org.apache.catalina.core.FrameworkListener to + allow replicating adding a Listener to context.xml in a programmatic + way. (remm) +
+ Move Container.ADD_CHILD_EVENT to before the child + container start, and Container.REMOVE_CHILD_EVENT to + before removal of the child from the internal child collection. + (remm) +
+ Remove any fragment included in the target path used to obtain a + RequestDispatcher. The requested target path is logged as a + warning since this is an application error. (markt) +

Coyote

+ NIO poller seems to create some unwanted concurrency, causing rare + CI test failures. Add sync when processing async operation to avoid + this. (remm) +
+ Fix concurrency issue that lead to incorrect HTTP/2 connection timeout. + (remm/markt) +
+ Avoid useless exception wrapping in async IO. (remm) +
+ 63412: Security manager failure when using the async IO + API from a webapp. (remm) +
+ Remove acceptorThreadCount Connector attribute, + one accept thread is sufficient. As documented, value 2 + was the only other sensible value, but without and impact beyond + certain microbenchmarks. (remm) +
+ Avoid possible NPEs on connector stop. (remm) +
+ Remove pollerThreadCount Connector attribute for NIO, + one poller thread is sufficient. (remm) +
+ Add async IO for APR connector for consistency, but disable it by + default due to low performance. (remm) +
+ Avoid blocking write of internal buffer when using async IO. (remm) +
+ Refactor async IO implementation to the SocketWrapperBase. + (remm) +
+ Refactor SocketWrapperBase close using an atomic boolean + and a doClose method that subclasses will implement, with + a guarantee that it will be run only once. (remm) +
+ Decouple the socket wrapper, which is not recycled, from the NIOx + channel after close, and replace it with a dummy static object. (remm) +
+ Clear buffers on socket wrapper close. (remm) +
+ NIO2 failed to properly close sockets on connector stop. (remm) +
+ Reduce the default for maxConcurrentStreams on the + Http2Protocol from 200 to 100 to align with typical + defaults for HTTP/2 implementations. (markt) +
+ Reduce the default HTTP/2 header list size from 4GB to 32kB to align + with typical HTTP/2 implementations. (markt) +
+ Add support for same-site cookie attribute. Patch provided by John + Kelly. (markt) +
+ Drop legacy NIO double socket close (close channel, then close + socket). (remm) +
+ Fix HTTP/2 end of stream concurrency with async. (remm) +
+ Correct a bug in the stream flushing code that could lead to multiple + threads processing the stream concurrently which in turn could cause + errors processing the stream. (markt) +

Cluster

+ 62841: Refactor the DeltaRequest serialization + to reduce the window during which the DeltaSession is + locked and to remove a potential cause of deadlocks during + serialization. (markt) +
+ 63441: Further streamline the processing of session creation + messages in the DeltaManager to reduce the possibility of a + session update message being processed before the session has been + created. (markt) +

WebSocket

+ Fix timeout logic for async non blocking writes. Identified by + Coverity Scan. (remm) +

Web applications

+ Expand the explanation of how deprecated TLS configuration attributes + are converted to the new TLS configuration style. (markt) +

Tribes

+ Treat NoRouteToHostException the same way as + SocketTimeoutException when checking the health of group + members. This avoids a SEVERE log message every time the check is + performed when the host associated with a group member is not powered + on. (markt) +

Other

+ Switch from FindBugs to SpotBugs. (fschumacher) +
+ Start Graal native image compatibility, using the tomcat-maven + packaging. (remm) +
+ 63403: Fix TestHttp2InitialConnection test failures when + running with a non-English locale. (kkolinko) +
+ Add Graal JreCompat, and use it to disable JMX and URL stream handlers. + (remm) +
+ Expand the coverage and quality of the Czech translations provided + with Apache Tomcat. Includes contributions by Arnošt Havelka. (markt) +
+ Expand the coverage and quality of the German translations provided + with Apache Tomcat. Includes contributions by Niklasmerz, dusiema and + Jens. (markt) +
+ Expand the coverage and quality of the French translations provided + with Apache Tomcat. (remm) +
+ Expand the coverage and quality of the Simplified Chinese translations + provided with Apache Tomcat. Includes contributions by 諵. (markt) +
+ Use the test command to check for terminal availability + rather than the tty command since the tty + based test fails on non-English locales. (markt) +

2019-05-13 Tomcat 9.0.20 (markt)

Catalina

+ Fix some edge cases where the docBase was not being set using a canonical + path which in turn meant resource URLs were not being constructed as + expected. (markt) +
+ Fix a potential resource leak when executing CGI scripts from a WAR + file. Identified by Coverity scan. (markt) +
+ Fix a potential concurrency issue in the StringCache identified by + Coverity scan. (markt) +
+ Fix a potential concurrency issue in the main Sendfile thread of the APR + connector. Identified by Coverity scan. (markt) +
+ Fix a potential resource leak when running a web application from a WAR + file. Identified by Coverity scan. (markt) +
+ Fix a potential resource leak on some exception paths in the + DataSourceRealm. Identified by Coverity scan. (markt) +
+ Fix a potential resource leak on an exception path when parsing JSP + files. Identified by Coverity scan. (markt) +
+ Fix a potential resource leak when a JNDI lookup returns an object of an + in compatible class. Identified by Coverity scan. (markt) +
+ Refactor ManagerServlet to avoid loading classes when + filtering JNDI resources for resources of a specified type. (markt) +
+ 63324: Refactor the CrawlerSessionManagerValve + so that the object placed in the session is compatible with session + serialization with mem-cached. Patch provided by Martin Lemanski. + (markt) +
+ 63358: Expand the throwOnFailure support in the + Connector to include the adding of a Connector + to a running Service. (markt) +
+ 63361: Add a new method + (Registry.disableRegistry()) that can be used to disable + JMX registration of Tomcat components providing it is called before the + first component is registered. (markt) +
+ Avoid OutOfMemoryErrors and + ArrayIndexOutOfBoundsExceptions when accessing large files + via the default servlet when resource caching has been disabled. (markt) +
+ Avoid a NullPointerException when a Context is + defined in server.xml with a docBase but not + the optional path. (markt) +
+ 63333: Override the isAvailable() method in the + JAASRealm so that only login failures caused by invalid + credentials trigger account lock out when the LockOutRealm + is in use. Patch provided by jchobantonov. (markt) +
+ Add --no-jmx flag to allow disabling JMX in + startup.Tomcat.main. (remm) +

Coyote

+ The useAsyncIO boolean attribute on the Connector element + value now defaults to true. (remm) +
+ Possible HTTP/2 connection leak issue when using async with NIO. (remm) +
+ Fix socket close discrepancies for NIO, now the wrapper close + is used everywhere except for socket accept problems. (remm) +
+ Implement poller timeout when using async IO with NIO. (remm) +
+ Avoid creating and using object caches when they are disabled. (remm) +
+ When running on newer JREs that don't support SSLv2Hello, don't warn + that it is not available unless explicitly configured. (markt) +
+ Change default value of pollerThreadCount of NIO + to 1. (remm) +
+ Associate BlockPoller thread name with its NIO connector for better + readability. (remm) +
+ The async HTTP/2 frame parser should tolerate concurrency so clearing + shared buffers before attempting a read is not possible. (remm) +
+ Update the HTTP/2 connection preface and initial frame reading to be + asynchronous instead of blocking IO. (remm) +
+ Refactor Hostname validation to improve performance. Patch provided by + Uwe Hees. (markt) +
+ Add additional NIO2 style read and write methods closer to core NIO2, + for possible use with an asynchronous workflow like CompletableFuture. + (remm) +
+ Expand HTTP/2 timeout handling to include connection window exhaustion + on write. This is the fix for CVE-2019-10072. (markt) +

Jasper

+ 63359: Ensure that the type conversions used when converting + from strings for jsp:setProperty actions are correctly + implemented as per section JSP.1.14.2.1 of the JSP 2.3 specification. + (markt) +

Other

+ 63335: Ensure that stack traces written by the + OneLineFormatter are fully indented. The entire stack trace + is now indented by an additional TAB character. (markt) +
+ 63370: Message files (LocalStrings_*.properties) of the + examples webapp not converted to ascii. (woonsan) +
+ Expand the coverage and quality of the French translations provided + with Apache Tomcat. (remm) +
+ Expand the coverage and quality of the Japanese translations provided + with Apache Tomcat. Includes contributions by motohashi.yuki. (markt) +
+ Expand the coverage and quality of the Czech translations provided + with Apache Tomcat. Includes contributions by Arnošt Havelka. (markt) +
+ When using the OneLineFormatter, don't print a blank line + in the log after printing a stack trace. (markt) +
+ Update the internal fork of Apache Commons FileUpload to 41e4047 + (2019-04-24) pick up some enhancements. (markt) +
+ Update the internal fork of Apache Commons DBCP 2 to dcdbc72 + (2019-04-24) to pick up some clean-up and enhancements. (markt) +
+ Update the internal fork of Apache Commons Pool 2 to 0664f4d + (2019-04-30) to pick up some enhancements and bug fixes. (markt) +

2019-04-13 Tomcat 9.0.19 (markt)

Catalina

+ Fix wrong JMX registration regression in 9.0.18. (remm) +

Coyote

+ Add vectoring for NIO in the base and SSL channels. (remm) +
+ Add asynchronous IO from NIO2 to the NIO connector, with support for + the async IO implementations for HTTP/2 and Websockets. The + useAsyncIO boolean attribute on the Connector element + allows enabling use of the asynchronous IO API. (remm) +

Other

+ Ensure that the correct files are included in the source distribution + for javacc based parsers depending on whether jjtree is used or not. + (markt) +
+ Ensure that text files in the source distribution have the correct line + endings for the target platform. (markt) +

not released Tomcat 9.0.18 (markt)

Catalina

+ 63196: Provide a default (X-Forwarded-Proto) for + the protocolHeader attribute of the + RemoteIpFilter and RemoteIpValve. (markt) +
+ 63235: Refactor Charset cache to reduce start time. (markt) +
+ 63249: Use a consistent log level (WARN) when + logging the failure to register or deregister a JMX Bean. (markt) +
+ 63249: Use a consistent log level (ERROR) when + logging the LifecycleException associated with the failure + to start or stop a component. (markt) +
+ When the SSI directive fsize is used with an invalid + target, return a file size of - rather than + 1k. (markt) +
+ 63251: Implement a work-around for a known JRE bug (JDK-8194653) + that may cause a dead-lock when Tomcat starts. (markt) +
+ 63275: When using a RequestDispatcher ensure + that HttpServletRequest.getContextPath() returns an encoded + path in the dispatched request. (markt) +
+ Add optional listeners for Server/Listener, as a slight variant of + a standard listener. The difference is that loading is not fatal when + it fails. This would allow adding example configuration to the standard + server.xml if deemed useful. Storeconfig will not attempt to persist + the new listener. (remm) +
+ 63286: Document the differences in behaviour between the + LogFormat directive in httpd and the pattern + attribute in the AccessLogValve for %D and + %T. (markt) +
+ 63287: Make logging levels more consistent for similar issues + of similar severity. (markt) +
+ 63311: Add support for https URLs to the local resolver within + Tomcat used to resolve standard XML DTDs and schemas when Tomcat is + configured to validate XML configuration files such as web.xml. (markt) +
+ Encode the output of the SSI printenv command. This is the + fix for CVE-2019-0221. (markt) +
+ Use constants for SSI encoding values. (markt) +
+ When the CGI Servlet is configured with + enableCmdLineArguments set to true, limit the encoded form + of the individual command line arguments to those values allowed by RFC + 3875. This restriction may be relaxed by the use of the new + initialisation parameter cmdLineArgumentsEncoded. (markt) +
+ When the CGI Servlet is configured with + enableCmdLineArguments set to true, limit the decoded form + of the individual command line arguments to known safe values when + running on Windows. This restriction may be relaxed by the use of the + new initialisation parameter cmdLineArgumentsDecoded. This + is the fix for CVE-2019-0232. (markt) +

Coyote

+ Fix bad interaction between NIO2 async read API and the regular read. + (remm) +
+ Refactor NIO2 write pending strategy for the classic IO API. (remm) +
+ Restore original maxConnections default for NIO2 as the underlying + close issues have been fixed. (remm) +
+ Harmonize NIO2 isReadyForWrite with isReadyForRead code. (remm) +
+ When using a JSSE TLS connector that supported ALPN (Java 9 onwards) and + a protocol was not negotiated, Tomcat failed to fallback to HTTP/1.1 and + instead dropped the connection. (markt) +
+ Correct a regression in the TLS connector refactoring in Tomcat 9.0.17 + that prevented the use of PKCS#8 private keys with OpenSSL based + connectors. (markt) +
+ Fix NIO2 SSL edge cases. (remm) +
+ When performing an upgrade from HTTP/1.1 to HTTP/2, ensure that any + query string present in the original HTTP/1.1 request is passed to the + HTTP/2 request processing. (markt) +
+ When Tomcat writes a final response without reading all of an HTTP/2 + request, reset the stream to inform the client that the remaining + request body is not required. (markt) +

Jasper

+ Add support for specifying Java 11 (with the value 11) as + the compiler source and/or compiler target for JSP compilation. (markt) +
+ Add support for specifying Java 12 (with the value 12) and + Java 13 (with the value 13) as the compiler source and/or + compiler target for JSP compilation. If used with an ECJ version that + does not support these values, a warning will be logged and the latest + supported version will used. Based on a patch by Thomas Collignon. + (markt) +

Web applications

+ 63184: Expand the SSI documentation to provide more + information on the supported directives and their attributes. Patch + provided by nightwatchcyber. (markt) +
+ Add a note to the documentation about the risk of DoS with poorly + written regular expressions and the RewriteValve. Patch + provided by salgattas. (markt) +

jdbc-pool

+ Improved maxAge handling. Add support for age check on idle connections. + Connection that expired reconnects rather than closes it. Patch provided + by toby1984. (kfujino) +
+ 63320: Ensure that StatementCache caches + statements that include arrays in arguments. (kfujino) +

Other

+ Update to the Eclipse JDT compiler 4.10. (markt) +
+ Expand the coverage and quality of the Spanish translations provided + with Apache Tomcat. Includes contributions by Ulises Gonzalez Horta. + (markt) +
+ Expand the coverage and quality of the Czech translations provided + with Apache Tomcat. Includes contributions by Arnošt Havelka. (markt) +
+ Expand the coverage and quality of the Chinese translations provided + with Apache Tomcat. Includes contributions by winsonzhao and wjt. + (markt) +
+ Expand the coverage and quality of the Russian translations provided + with Apache Tomcat. (kkolinko) +
+ Expand the coverage and quality of the Japanese translations provided + with Apache Tomcat. (kfujino) +
+ Expand the coverage and quality of the Korean translations provided + with Apache Tomcat. (woonsan) +
+ Expand the coverage and quality of the German translations provided + with Apache Tomcat. (fschumacher) +
+ Expand the coverage and quality of the French translations provided + with Apache Tomcat. (remm) +

2019-03-18 Tomcat 9.0.17 (markt)

Catalina

+ Refactor how cookies are transferred from the base request to a + PushBuilder so that they are accessible, and may be edited, + via the standard PushBuilder methods for working with HTTP + headers. (markt) +
+ Simplify the value of jarsToSkip property in + catalina.properties file for tomcat-i18n jar files. + Use prefix pattern instead of listing each language. (kkolinko) +
+ Restore the getter and setter for the access log valve attribute + maxLogMessageBufferSize that were accidentally removed. + (markt) +
+ 63206: Add a new attribute to Context - + createUploadTargets which, if true enables + Tomcat to create the temporary upload location used by a Servlet if the + location specified by the Servlet does not already exist. The default + value is false. (markt) +
+ 63210: Ensure that the Apache Commons DBCP 2 based default + connection pool is correctly shutdown when it is no longer required. + This ensures that a non-daemon thread is not left running that will + prevent Tomcat from shutting down cleanly. (markt) +
+ 63213: Ensure the correct escaping of group names when + searching for nested groups when the JNDIRealm is configured with + roleNested set to true. (markt) +
+ 63236: Use String.intern() as suggested by + Phillip Webb to reduce memory wasted due to String duplication. This + changes saves ~245k when starting a clean installation. With additional + thanks to YourKit Java profiler for helping to track down the wasted + memory and the root causes. (markt) +
+ 63246: Fix a potential NullPointerException when + calling AsyncContext.dispatch(). (markt) +
+ Always use the absolute path of the docBase during the + deployment process to determine the Context name, deployment type, + whether the docBase is located within the + appBase etc. (markt) +

Coyote

+ When performing an HTTP/1.1 upgrade to HTTP/2 (h2c) ensure that the hostname + and port from the HTTP/1.1 Host header of the upgraded request are made + available via the standard methods + ServletRequest.getServerName() and + ServletRequest.getServerPort(). (markt) +
+ Refactor the APR/Native endpoint TLS configuration code to enable JSSE + style configuration - including JKS keystores - to be used with the + APR/Native connector. (markt) +
+ With the TLS configuration refactoring, the configuration attributes + sessionCacheSize and sessionTimeout are no + longer limited to JSSE implementations. They may now be used with + OpenSSL implementations as well. (markt) +
+ Refactor NIO2 read pending strategy for the classic IO API. (remm) +
+ 63182: Avoid extra read notifications for HTTP/1.1 with + NIO2 when using asynchronous threads. (remm) +
+ 63205: Add a work-around for a known + JRE KeyStore + loading bug. (markt) +
+ NIO2 should try to use SocketTimeoutException everywhere rather than a + mix of it and InterruptedByTimeout. (remm) +
+ Correct an error in the request validation that meant that HTTP/2 push + requests always resulted in a 400 response. (markt) +
+ 63223: Correctly account for push requests when tracking + currently active HTTP/2 streams. (markt) +
+ Ensure enough buffer space when using TLS with NIO2 by using the main + read buffer to store additional decrypted data. (remm) +
+ Verify HTTP/2 stream is still writable before assuming a timeout + occurred. (remm) +
+ Avoid some overflow cases with OpenSSL to improve efficiency, as the + OpenSSL engine has an internal buffer. (remm) +
+ Harmonize HTTP/1.1 NIO2 keepalive code. (remm) +

WebSocket

+ Remove the STREAMS_DROP_EMPTY_MESSAGES system property that + was introduced to work-around four failing TCK tests. An alternative + solution has been implemented. Sending messages via + getSendStream() and getSendWriter() will now + only result in messages on the wire if data is written to the + OutputStream or Writer. Writing zero length + data will result in an empty message. Note that sending a message via an + Encoder may result in the message being send via + getSendStream() or getSendWriter(). (markt) +

Web applications

+ Fix messages used by Manager and Host Manager web applications. + Disambiguate message keys used when adding or removing a host. + Improve display of summary values on the status page: separate + terms and values with a whitespace. Improve wording of messages + for expire sessions command. (kkolinko) +
+ Do not add CSRF nonce parameter and suppress Referer header for external + links in Manager and Host Manager web applications. (kkolinko) +

Tribes

+ Add feature that discover local member from the static member list. + (kfujino) +
+ Ensure that members registered in the addSuspects list are static + members. (kfujino) +

Other

+ Expand the coverage and quality of the French translations provided + with Apache Tomcat. (remm) +
+ 63041: Revert the changes for 53930 that added + support for the CATALINA_OUT_CMD environment variable as + they prevented correct operation with systemd configurations that did + not explicitly specify a PID file. (markt) +
+ Expand the coverage and quality of the Russian translations provided + with Apache Tomcat. (kkolinko) +
+ Fix the artifactId of tomcat-i18n-cs. (rjung) +
+ Expand the coverage and quality of the Korean translations provided + with Apache Tomcat. (woonsan) +
+ Expand the coverage and quality of the Chinese translations provided + with Apache Tomcat. Includes contributions by winsonzhao. (markt) +
+ Expand the coverage and quality of the Czech translations provided + with Apache Tomcat. Includes contributions by Arnošt Havelka. (markt) +
+ Expand the coverage and quality of the Spanish translations provided + with Apache Tomcat. Includes contributions by Ulises Gonzalez Horta. + (markt) +

2019-02-08 Tomcat 9.0.16 (markt)

Web applications

+ Use client's preferred language for the Server Status page of the + Manager web application. Review and fix several cases when the + client's language preference was not respected in Manager and + Host Manager web applications. (kkolinko) +
+ 63141: Ensure that translated manager response strings still + start with OK - where expected by the associated Ant tasks. + (markt) +
+ 63143: Ensure that the Manager web application respects the + language preferences of the user as configured in the browser when the + language of the default system locale is not English. (markt) +

Tribes

+ Remove unnecessary shutdown for executor. (kfujino) +

Other

+ Update the NSIS Installer used to build the Windows installer to version + 3.04. (markt) +
+ Add Czech translations to Apache Tomcat. Includes contributions from + Arnošt Havelka and Alice. (markt) +
+ Expand the coverage and quality of the Spanish translations provided + with Apache Tomcat. Includes contributions from Ulises Gonzalez Horta. + (markt) +
+ Expand the coverage and quality of the French translations provided + with Apache Tomcat. (remm) +
+ Expand the coverage and quality of the Korean translations provided + with Apache Tomcat. (woonsan) +
+ Expand the coverage and quality of the Japanese translations provided + with Apache Tomcat. Includes contributions from Yujiorama. (markt) +
+ Expand the coverage and quality of the Chinese translations provided + with Apache Tomcat. Includes contributions from zheng. (markt) +
+ Expand the coverage and quality of the Russian translations provided + with Apache Tomcat. (kkolinko) +

not released Tomcat 9.0.15 (markt)

Catalina

+ 54741: Add a new method, + Tomcat.addWebapp(String,URL), that allows a web application + to be deployed from a URL when using Tomcat in embedded mode. (markt) +
+ 63002: Fix setting rewrite qsdiscard flag. (remm) +
+ Implement the requirements of section 8.2.2 2c of the Servlet + specification and prevent a web application from deploying if it has + fragments with duplicate names and is configured to use relative + ordering of fragments. (markt) +
+ Ensure that the HEAD response is consistent with the GET response when + HttpServlet is relied upon to generate the HEAD response + and the GET response uses chunking. (markt) +
+ Ensure that the ServletOutputStream implementation is + consistent with the requirements of asynchronous I/O and that all of the + write methods use a single write rather than multiple writes. (markt) +
+ Correct the Javadoc for Context.getDocBase() and + Context.setDocBase() and remove text that indicates that a + URL may be used for the docBase as this has not been the + case for quite some time. (markt) +
+ Add basic health check valve. (remm) +
+ Correct a bug exposed in 9.0.14 and ensure that the Tomcat terminates in + a timely manner when running as a service. (markt) +
+ Log a message when using a Connector that requires Apr without enabling + the AprLifecycleListener first. (csutherl) +
+ Utility thread count for special negative or zero values will again be + based on Runtime.getRuntime().availableProcessors(). (remm) +
+ Treat I/O errors during request body reads the same way as I/O errors + during response body writes. The errors are treated as client side + errors rather than server side errors and only logged at debug level. + (markt) +
+ 63038: Ensure that a ClassNotFoundException is + thrown when attempting to load a class from a corrupted JAR file. + (markt) +
+ 63078: Ensure the utility thread pool is at least two, as the + deployer uses a blocking pattern. (remm, markt) +
+ Make the removal of leading and trailing whitespace from credentials + passed to BASIC authentication configurable via a new attribute, + trimCredentials on the BasicAuthenticator. + (markt) +
+ 63003: Extend the unloadDelay attribute on a + Context to include in-flight asynchronous requests. (markt) +
+ 63026: Add a new attribute, forceDnHexEscape, to + the JNDIRealm that forces escaping in the String + representation of a distinguished name to use the \nn form. + This may avoid issues with realms using Active Directory which appears + to be more tolerant of optional escaping when the \nn form + is used. (markt) +
+ Avoid a swallowed (and therefore ignored) access failure during web + application class loading when running under a + SecurityManager. (markt) +
+ Add SSL configuration options to the JMX remote listener using the + SSLHostConfig framework. (remm) +
+ Update the recommended minimum Tomcat Native version to 1.2.21. (markt) +
+ 63137: If the resources for a web application have been + configured with multiple locations mapped to + /WEB-INF/classes, ensure that all of those locations are + used when building the web application class path. Patch provided by + Marcin Gołębski. (markt) +

Coyote

+ 63009: Include the optional content-length + header in HTTP/2 responses where an appropriate value is available. + (markt) +
+ 63022: Do not use the socket open state when using the + wrapper isClosed method for NIO and NIO2, as it will disable all + further processing. (remm) +
+ Fix socket close discrepancies for NIO2, now the wrapper close + is used everywhere except for socket accept problems. (remm) +
+ Fix use of write timeout instead of read timeout for HTTP/2 NIO2 + frame read. (remm) +
+ Fix incorrect APR sendfile thread stop. (remm) +

Jasper

+ 63056: Correct a regression in the fix for 53737 + that did not correctly scan the web application directory structure for + JSPs. (markt) +
+ Update the performance optimisation for using expressions in tags that + depend on uninitialised tag attributes with implied scope to make the + performance optimisation aware of the new public class + (java.lang.Enum$EnumDesc) added in Java 12. (markt) +

WebSocket

+ 57974: Ensure implementation of + Session.getOpenSessions() returns correct value for both + client-side and server-side calls. (markt) +
+ 63019: Use payload remaining bytes rather than limit when + writing. Submitted by Benoit Courtilly. (remm) +
+ When running under a SecurityManager, ensure that the + ServiceLoader look-up for the default + javax.websocket.server.ServerEndpointConfig.Configurator + implementation completes correctly rather than silently using the + hard-coded fall-back. (markt) +
+ Ensure that the network connection is closed if the client receives an + I/O error trying to communicate with the server. (markt) +
+ Ignore synthetic methods when scanning POJO methods. (markt) +
+ Implement the requirements of section 5.2.1 of the WebSocket 1.1 + specification and ensure that if the deployment of one Endpoint fails, + no Endpoints are deployed for that web application. (markt) +
+ Implement the requirements of section 4.3 of the WebSocket 1.1 + specification and ensure that the deployment of an Endpoint fails if + @PathParam is used with an invalid parameter type. (markt) +
+ Ensure a DeploymentException rather than an + IllegalArgumentException is thrown if a method annotated + with @OnMessage does not conform to the requirements set + out in the Javadoc. (markt) +
+ Improve algorithm that determines if two @OnMessage + annotations have been added for the same message type. Prior to this + change some matches were missed. (markt) +

Web applications

+ 63103: Remove the unused source.jsp file and associated tag + from the examples web application as it is no longer used. (markt) +

Tribes

+ Add dns-ping support to enumerate cluster members. This is much simpler + than getting the pod list but it does not indicate pod status. + Submitted by Maxime Beck. (remm) +
+ Never expire the local member from a Membership. (remm) +

Other

+ Update container image with monitoring contraptions. (remm) +
+ Expand the coverage and quality of the Korean translations provided with + Apache Tomcat. Includes contributions from woonsan and Chris Cho. + (markt) +
+ Expand the coverage and quality of the Japanese translations provided + with Apache Tomcat. Includes contributions from kfujino, Yujiorama and + motohashi.yuki. (markt) +
+ Expand the coverage and quality of the French translations provided with + Apache Tomcat. Includes contributions from remm, Ludovic Pénet and + evernat. (markt) +
+ Expand the coverage and quality of the German translations provided + with Apache Tomcat. Includes contributions from fschumacher, Stefan and + burghard. (markt) +
+ Expand the coverage and quality of the Chinese (simplified) translations + provided with Apache Tomcat. Includes contributions from winsonzhao, + Lanranzi, shawn, Winsonzhoa, JinXiqian, RichardHo, qingshi huang, + Greenman0007, Jim Ma, huxing, 袁宇杰 and evernat. (markt) +
+ Expand the coverage and quality of the Spanish translations provided + with Apache Tomcat. Includes contributions from Ulises Gonzalez Horta, + Israel, Eduardo Quintanilla and Miguel Ortega. (markt) +
+ Expand the coverage and quality of the Russian translations provided + with Apache Tomcat. Includes contributions from Andrei Maiseyenka and + solomax. (markt) +
+ Expand the coverage and quality of the Brazilian Portuguese translations + provided with Apache Tomcat. Includes contributions from Victor Caetano + and Dabilo. (markt) +
+ 63041: Correct a regression in the fix for 53930 + that prevented Tomcat from working correctly with systemd. Patch + provided by Patrik S. (markt) +
+ 63072: Remove extras (JMX remote listener and webservices + object factories) and merge them back into the core build. + (remm) +
+ Update the internal fork of Apache Commons FileUpload to pick up the + changes in the Apache Commons FileUpload 1.4 release. (markt) +
+ Update the internal fork of Apache Commons DBCP 2 to de20b77 + (2019-01-29) to pick up some bug fixes and enhancements. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.21 to + pick up the memory leak fixes when using NIO/NIO2 with OpenSSL. (markt) +

2018-12-12 Tomcat 9.0.14 (markt)

Catalina

+ 62788: Add explicit logging configuration to write log files + using UTF-8 to align with Tomcat's use of UTF-8 by default + elsewhere. (markt) +
+ The default Servlet should not override a previously set content-type. + (remm) +
+ Fix storeconfig for the cluster encryption interceptor key attribute. + (remm) +
+ Add a scheduled executor to the Server, which can be used to + process periodic utility tasks. The utility threads are non daemon + by default. (remm) +
+ Refactor container background processor using the Server executor, and + add monitoring to reschedule it in case of an unexpected error. (remm) +
+ Refactor parallel deployment threads using the Server executor. (remm) +
+ Introduce a ConfigurationSource API to standardize access to the core + configuration resources of Tomcat. (remm) +
+ Update the Tomcat embedded API by allowing to set a configuration + source, which will allow processing of core configuration. (remm) +
+ Refactor processing of server.xml, web.xml, context.xml, other + configuration files and resources using the ConfigurationSource API. + JASPIC persistent providers load and store remains file based. + StoreConfig Tomcat configuration files storing remains file based + at their previous default locations. (remm) +
+ 62897: Provide a property + (clearReferencesThreadLocals) on the standard + Context implementation that enables the check for memory + leaks via ThreadLocals to be disabled because this check + depends on the use of an API that has been deprecated in later versions + of Java. (markt) +
+ Fix more storeconfig issues with duplicated SSL attributes. (remm) +
+ 62924: Fix file descriptor leak introduced in the code that + monitors tomcat-users.xml for modifications. (markt) +
+ Add periodic event notification for lifecycle listeners configured on + the Server. (remm) +
+ 62968: Avoid unnecessary (and relatively expensive) + getResources() call in the Mapper when processing rule 7. + (markt) +
+ Update the recommended minimum Tomcat Native version to 1.2.19. (markt) +
+ 62978: Update the RemoteIpValve to handle multiple values in + the x-forwarded-proto header. Patch provided by Tom Groot. + (markt) +
+ Update the RemoteIpFilter to handle multiple values in the + x-forwarded-proto header. Based on a patch provided by Tom + Groot. (markt) +
+ 62986: Refactor the code that performs class scanning during + web application start to make integration simpler for downstream users. + Patch provided by rmannibucau. (markt) +
+ Filter out tomcat-web.xml from the watched resources list in + storeconfig. (remm) +
+ 62988: Fix the LoadBalancerDrainingValve so it + works when the session cookie configuration is not explicitly declared. + Based on a patch provided by Andreas Kurth. (markt) +

Coyote

+ Refactor connector async timeout threads using a scheduled executor. + (remm) +
+ Avoid using a dedicated thread for accept on the NIO2 connector, it is + always less efficient. (remm) +
+ Load SSL configuration resources for JSSE using the ConfigurationSource + API. OpenSSL use requires actual files. (remm) +
+ 62899: Prevent the incorrect timing out of connections when + Servlet non-blocking I/O is used to read a request body over an HTTP/2 + stream. (markt) +
+ Avoid bad SSLHostConfig JMX registrations before init. (remm) +
+ Avoid a potential hang when a client connects using TLS 1.0 to a Tomcat + HTTPS connector configured to use NIO or NIO2 with OpenSSL 1.1.1 or + later. (markt) +

Jasper

+ Update the Eclipse Compiler for Java to 4.9. Additional patch by Lukasz + Jader. (markt) +
+ 53737: Extend JspC, the precompilation tool, to include + support for resource JARs. (markt) +
+ 62976: Avoid an IllegalStateException when using + background compilation when tag files are packaged in JAR files. (markt) +

Web applications

+ 53553: Add the ability to specify a context.xml from the + server to use when uploading a web application for deployment with the + Manager web application. Patch provided by Anton Lindström. (markt) +
+ 62918: Filter out subtype mbeans to avoid breaking the + connector status page. (remm) +
+ Unify letter case of the word 'How-To' in the webapps (csutherl) +

Tribes

+ Refactor various operations performed in tribes using a scheduled + executor. When tribes is not running standalone, it will use the + executor from the Catalina Server. If running independently, the + Channel will provide the executor. (remm) +
+ Make EncryptInterceptor thread-safe. This makes this interceptor + actually usable. (schultz/markt) +
+ Add support for GCM mode to EncryptInterceptor. (schultz) +

Other

+ Prevent an error when running in a Cygwin shell and the + JAVA_ENDORSED_DIRS system property is empty. Patch provided + by Zemian Deng. (markt) +
+ Expand the coverage and quality of the French translations provided with + Apache Tomcat. Includes contributions from remm, soliplaya, Ludovic + Pénet, David, NicolasG and bdelacretaz. (markt) +
+ Add Simplified Chinese translations to the translations to Apache + Tomcat. Includes contributions from Darren Luo, syseal, Winsonzhao, + 袁宇杰, Lanranzi, ZhangJieWen, Jerry, yinzhili001, 安柏诚, shawn, lavender, + Zheng Feng, zengwc, RichardHo, mm, gingshi huang, Bob, geekwang, zheng, + Deanzhg, Tianfengjingjing, Panblack, oking, Dave Newman, Cnfnss, Jim Ma, + 852394875, huxing and Greenman0007. (markt) +
+ Add Korean translations to Apache Tomcat. Includes contributions from + woonsan, JunSang Park, song choe and OhChan. (markt) +
+ Expand the coverage and quality of the Spanish translations provided + with Apache Tomcat. Includes contributions from Ulises Gonzalez Horta, + Israel, Eduardo Quintanilla and Miguel suarez. (markt) +
+ Expand the coverage and quality of the Russian translations provided + with Apache Tomcat. Includes contributions from solomax, Rafael Sachakov + and Andrei Maiseyenka. (markt) +
+ Expand the coverage and quality of the German translations provided + with Apache Tomcat. Includes contributions from Matk80, burghard, + Daniel Wehringer and Felix Schumacher. (markt) +
+ Expand the coverage and quality of the Japanese translations provided + with Apache Tomcat. Includes contributions from Yujiorama, + motohashi.yuki and kfujino. (markt) +
+ Add Brazilian Portuguese translations to Apache Tomcat. Includes + contributions from geraldo netto. (markt) +
+ Include Brazilian Portuguese translations in the standard Tomcat + distribution. (markt) +
+ Include Simplified Chinese translations in the standard Tomcat + distribution. (markt) +
+ Include Korean translations in the standard Tomcat distribution. (markt) +
+ Add a packaging method for Tomcat using Maven, as well as a container + build file for it. (remm) +
+ Add XML Namespace to the project element of all POM files so that the + XML files are Well Formed and Valid. (csutherl) +
+ 53930: Add support for the CATALINA_OUT_CMD + environment variable that defines a command to which captured stdout and + stderr will be redirected. Patch provided by Casey Lucas. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.19 to + pick up the latest Windows binaries built with APR 1.6.5 and OpenSSL + 1.1.1a. (markt) +
+ Add i18n to many strings that lacked it. (remm) +

2018-11-07 Tomcat 9.0.13 (markt)

Catalina

+ 58590: Add the ability for a UserDatabase to monitor the + backing XML file for changes and reload the source file if a change in + the last modified time is detected. This is enabled by default meaning + that changes to $CATALINA_BASE/conf/tomcat-users.xml will + now take effect a short time after the file is saved. (markt) +
+ 61171: Add the portOffset attribute to the + Server element which is added to the configured shutdown + and Connector ports. Based on a patch by Marek Czernek. + (markt) +
+ 61692: Add the ability to control which HTTP methods are + handled by the CGI Servlet via a new initialization parameter + cgiMethods. (markt) +
+ 62687: Expose content length information for resources + when using a compressed war. (remm) +
+ 62737: Fix rewrite substitutions parsing of {} nesting. + (remm) +
+ Add rewrite flags output when getting the rewrite configuration back. + (remm) +
+ Add missing qsdiscard flag to the rewrite flags as a cleaner way to + discard the query string. (remm) +
+ 62755: Add ability to opt out of adding the default web.xml + config when embedding Tomcat and adding a context via + addWebapp(). Call + setAddDefaultWebXmlToWebapp(false) to prevent the automatic + config. (isapir) +
+ Add documentation about the files context.xml.default and + web.xml.default that can be used to customize + conf/context.xml and conf/web.xml on a per + host basis. (fschumacher) +
+ Ensure that a canonical path is always used for the docBase of a Context + to ensure consistent behaviour. (markt) +
+ 62803: Fix SSL connector configuration processing + in storeconfig. (remm) +
+ 62797: Pass throwable to keep client aborts with status 200 + rather than 500. Patch submitted by zikfat. (remm) +
+ 62802: Restore the appContextProtection + attribute to the JreMemoryLeakPreventionListener as + application code may still trigger this memory leak. (markt) +
+ 62809: Correct a regression in the implementation of DIGEST + authentication support for the Deployer Ant tasks (bug 45832) + that prevented the DeployTask from working when + authentication was required. (markt) +
+ Update the recommended minimum Tomcat Native version to 1.2.18. (markt) +
+ Ignore an attribute named source on Context + elements provided by StandardContext. This is to suppress + warnings generated by the Eclipse / Tomcat integration provided by + Eclipse. Based on a patch by mdfst13. (markt) +
+ 62830: Added JniLifeCycleListener and static + methods Library.loadLibrary(libraryName) and + Library.load(filename) to load a native library by a + shared class loader so that more than one Webapp can use it. (isapir) +
+ Refactor the Connector so that the port is obtained from + the Endpoint rather than a local field that could end up + out of sync. (markt) +
+ Correct a typo in the Spanish resource files. Patch provided by Diego + Agulló. (markt) +
+ 62868: Order the Enumeration<URL> provided + by WebappClassLoaderBase.getResources(String) according to + the setting of the delegate flag. (markt) +

Coyote

+ Add TLSv1.3 to the default protocols and to the all + alias for JSSE based TLS connectors when running on a JVM that + supports TLS version 1.3. One such JVM is OpenJDK version 11. (rjung) +
+ 62685: Correct an error in host name validation parsing that + did not allow a fully qualified domain name to terminate with a period. + Patch provided by AG. (markt) +
+ Make PEM file parser a public utility class. (remm) +
+ 62739: Do not reject requests with an empty HTTP Host header. + Such requests are unusual but not invalid. Patch provided by Michael + Orr. (markt) +
+ 62748: Add TLS 1.3 support for the APR/Native connector and + the NIO/NIO2 connector when using the OpenSSL backed JSSE + implementation. (schultz/markt) +
+ 62791: Remove an unnecessary check in the NIO TLS + implementation that prevented from secure WebSocket connections from + being established. (markt) +
+ Fix server initiated TLS renegotiation to obtain a client certificate + when using NIO/NIO2 and the OpenSSL backed JSSE TLS implementation. + (markt) +
+ Ensure open sockets etc. are cleaned up if the socket binding process + fails. (markt) +
+ 62871: Improve MBeans for Endpoint instances (type + ThreadPool in JMX) by using explicit declaration of + attributes and operations rather than relying on introspection. Add a + new MBean to expose the Socketproperties values. (markt) +

Jasper

+ Correct parsing of XML whitespace in TLD function signatures that + incorrectly only looked for the space character. (markt) +
+ 62674: Correct a regression in the stand-alone JSP compiler + utility, JspC, caused by the fix for 53492, that + caused the JSP compiler to hang. (markt) +
+ 62721: Correct generation of web.xml header when using JspC. + (markt) +
+ 62757: Correct a regression in the fix for 62603 + that caused NullPointerExceptions when compiling tag files + on first access when development mode was disabled and background + compilation was enabled. Based on a patch by Jordi Llach. (markt) +

WebSocket

+ 62731: Make the URI returned by + HandshakeRequest.getRequestURI() and + Session.getRequestURI() absolute so that the scheme, host + and port are accessible. (markt) +

Web applications

+ 62676: Expand the CORS filter documentation to make it clear + that explicit configuration is required to enable support for + cross-origin requests. (markt) +
+ 62712: Correct NPE in Manager application when attempting to + view configured certificates for an APR/native TLS connector. (markt) +
+ 62761: Correct the advanced CORS example in the Filter + documentation to use a valid configuration. (markt) +
+ 62786: Add a note to the Context documentation to explain + that, by default, settings for a Context element defined in server.xml + will be overwritten by settings specified in a default context file such + as conf/context.xml. (markt) +
+ Create a little visual separation between the Undeploy button and the + other buttons in the Manager application. Patch provided by Łukasz + Jąder. (markt) +

Tribes

+ Add setMembershipService method to the + MembershipProvider. (kfujino) +
+ Experimental Kubernetes aware cloud membership provider, based on code + by Maxime Beck. Contains code derived from jgroups. (remm/kfujino) +
+ Move the event notification ThreadPoolExecutor to + MembershipProviderBase. (kfujino) +
+ Even if all members have already disappeared and PING can not be sent, + ensure that members will be expired. (kfujino) +
+ Ensure that remove the member from suspect list when member added. + (kfujino) +
+ Add EncryptInterceptor to the portfolio of available clustering + interceptors. This adds symmetric encryption of session data + to Tomcat clustering regardless of the type of cluster manager + or membership being used. (schultz) +

Other

+ Port DBCP transaction synchronization registry fix + (commit d49d45e). (remm) +
+ Update the internal fork of Apache Commons Pool 2 to d4e0e88 + (2018-09-12) to pick up some bug fixes and enhancements. (markt) +
+ 62705: Added a fail fast check for minimum required Apache + Ant version 1.9.8 when building Tomcat. (isapir) +
+ Added ant target ide-intellij to create an IntelliJ IDEA project. (isapir) +
+ Utility JSON parser generated from a public domain javacc grammar + written by Robert Fischer. (remm) +
+ Update the packaged version of the Tomcat Native Library to 1.2.18 to + pick up the latest Windows binaries built with APR 1.6.5 and OpenSSL + 1.1.1. (markt) +

2018-09-10 Tomcat 9.0.12 (markt)

Catalina

+ Improve the handling of path parameters when working with + RequestDispatcher objects. (markt) +
+ 62664: Process requests with content type + multipart/form-data to servlets with a + @MultipartConfig annotation regardless of HTTP method. + (markt) +
+ 62667: Add recursion to rewrite substitution parsing. (remm) +
+ 62669: When using the SSIFilter and a resource does not + specify a content type, do not force the content type to + application/x-octet-stream. (markt) +
+ 62670: Adjust the memory leak protection for the + DriverManager so that JDBC drivers located in + $CATALINA_HOME/lib and $CATALINA_BASE/lib are + loaded via the service loader mechanism when the protection is enabled. + (markt) +
+ When generating a redirect to a directory in the Default Servlet, avoid + generating a protocol relative redirect. (markt) +

Coyote

+ Fix potential deadlocks when using asynchronous Servlet processing with + HTTP/2 connectors. (markt) +
+ 62620: Fix corruption of response bodies when writing large + bodies using asynchronous processing over HTTP/2. (markt) +
+ 62628: Additional fixes for output corruption of response + bodies when writing large bodies using asynchronous processing over + HTTP/2. (markt) +
+ Support for Netware in the org.apache.tomcat.jni package + has been removed as there has not been a supported Netware platform for + a number of years. (markt) +

Jasper

+ Correct the JSP version in the X-PoweredBy HTTP header generated when + the xpoweredBy option is enabled. (markt) +
+ 62662: Fix the corruption of web.xml output during JSP + compilation caused by the fix for 53492. Patch provided by + Bernhard Frauendienst. (markt) +

Web applications

+ Expand the information in the documentation web application regarding + the use of CATALINA_HOME and CATALINA_BASE. + Patch provided by Marek Czernek. (markt) +
+ 62652: Make it clearer that the version of DBCP that is + packaged in Tomcat 9.0.x is DBCP 2. Correct the names of some DBCP 2 + configuration attributes that changed between 1.x and 2.x. (markt) +
+ 62666: Expand internationalisation support in the Manager + application to include the server status page and provide Russian + translations in addition to English. Patch provided by Artem Chebykin. + (markt) +

Other

+ Switch the build script to use http for downloads from an ASF mirror + using the closer.lua script to avoid failures due to HTTPS to HTTP + redirects. (rjung) +

2018-08-17 Tomcat 9.0.11 (markt)

Catalina

+ Make the isLocked() method of the LockOutRealm + public and expose the method via JMX. (markt) +
+ 53387: Add support for regular expression capture groups to + the SSI servlet and filter. (markt) +
+ 53411: Improve the handling of HTTP requests that do not + explicitly specify a host name when no default host is configured. Also + improve the tracking of changes to the default host as hosts are added + and removed while Tomcat is running. (markt) +
+ Ensure that the HTTP Vary header is set correctly when using the CORS + filter and improve the cacheability of requests that pass through the + COPRS filter. (markt) +
+ 62527: Revert restriction of JNDI to the java: + namespace. (remm) +
+ Introduce a new class - MultiThrowable - to report + exceptions when multiple actions are taken where each action may throw + an exception but all actions are taken before any errors are reported. + Use this new class when reporting multiple container (e.g. web + application) failures during start. (markt) +
+ Correctly decode URL paths (+ should not be decoded to a + space in the path) in the RequestDispatcher and the web + application class loader. (markt) +
+ Make logout more robust if JASPIC subject is unexpectedly unavailable. + (markt) +
+ 62547: JASPIC cleanSubject() was not called on + logout when the authenticator was configured to cache the authenticated + Principal. Patch provided by Guillermo González de Agüero. (markt) +
+ 62559: Add jaxb-*.jar to the list of JARs + ignored by StandardJarScanner. (markt) +
+ 62560: Add oraclepki.jar to the list of JARs + ignored by StandardJarScanner. (markt) +
+ 62607: Return a non-zero exit code from + catalina.[bat|sh] run if Tomcat fails to start. (markt) +
+ Use short circuit logic to prevent potential NPE in CorsFilter. (fschumacher) +
+ Simplify construction of appName from container name in JAASRealm. (fschumacher) +
+ Remove ServletException from declaration of + Tomcat.addWebapp(String,String) since it is never thrown. + Patch provided by Tzafrir. (markt) +

Coyote

+ Refactor HTTP date creation and parsing to reduce code duplication, + reduce the use of ThreadLocals and to increase the use of caching. + (markt) +
+ 56676: Add a default location for the native library, as + ${catalina.home}/bin, which the testsuite already uses. (remm) +
+ 60560: Add support for using an inherited channel to + the NIO connector. Based on a patch submitted by Thomas Meyer with + testing and suggestions by Coty Sutherland. (remm) +
+ 62507: Ensure that JSSE based TLS connectors work correctly + with a DKS keystore. (markt) +
+ Refactor code that adds an additional header name to the + Vary HTTP response header to use a common utility method + that addresses several additional edge cases. (markt) +
+ 62515: When a connector is configured (via setting + bindOnInit to false) to bind/unbind the server + socket during start/stop, close the socket earlier in the stop process + so new connections do not sit in the TCP backlog during the shutdown + process only to be dropped as stop completes. In this scenario new + connections will now be refused immediately. (markt) +
+ 62526: Correctly handle PKCS12 format key stores when the key + store password is configured to be the empty string. (markt) +
+ 62605: Ensure ReadListener.onDataAvailable() is + called when the initial request body data arrives after the request + headers when using asynchronous processing over HTTP/2. (markt) +
+ 62614: Ensure that + WriteListener.onWritePossible() is called after + isReady() returns false and the window size is + subsequently incremented when using asynchronous processing over HTTP/2. + (markt) +

Jasper

+ 53492: Make the Java file generation process multi-threaded. + By default, one thread will be used per core. Based on a patch by Dan + Fabulich. (markt) +
+ 62453: Add a performance optimisation for using expressions + in tags that depend on uninitialised tag attributes with implied scope. + Generally, using an explicit scope with tag attributes in EL is the best + way to avoid various potential performance issues. (markt) +
+ Correctly decode URL paths (+ should not be decoded to a + space in the path) in the Jasper class loader. (markt) +
+ 62603: Fix a potential race condition when development mode + is disabled and background compilation checks are enabled. It was + possible that some updates would not take effect and/or + ClassNotFoundExceptions would occur. (markt) +

WebSocket

+ 62596: Remove the limit on the size of the initial HTTP + upgrade request used to establish the web socket connection. (markt) +

Web applications

+ 62558: Add Russian translations for the Manager and Host + Manager web applications. Based on a patch by Ivan Krasnov. (markt) +
+ Add documents for Static Membership service. (kfujino) +
+ 62561: Add advanced class loader configuration information + regarding the use of the Server and Shared class loaders to the + documentation web application. (markt) +

Tribes

+ Ensures that the specified rxBufSize is correctly set to + receiver buffer size. (kfujino) +
+ Correct the stop order of the Channel components. It stops in the + reverse order to that at startup. (kfujino) +
+ Added new StaticMembership implementation. This implementation does not + require any additional configuration of other + ChannelInterceptors. It works only with membership service. + (kfujino) +

Other

+ Support building with Java 9+ while preserving the Java 8 compatibility + at runtime (requires Ant 1.9.8 or later). (ebourg) +
+ Update WSDL4J library to version 1.6.3 (from 1.6.2). (kkolinko) +
+ Update JUnit library to version 4.12 (from 4.11). (kkolinko) +
+ Downgrade CGLib library used for testing with EasyMock to version + 2.2.2 (from 2.2.3) as version 2.2.3 is not available from Maven Central. + (markt) +
+ Implement checksum checks when downloading dependencies that are used + to build Tomcat. (kkolinko) +
+ Fixed spelling. Patch provided by Jimmy Casey via GitHub. (violetagg) +
+ Update the internal fork of Apache Commons Pool 2 to 3e02523 + (2018-08-09) to pick up some bug fixes and enhancements. (markt) +
+ Update the internal fork of Apache Commons DBCP 2 to abc0484 + (2018-08-09) to pick up some bug fixes and enhancements. (markt) +
+ Correct various spelling errors throughout the source code and + documentation. Patch provided by Kazuhiro Sera. (markt) +

2018-06-25 Tomcat 9.0.10 (markt)

Catalina

+ 62476: Use GMT timezone for the value of + Expires header as required by HTTP specification + (RFC 7231, 7234). (kkolinko) +

not released Tomcat 9.0.9 (markt)

Catalina

+ Treat the <mapped-name> element of a + <env-entry> in web.xml in the same way as the + mappedName element of the equivalent @Resource + annotation. Both now attempt to set the mappedName property + of the resource. (markt) +
+ Correct the processing of resources with + <injection-target>s defined in web.xml. First look + for a match using JavaBean property names and then, only if a match is + not found, look for a match using fields. (markt) +
+ When restoring a saved request with a request body after FORM + authentication, ensure that calls to the HttpServletRequest + methods getRequestURI(), getQueryString() and + getProtocol() are not corrupted by the processing of the + saved request body. (markt) +
+ JNDI resources that are defined with injection targets but no value are + now treated as if the resource is not defined. (markt) +
+ Ensure that JNDI names used for <lookup-name> entries + in web.xml and for lookup elements of + @Resource annotations specify a name with an explicit + java: namespace. (markt) +
+ 50019: Add support for <lookup-name>. + Based on a patch by Gurkan Erdogdu. (markt) +
+ Add the AuthenticatedUserRealm for use with CLIENT-CERT and + SPNEGO when just the authenticated user name is required. (markt) +
+ 50175: Add a new attribute to the standard context + implementation, skipMemoryLeakChecksOnJvmShutdown, that + allows the user to configure Tomcat to skip the memory leak checks + usually performed during web application stop if that stop is triggered + by a JVM shutdown. (markt) +
+ 51497: Add an option, ipv6Canonical, to the + AccessLogValve that causes IPv6 addresses to be output in + canonical form defined by RFC 5952. (ognjen/markt) +
+ 51953: Add the RemoteCIDRFilter and + RemoteCIDRValve that can be used to allow/deny requests + based on IPv4 and/or IPv6 client address where the IP ranges are defined + using CIDR notation. Based on a patch by Francis Galiegue. (markt) +
+ 62343: Make CORS filter defaults more secure. This is the fix + for CVE-2018-8014. (markt) +
+ Ensure that the web application resources implementation does not + incorrectly cache results for resources that are only visible as class + loader resources. (markt) +
+ 62387: Do not log a warning message if the file based + persistent session store fails to delete the file for a session when the + session is invalidated because the file has not been created yet. + (markt) +
+ Make all loggers associated with Tomcat provided Filters non-static to + ensure that log messages are not lost when a web application is + reloaded. (markt) +
+ Correct the manifest for the annotations-api.jar. The JAR implements the + Common Annotations API 1.3 and the manifest should reflect that. (markt) +
+ Switch to non-static loggers where there is a possibility of a logger + becoming associated with a web application class loader causing log + messages to be lost if the web application is stopped. (markt) +
+ 62389: Add the IPv6 loopback address to the default + internalProxies regular expression. Patch by Craig Andrews. + (markt) +
+ In the RemoteIpValve and RemoteIpFilter, + correctly handle the case when the request passes through one or more + trustedProxies but no internalProxies. Based + on a patch by zhanhb. (markt) +
+ Correct the logic in MBeanFactory.removeConnector() to + ensure that the correct Connector is removed when there are multiple + Connectors using different addresses but the same port. (markt) +
+ Make JAASRealm mis-configuration more obvious by requiring + the authenticated Subject to include at least one Principal of a type + specified by userClassNames. (markt) +

Coyote

+ Correct a regression in the error page handling that prevented error + pages from issuing redirects or taking other action that required the + response status code to be changed. (markt) +
+ Consistent exception propagation for NIO2 SSL close. (remm) +
+ Followup sync fix for NIO2 async IO blocking read/writes. (remm) +
+ Log an error message if the AJP connector detects that the reverse proxy + is sending AJP messages that are too large for the configured + packetSize. (markt) +
+ Relax Host validation by removing the requirement that the final + component of a FQDN must be alphabetic. (markt) +
+ 62371: Improve logging of Host validation failures. (markt) +
+ Fix a couple of unlikely edge cases in the shutting down of the + APR/native connector. (markt) +
+ Add missing handshake timeout for NIO2. (remm) +
+ Correctly handle a digest authorization header when the user name + contains an escaped character. (markt) +
+ Correctly handle a digest authorization header when one of the hex + field values ends the header with in an invalid character. (markt) +
+ Correctly handle an invalid quality value in an + Accept-Language header. (markt) +
+ 62423: Fix SSL docs CRL attribute typo. (remm) +
+ Improve IPv6 validation by ensuring that IPv4-Mapped IPv6 addresses do + not contain leading zeros in the IPv4 part. Based on a patch by Katya + Stoycheva. (markt) +
+ Fix NullPointerException thrown from + replaceSystemProperties() when trying to log messages. (csutherl) +
+ Avoid unnecessary processing of async timeouts. (markt) +

Jasper

+ 50234: Add the capability to generate a web-fragment.xml file + to JspC. (markt) +
+ 62080: Ensure that all reads of the current thread's context + class loader made by the UEL API and implementation are performed via a + PrivilegedAction to ensure that a + SecurityException is not triggered when running under a + SecurityManager. (mark) +
+ 62350: Refactor + org.apache.jasper.runtime.BodyContentImpl so a + SecurityException is not thrown when running under a + SecurityManger and additional permissions are not required in the + catalina.policy file. This is a follow-up to the fix for + 43925. (kkolinko/markt) +
+ Enable JspC from Tomcat 9 to work with Maven JspC compiler plug-ins + written for Tomcat 8.5.x. Patch provided by Pavel Cibulka. (markt) +
+ Update web.xml, web-fragment.xml and web.xml extracts generated by JspC + to use the Servlet 4.0 version of the relevant schemas. (markt) +

Cluster

+ Remove duplicate calls when creating a replicated session to reduce the + time taken to create the session and thereby reduce the chances of a + subsequent session update message being ignored because the session does + not yet exist. (markt) +
+ Add the method to send a message with a specified sendOptions. (kfujino) +
+ When sending the GET_ALL_SESSIONS message, make sure that + sends with asynchronous option in order to avoid ack timeout. Waiting to + receive the ALL_SESSION_DATA message should be done with + waitForSendAllSessions instead of ACK. (kfujino) +

WebSocket

+ Use NIO2 API for websockets writes. (remm) +
+ When decoding of path parameter failed, make sure to throw + DecodeException instead of throwing + ArrayIndexOutOfBoundsException. (kfujino) +
+ Improve the handling of exceptions during TLS handshakes for the + WebSocket client. (markt) +
+ Enable host name verification when using TLS with the WebSocket client. + (markt) +

Web applications

+ 62395: Clarify the meaning of the connector attribute + minSpareThreads in the documentation web application. + (markt) +
+ Correct the documentation for the allowHostHeaderMismatch + attribute of the standard HTTP Connector implementations. (markt) +

Tribes

+ Ensure that the correct default value is returned when retrieve unset + properties in McastService. (kfujino) +
+ Make MembershipService more easily extensible. (kfujino) +

jdbc-pool

+ When logValidationErrors is set to true, the connection + validation error is logged as SEVERE instead of + WARNING. (kfujino) +

Other

+ Ensure that Apache Tomcat may be built from source with Java 11. (markt) +
+ 52381: Add OSGi metadata to JAR files. (markt) +
+ 62391: Remove references to javaw.exe as this + file is not required by Tomcat and the references prevent the use of the + Server JRE. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.17 to + pick up the latest Windows binaries built with APR 1.6.3 and OpenSSL + 1.0.2o. (markt) +
+ 62458: Update the internal fork of Commons Pool 2 to dfef97b + (2018-06-18) to pick up some bug fixes and enhancements. (markt) +
+ Update the internal fork of Commons DBCP 2 to 2.4.0. (markt) +

2018-05-03 Tomcat 9.0.8 (markt)

Catalina

+ 62263: Avoid a NullPointerException when the + RemoteIpValve processes a request for which no Context can + be found. (markt) +
+ 62258: Don't trigger the standard error page mechanism when + the error has caused the connection to the client to be closed as no-one + will ever see the error page. (markt) +
+ Register MBean when DataSource Resource + type="javax.sql.XADataSource". Patch provided by Masafumi Miura. + (csutherl) +
+ Fix a rare edge case that is unlikely to occur in real usage. This edge + case meant that writing long streams of UTF-8 characters to the HTTP + response that consisted almost entirely of surrogate pairs could result + in one surrogate pair being dropped. (markt) +
+ Update the internal fork of Apache Commons BCEL to r1829827 to add early + access Java 11 support to the annotation scanning code. (markt) +
+ 62297: Enable the CrawlerSessionManagerValve to + correctly handle bots that crawl multiple hosts and/or web applications + when the Valve is configured on a Host or an Engine. (fschumacher) +
+ 62309: Fix a SecurityException when using JASPIC + under a SecurityManager when authentication is not + mandatory. (markt) +
+ 62329: Correctly list resources in JAR files when directories + do not have dedicated entries. Patch provided by Meelis Müür. (markt) +
+ Collapse multiple leading / characters to a single + / in the return value of + HttpServletRequest#getContextPath() to avoid issues if the + value is used with HttpServletResponse#sendRedirect(). This + behaviour is enabled by default and configurable via the new Context + attribute allowMultipleLeadingForwardSlashInPath. (markt) +
+ Improve handling of overflow in the UTF-8 decoder with supplementary + characters. (markt) +

Coyote

+ Correct off-by-one error in thread pool that allowed thread pools to + increase in size to one more than the configured limit. Patch provided + by usc. (markt) +
+ Prevent unexpected TLS handshake failures caused by errors during a + previous handshake that were not correctly cleaned-up when using the NIO + or NIO2 connector with the OpenSSLImplementation. (markt) +
+ 62273: Implement configuration options to work-around + specification non-compliant user agents (including all the major + browsers) that do not correctly %nn encode URI paths and query strings + as required by RFC 7230 and RFC 3986. (markt) +
+ Fix sync for NIO2 async IO blocking read/writes. (remm) +

Jasper

+ Update the Eclipse Compiler for Java to 4.7.3a. (markt) +
+ Allow 9 to be used to specify Java 9 as the compiler source + and/or compiler target for JSP compilation. The Early Access value of + 1.9 is still supported. (markt) +
+ Add support for specifying Java 10 (with the value 10) as + the compiler source and/or compiler target for JSP compilation. (markt) +
+ 62287: Do not rely on hash codes to test instances of + ValueExpressionImpl for equality. Patch provided by Mark + Struberg. (markt) +

WebSocket

+ 62301: Correct a regression in the fix for 61491 + that didn't correctly handle a final empty message part in all + circumstances when using PerMessageDeflate. (markt) +
+ 62332: Ensure WebSocket connections are closed after an I/O + error is experienced reading from the client. (markt) +

Other

+ Avoid warning when running under Cygwin when the + JAVA_ENDORSED_DIRS environment variable is not set. Patch + provided by Zemian Deng. (markt) +

2018-04-07 Tomcat 9.0.7 (markt)

Catalina

+ 51195: Avoid a false positive report of a web application + memory leak by clearing ObjectStreamClass$Caches of classes + loaded by the web application when the web application is stopped. + (markt) +
+ 52688: Add support for the maxDays attribute to + the AccessLogValve and ExtendedAccessLogValve. + This allows the maximum number of days for which rotated access logs + should be retained before deletion to be defined. (markt) +
+ Ensure the MBean names for the SSLHostConfig and + SSLHostConfigCertificate are correctly formed when the + Connector is bound to a specific IP address. (markt) +
+ 62168: When using the PersistentManager honor a + value of -1 for minIdleSwap and do not swap + out sessions to keep the number of active sessions under + maxActive. Patch provided by Holger Sunke. (markt) +
+ 62172: Improve Javadoc for + org.apache.catalina.startup.Constants and ensure that the + constants are correctly used. (markt) +
+ 62175: Avoid infinite recursion, when trying to validate + a session while loading it with PersistentManager. + (fschumacher) +
+ Ensure that NamingContextListener instances are only + notified once of property changes on the associated naming resources. + (markt) +
+ 62224: Disable the forkJoinCommonPoolProtection + of the JreMemoryLeakPreventionListener when running on Java + 9 and above since the underlying JRE bug has been fixed. (markt) +

Coyote

+ Avoid potential loop in APR/Native poller. (markt) +
+ Ensure streams that are received but not processed are excluded from the + tracking of maximum ID of processed streams. (markt) +
+ Refactor the check for a paused connector to consistently prevent new + streams from being created after the connector has been paused. (markt) +
+ Improve debug logging for HTTP/2 pushed streams. (markt) +
+ The OpenSSL engine SSL session will now ignore invalid accesses. (remm) +
+ 62177: Correct two protocol errors with HTTP/2 + PUSH_PROMISE frames. Firstly, the HTTP/2 protocol only + permits pushes to be sent on peer initiated requests. Secondly, pushes + must be sent in order of increasing stream ID. These restriction were + not being enforced leading to protocol errors at the client. (markt) +

Web applications

+ Add document for FragmentationInterceptor. (kfujino) +
+ Document how the roles for an authenticated user are determined when the + CombinedRealm is used. (markt) +
+ 62163: Correct the Tomcat Setup documentation that + incorrectly referred to Java 7 as the minimum version rather than Java + 8. (markt) +

Tribes

+ Add JMX support for FragmentationInterceptor in order to + prevent warning of startup. (kfujino) +

jdbc-pool

+ Ensure that SQLWarning has been cleared when connection + returns to the pool. (kfujino) +
+ Enable clearing of SQLWarning via JMX. (kfujino) +
+ Ensure that parameters have been cleared when + PreparedStatement and/or CallableStatement are + cached. (kfujino) +
+ Enable PoolCleaner to be started even if validationQuery + is not set. (kfujino) +

Other

+ Update the build script so MD5 hashes are no longer generated for + releases as per the change in the ASF distribution policy. (markt) +
+ 62164: Switch the build script to use TLS for downloads from + SourceForge and Maven Central to avoid failures due to HTTP to HTTPS + redirects. (markt) +
+ Always report the OS's umask when launching the JVM. (schultz) +
+ Add managed connections package to the package renamed DBCP 2 to provide + a complete DBCP 2 in Tomcat. (remm) +

2018-03-08 Tomcat 9.0.6 (markt)

Catalina

+ 43866: Add additional attributes to the Manager to provide + control over which listeners are called when an attribute is added to + the session when it has already been added under the same name. This is + to aid clustering scenarios where setAttribute() is often + called to signal that the attribute value has been mutated and needs to + be replicated but it may not be required, or even desired, for the + associated listeners to be triggered. The default behaviour has not been + changed. (markt) +
+ Minor optimization when calling class transformers. (rjung) +
+ Pass errors triggered by invalid requests or unavailable services to the + application provided error handling and/or the container provided error + handling (ErrorReportValve) as appropriate. (markt) +
+ 41007: Add the ability to specify static HTML responses for + specific error codes and/or exception types with the + ErrorReportValve. (markt) +
+ Prevent Tomcat from applying gzip compression to content that is already + compressed with brotli compression. Based on a patch provided by burka. + (markt) +
+ 62090: Null container names are not allowed. (remm) +
+ 62104: Fix programmatic login regression as the + NonLoginAuthenticator has to be set for it to work (if no login method + is specified). (remm) +
+ 62117: Improve error message in catalina.sh when + calling kill -0 <pid> fails. Based on a suggestion + from Mark Morschhaeuser. (markt) +
+ 62118: Correctly create a JNDI ServiceRef using + the specified interface rather than the concrete type. Based on a + suggestion by Ángel Álvarez Páscua. (markt) +
+ Fix for RequestDumperFilter log attribute. Patch provided + by Kirill Romanov via Github. (violetagg) +
+ 62123: Avoid ConcurrentModificationException + when attempting to clean up application triggered RMI memory leaks on + web application stop. (markt) +
+ When a deployment descriptor is deployed that includes a + path attribute, log a warning that the path + attribute will be ignored. (markt) +
+ When a deployment descriptor is deployed that references an external + docBase and, as a result, a docBase under the + appBase will be ignored, log a warning. (markt) +
+ Correct a regression in the fix for 60276 that meant that + compression was applied to all MIME types. Patch provided by Stefan + Knoblich. (markt) +

Coyote

+ Add async HTTP/2 parser for NIO2. (remm) +
+ Add minor HPACK fixes, based on fixes by Stuart Douglas. (remm) +
+ 61751: Follow up fix so that OpenSSL engine returns + underflow when unwrapping if no bytes were produced and the input is + empty. (remm) +
+ Minor OpenSSL engine cleanups. (remm) +
+ NIO SSL handshake should throw an exception on overflow status, like + NIO2 SSL. (remm) +

Web applications

+ 47467: When deploying a web application via the manager + application and a path is not explicitly specified, derive it from the + provided deployment descriptor or, if that is not present, the WAR or + DIR. (markt) +
+ 48672: Add documentation for the Host Manager web + application. Patch provided by Marek Czernek. (markt) +
+ Add support for specifying the application version when deploying an + application via the Manager application HTML interface. (markt) +
+ Work-around a known, non-specification compliant behaviour in some + versions of IE that can allow XSS when the Manager application generates + a plain text response. Based on a suggestion from Muthukumar Marikani. + (markt) +

2018-02-11 Tomcat 9.0.5 (markt)

Catalina

+ Prevent a stack trace being written to standard out when running on Java + 10 due to changes in the LogManager implementation. (markt) +
+ Avoid duplicate load attempts if one has been made already. (remm) +
+ Avoid NPE in ThreadLocalLeakPreventionListener if there is no Engine. + (remm) +
+ 62000: When a JNDI reference cannot be resolved, ensure that + the root cause exception is reported rather than swallowed. (markt) +
+ 62036: When caching an authenticated user Principal in the + session when the web application is configured with the + NonLoginAuthenticator, cache the internal Principal object + rather than the user facing Principal object as Tomcat requires the + internal object to correctly process later authorization checks. (markt) +
+ Refactor error handling to enable errors that occur before processing is + passed to the application to be handled by the application provided + error handling and/or the container provided error handling + (ErrorReportValve) as appropriate. (markt) +
+ Pass 404 errors triggered by a missing ROOT web application to the + container error handling to generate the response body. (markt) +
+ Pass 400 errors triggered by invalid request targets to the container + error handling to generate the response body. (markt) +
+ Provide a correct Allow header when responding to an HTTP + TRACE request for a JSP with a 405 status code. (markt) +
+ When using Tomcat embedded, only perform Authenticator configuration + once during web application start. (markt) +
+ 62067: Correctly apply security constraints mapped to the + context root using a URL pattern of "". (markt) +
+ Process all ServletSecurity annotations at web application + start rather than at servlet load time to ensure constraints are applied + consistently. (markt) +

Coyote

+ 61751: Fix truncated request input streams when using NIO2 + with TLS. (markt) +
+ 62023: Log error reporting multiple SSLHostConfig elements + when using the APR Connector instead of crashing Tomcat. (csutherl) +
+ 62032: Fix NullPointerException when certificateFile is not + defined on an SSLHostConfig and unify the behavior when a + certificateFile is defined but the file does not exist for both + JKS and PEM file types. (csutherl) +
+ Ensure that the toString() method behaves consistently for + ByteChunk and CharChunk and that + null is returned when toString() is called + both on newly created objects and immediately after a call to + recycle(). This should not impact typical Tomcat users. It + may impact users who use these classes directly in their own code. + (markt) +
+ Ensure that the toString(), toBytes() and + toChars() methods of MessageBytes behave + consistently and do not throw a NullPointerException both + on newly created objects and immediately after a call to + recycle(). This should not impact typical Tomcat users. It + may impact users who use these classes directly in their own code. + (markt) +
+ When processing an HTTP 1.0 request in the HTTP connector and no host + information is provided in the request, obtain the server port from the + local port rather than the connector configuration since the configured + value maybe zero. (markt) +
+ Enable strict validation of the provided host name and port for all + connectors. Requests with invalid host names and/or ports will be + rejected with a 400 response. (markt) +
+ Update the host validation to permit host names and components of domain + names (excluding top-level domains) to start with a number and to ensure + that top-level domains are fully alphabetic. (markt) +
+ 62053: Fix NPE when writing push headers with HTTP/2 NIO2. + Patch submitted by Holger Sunke. (remm) +

Jasper

+ Include an HTTP Allow header when a JSP generates a + 405 response due to a request with an unsupported method. (markt) +
+ Add support for the HTTP OPTION method to JSPs. The + JSP specification explicitly states that the behaviour for this + method is undefined for JSPs so this is a Tomcat specific + behaviour. (markt) +

WebSocket

+ 62024: When closing a connection with an abnormal close, + close the socket immediately rather than waiting for a close message + from the client that may never arrive. (markt) +

Webapps

+ 62049: Fix missing class from manager 404 JSP error page. + (remm) +

jdbc-pool

+ Enhance the JMX support for jdbc-pool in order to expose + PooledConnection and JdbcInterceptors. + (kfujino) +
+ Add MBean for PooledConnection. (kfujino) +
+ 62011: Add MBean for StatementCache. (kfujino) +
+ Expose the cache size for each connection via JMX in + StatementCache. (kfujino) +
+ Add MBean for ResetAbandonedTimer. (kfujino) +

Other

+ Update the list with the public interfaces in the RELEASE-NOTES. + (violetagg) +
+ Update the NSIS Installer used to build the Windows installer to version + 3.03. (kkolinko) +

2018-01-22 Tomcat 9.0.4 (markt)

Catalina

+ Correct a regression in the previous fix for 61916 that meant + that any call to addHeader() would have been replaced with + a call to setHeader() for all requests mapped to the + AddDefaultCharsetFilter. (markt) +
+ 61999: maxSavePostSize set to 0 should disable saving POST + data during authentication. (remm) +

Coyote

+ Fix NIO2 HTTP/2 sendfile. (remm) +
+ 61993: Improve handling for ByteChunk and + CharChunk instances that grow close to the maximum size + allowed by the JRE. (markt) +

Jasper

+ 43925: Add a new system property + (org.apache.jasper.runtime.BodyContentImpl.BUFFER_SIZE) to + control the size of the buffer used by Jasper when buffering tag bodies. + (markt) +

Web applications

+ 62006: Document the new JvmOptions9 command line + parameter for tomcat9.exe. (markt) +

not released Tomcat 9.0.3 (markt)

Catalina

+ 57619: Implement a small optimisation to how JAR URLs are + processed to reduce the storage of duplicate String objects in memory. + Patch provided by Dmitri Blinov. (markt) +
+ Add some missing NPEs to ServletContext. (remm) +
+ Update the Java EE 8 XML schema to the released versions. (markt) +
+ Minor HTTP/2 push fixes. (remm) +
+ 61916: Extend the AddDefaultCharsetFilter to add + a character set when the content type is set via + setHeader() or addHeader() as well as when it + is set via setContentType(). (markt) +
+ When using WebDAV to copy a file resource to a destination that requires + a collection to be overwritten, ensure that the operation succeeds + rather than fails (with a 500 response). This enables Tomcat to pass two + additional tests from the Litmus WebDAV test suite. (markt) +
+ Modify the Default and WebDAV Servlets so that a 405 status code is + returned for PUT and DELETE requests when + disabled via the readonly initialisation parameter. +
+ Align the contents of the Allow header with the response + code for the Default and WebDAV Servlets. For any given resource a + method that returns a 405 status code will not be listed in the + Allow header and a method listed in the Allow + header will not return a 405 status code. (markt) +

Coyote

+ 60276: Implement GZIP compression support for responses + served over HTTP/2. (markt) +
+ Do not call onDataAvailable without any data to read. (remm) +
+ Correctly handle EOF when ServletInputStream.isReady() is + called. (markt) +
+ 61886: Log errors on non-container threads at + DEBUG rather than INFO. The exception will be + made available to the application via the asynchronous error handling + mechanism. (markt) +
+ 61914: Possible NPE with Java 9 when creating an SSL engine. + Patch submitted by Evgenij Ryazanov. (remm) +
+ 61918: Fix connectionLimitLatch counting when closing an + already closed socket. Based on a patch by Ryan Fong. (remm) +
+ Add support for the OpenSSL ARIA ciphers to the OpenSSL to JSSE + cipher mapping. (markt) +
+ 61932: Allow a call to AsyncContext.dispatch() + to terminate non-blocking I/O. (markt) +
+ 61948: Improve the handling of malformed ClientHello messages + in the code that extracts the SNI information from a TLS handshake for + the JSSE based NIO and NIO2 connectors. (markt) +
+ Fix NIO2 handshaking with a full input buffer. (remm) +
+ Return a simple, plain text error message if a client attempts to make a + plain text HTTP connection to a TLS enabled NIO or NIO2 Connector. + (markt) +

Jasper

+ 61854: When using sets and/or maps in EL expressions, ensure + that Jasper correctly parses the expression. Patch provided by Ricardo + Martin Camarero. (markt) +
+ Improve the handling of methods with varargs in EL expressions. In + particular, the calling of a varargs method with no parameters now works + correctly. Based on a patch by Nitkalya (Ing) Wiriyanuparb. (markt) +
+ 61945: Fix prototype mode used to compile tags. (remm) +

Web applications

+ 61223: Add the mbeans-descriptors.dtd file to the custom + MBean documentation so users have a reference to use when constructing + mbeans-descriptors.xml files for custom components. (markt) +
+ 61565: Add the ability to trigger a reloading of TLS host + configuration (certificate and key files, server.xml is not re-parsed) + via the Manager web application. (markt) +
+ 61566: Expose the currently in use certificate chain and list + of trusted certificates for all virtual hosts configured using the JSSE + style (keystore) TLS configuration via the Manager web application. + (markt) +
+ Partial fix for 61886. Ensure that multiple threads do not + attempt to complete the AsyncContext if an I/O error occurs + in the stock ticker example Servlet. (markt) +
+ 61886: Prevent ConcurrentModificationException + when running the asynchronous stock ticker in the examples web + application. (markt) +
+ 61886: Prevent NullPointerException and other + errors if the stock ticker example is running when the examples web + application is stopped. (markt) +
+ 61910: Clarify the meaning of the allowLinking + option in the documentation web application. (markt) +
+ Add OCSP configuration information to the SSL How-To. Patch provided by + Marek Czernek. (markt) +

jdbc-pool

+ 61312: Prevent NullPointerException when using + the statement cache of connection that has been closed. (kfujino) +

Other

+ Add an additional system property for the system property replacement. + (remm) +
+ Add missing SHA-512 hash for release artifacts to the build script. + (markt) +
+ Update the internal fork of Commons Pool 2 to 2.4.3. (markt) +
+ Update the internal fork of Commons DBCP 2 to 8a71764 (2017-10-18) to + pick up some bug fixes and enhancements. (markt) +
+ Update the internal fork of Commons FileUpload to 6c00d57 (2017-11-23) + to pick up some code clean-up. (markt) +
+ Update the internal fork of Commons Codec to r1817136 to pick up some + code clean-up. (markt) +
+ The native source bundles (for Commons Daemon and Tomcat Native) are no + longer copied to the bin directory for the deploy target. They are now + only copied to the bin directory for the release target. (markt) +

2017-11-30 Tomcat 9.0.2 (markt)

Catalina

+ Fix possible SecurityException when using TLS related + request attributes. (markt) +
+ 61597: Extend the StandardJarScanner to scan + JARs on the module path when running on Java 9 and class path scanning + is enabled. (markt) +
+ 61601: Add support for multi-release JARs in JAR scanning and + web application class loading. (markt) +
+ 61681: Allow HTTP/2 push when using request wrapping. (remm) +
+ Provide the SessionInitializerFilter that can be used to + ensure that an HTTP session exists when initiating a WebSocket + connection. Patch provided by isapir. (markt) +
+ 61682: When re-prioritising HTTP/2 streams, ensure that both + parent and children fields are correctly updated to avoid a possible + StackOverflowError. (markt) +
+ Improve concurrency by reducing the scope of the synchronisation for + javax.security.auth.message.config.AuthConfigFactory in the + JASPIC API implementation. Based on a patch by Pavan Kumar. (markt) +
+ Avoid a possible NullPointerException when timing out + AsyncContext instances during shut down. (markt) +
+ 61777: Avoid a NullPointerException when + detaching a JASPIC RegistrationListener. Patch provided by + Lazar. (markt) +
+ 61778: Correct the return value when detaching a JASPIC + RegistrationListener. Patch provided by Lazar. (markt) +
+ 61779: Avoid a NullPointerException when a + null RegistrationListener is passed to + AuthConfigFactory.getConfigProvider(). Patch provided by + Lazar. (markt) +
+ 61780: Only include the default JASPIC registration ID in the + return value for a call to + AuthConfigFactory.getRegistrationIDs() if a + RegistrationContext has been registered using the default + registration ID. Patch provided by Lazar. (markt) +
+ 61781: Enable JASPIC provider registrations to be persisted + when the layer and/or application context are null. Patch + provided by Lazar. (markt) +
+ 61782: When calling + AuthConfigFactory.doRegisterConfigProvider() and the + requested JASPIC config provider class is found by the web application + class loader, do not attempt to load the class with the class loader + that loaded the JASPIC API. Patch provided by Lazar. (markt) +
+ 61783: When calling + AuthConfigFactory.removeRegistration() and the registration + is persistent, it should be removed from the persistent store. Patch + provided by Lazar. (markt) +
+ 61784: Correctly handle the case when + AuthConfigFactoryImpl.registerConfigProvider() is called + with a provider name of null. Patch provided by Lazar. + (markt) +
+ 61795: Add a property to the Authenticator + implementations to enable a custom JASPIC CallbackHandler + to be specified. Patch provided by Lazar. (markt) +

Coyote

+ 61568: Avoid a potential SecurityException when + using the NIO2 connector and a new thread is added to the pool. (markt) +
+ 61583: Correct a further regression in the fix to enable the + use of Java key stores that contained multiple keys that did not all + have the same password. This fixes PKCS11 key store handling with + multiple keys selected with an alias. (markt) +
+ Improve NIO2 syncing for async IO operations. (remm) +
+ Sendfile support for HTTP/2 and NIO2. (remm) +
+ Reduce default HTTP/2 stream concurrent execution within a connection + from 200 to 20. (remm) +
+ 61668: Avoid a possible NPE when calling + AbstractHttp11Protocol.getSSLProtocol(). (markt) +
+ 61673: Avoid a possible + ConcurrentModificationException when working with the + streams associated with a connection. (markt) +
+ 61719: Avoid possible NPE calling + InputStream.setReadListener with HTTP/2. (remm) +
+ 61736: Improve performance of NIO connector when clients + leave large time gaps between network packets. Patch provided by Zilong + Song. (markt) +
+ 61740: Correct an off-by-one error in the Hpack header index + validation that caused intermittent request failures when using HTTP/2. + (markt) +

Jasper

+ 61604: Fix SMAP generation for JSPs that generate no output. + (markt) +
+ 61816: Invalid expressions in attribute values or template + text should trigger a translation (compile time) error, not a run time + error. (markt) +

WebSocket

+ 61604: Add support for authentication in the websocket + client. Patch submitted by J Fernandez. (remm) +

Web applications

+ Correct Javadoc links to point to Java SE 8 and Java EE 8. (markt) +
+ Enable Javadoc to be built with Java 9. (markt) +
+ 61603: Add XML filtering for the status servlet output where + needed. (remm) +
+ Correct the description of how the CGI servlet maps a request to a + script in the CGI How-To. (markt) +

Tribes

+ Fix incorrect behavior that attempts to resend channel messages more + than the actual setting value of maxRetryAttempts. + (kfujino) +
+ Ensure that the remaining Sender can send channel messages by avoiding + unintended ChannelException caused by comparing the number + of failed members and the number of remaining Senders. (kfujino) +
+ Ensure that remaining SelectionKeys that were not handled by throwing a + ChannelException during SelectionKey processing are + handled. (kfujino) +

Other

+ Improve the fix for 61439 and exclude the JPA, JAX-WS and EJB + annotations completely from the Tomcat distributions. (markt) +
+ Improve handling of endorsed directories. The endorsed directory + mechanism will only be used if the JAVA_ENDORSED_DIRS + system property is explicitly set or if + $CATALINA_HOME/endorsed exists. When running on Java 9, any + such attempted use of the endorsed directory mechanism will trigger an + error and Tomcat will fail to start. (rjung) +
+ 51496: When using the Windows installer, check if the + requested service name already exists and, if it does, prompt the user + to select an alternative service name. Patch provided by Ralph + Plawetzki. (markt) +
+ 61590: Enable service.bat to recognise when + JAVA_HOME is configured for a Java 9 JDK. (markt) +
+ 61598: Update the Windows installer to search the new (as of + Java 9) registry locations when looking for a JRE. (markt) +
+ Add generation of a SHA-512 hash for release artifacts to the build + script. (markt) +
+ 61658: Update MIME mappings for fonts to use + font/* as per RFC8081. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.16 to + pick up the latest Windows binaries built with APR 1.6.3 and OpenSSL + 1.0.2m. (markt) +
+ Update the NSIS Installer used to build the Windows installer to version + 3.02.1. (kkolinko) +
+ Update the Windows installer to use "The Apache Software Foundation" as + the Publisher when Tomcat is displayed in the list of installed + applications in Microsoft Windows. (kkolinko) +
+ 61803: Remove outdated SSL information from the Security + documentation. (remm) +

2017-09-30 Tomcat 9.0.1 (markt)

Catalina

+ Use the correct path when loading the JVM logging.properties + file for Java 9. (rjung) +
+ Add additional validation to the resource handling required to fix + CVE-2017-12617 on Windows. The checks were being performed elsewhere but + adding them to the resource handling ensures that the checks are always + performed. (markt) +

Other

+ 61563: Correct typos in Spanish translation. Patch provided by + Gonzalo Vásquez. (csutherl) +

not released Tomcat 9.0.0 (markt)

Catalina

+ 61542: Fix CVE-2017-12617 and prevent JSPs from being + uploaded via a specially crafted request when HTTP PUT was enabled. + (markt) +
+ 61554: Exclude test files in unusual encodings and markdown + files intended for display in GitHub from RAT analysis. Patch provided + by Chris Thistlethwaite. (markt) +

Coyote

+ 60762: Add the ability to make changes to the TLS + configuration of a connector at runtime without having to restart the + Connector. (markt) +
+ Add an option to reject requests that contain HTTP headers with invalid + (non-token) header names with a 400 response and reject such requests by + default. (markt) +
+ Implement the requirements of RFC 7230 (and RFC 2616) that HTTP/1.1 + requests must include a Host header and any request that + does not must be rejected with a 400 response. (markt) +
+ Implement the requirements of RFC 7230 that any HTTP/1.1 request that + specifies a host in the request line, must specify the same host in the + Host header and that any such request that does not, must + be rejected with a 400 response. This check is optional but enabled by + default. It may be disabled with the + allowHostHeaderMismatch attribute of the Connector. (markt) +
+ Implement the requirements of RFC 7230 that any HTTP/1.1 request that + contains multiple Host headers is rejected with a 400 + response. (markt) +
+ Add a way to set the property source in embedded mode. (remm) +
+ 61557: Correct a further regression in the fix to enable the + use of Java key stores that contain multiple keys that do not all have + the same password. The regression broke support for some FIPS compliant + key stores. (markt) +

jdbc-pool

+ 61545: Correctly handle invocations of methods defined in the + PooledConnection interface when using pooled XA + connections. Patch provided by Nils Winkler. (markt) +

Other

+ Update fix for 59904 so that values less than zero are accepted + instead of throwing a NegativeArraySizeException. (remm) +
+ Complete the implementation of the Servlet 4.0 specification. (markt) +

2017-09-19 Tomcat 9.0.0.M27 (markt)

Catalina

+ Before generating an error page in the ErrorReportValve, + check to see if I/O is still permitted for the associated connection + before generating the error page so that the page generation can be + skipped if the page is never going to be sent. (markt) +
+ 61189: Add the ability to set environment variables for + individual CGI scripts. Based on a patch by jm009. (markt) +
+ 61210: When running under a SecurityManager, do not print a + warning about not being able to read a logging configuration file when + that file does not exist. (markt) +
+ 61280: Add RFC 7617 support to the + BasicAuthenticator. Note that the default configuration + does not change the existing behaviour. (markt) +
+ 61424: Avoid a possible StackOverflowError when + running under a SecurityManager and using + Subject.doAs(). (markt) +
+ When running under Java 9 or later, and the + urlCacheProtection option of the + JreMemoryLeakPreventionListener is enabled, use the API + added in Java 9 to only disable the caching for JAR URL connections. + (markt) +
+ 61489: When using the CGI servlet, make the generation of + command line arguments from the query string (as per section 4.4 of RFC + 3875) optional and disabled by default. Based on a patch by jm009. + (markt) +
+ 61503: This corrects a potential regression in the fix for + 60940 with an alternative solution that adds the + JarEntry objects normally skipped by a + JarInputStream only if those entries exist. (markt) +

Coyote

+ The minimum required Tomcat Native version has been increased to 1.2.14. + This version includes a new API needed for correct client certificate + support when using a Java connector with OpenSSL TLS implementation and + support for the SSL_CONF OpenSSL API. (rjung) +
+ Add support for the OpenSSL SSL_CONF API when using + TLS with OpenSSL implementation. It can be used by adding + OpenSSLConf elements underneath SSLHostConfig. + The new element contains a list of OpenSSLConfCmd elements, + each with the attributes name and value. + (rjung) +
+ When using a Java connector in combination with the OpenSSL TLS + implementation, do not configure each SSL connection object via + the OpenSSLEngine. For OpenSSL the SSL object inherits its + settings from the SSL_CTX which we have already configured. + (rjung) +
+ When using JSSE TLS configuration with the OpenSSL implementation and + client certificates: include client CA subjects in the TLS handshake + so that the client can choose an appropriate client certificate to + present. (rjung) +
+ If an invalid option is specified for the + certificateVerification attribute of an + SSLHostConfig element, treat it as required + which is the most secure / restrictive option in addition to reporting + the configuration error. (markt) +
+ Improve the handling of client disconnections during the TLS + renegotiation handshake. (markt) +
+ Prevent exceptions being thrown during normal shutdown of NIO + connections. This enables TLS connections to close cleanly. (markt) +
+ Fix possible race condition when setting IO listeners on an upgraded + connection. (remm) +
+ Ensure that the APR/native connector uses blocking I/O for TLS + renegotiation. (markt) +
+ 48655: Enable Tomcat to shutdown cleanly when using sendfile, + the APR/native connector and a multi-part download is in progress. + (markt) +
+ 58244: Handle the case when OpenSSL resumes a TLS session + using a ticket and the full client certificate chain is not available. + In this case the client certificate without the chain will be presented + to the application. (markt) +
+ Improve the warning message when JSSE and OpenSSL configuration styles + are mixed on the same SSLHostConfig. (markt) +
+ 61415: Fix TLS renegotiation with OpenSSL based connections + and session caching. (markt) +
+ Delay checking that the configured attributes for an + SSLHostConfig instance are consistent with the configured + SSL implementation until Connector start to avoid incorrect + warnings when the SSL implementation changes during initialisation. + (markt) +
+ 61450: Fix default key alias algorithm. (remm) +
+ 61451: Correct a regression in the fix to enable the use of + Java key stores that contained multiple keys that did not all have the + same password. The regression broke support for any key store that did + not store keys in PKCS #8 format such as hardware key stores and Windows + key stores. (markt) +

WebSocket

+ 60523: Reduce the number of packets used to send WebSocket + messages by not flushing between the header and the payload when the + two are written together. (markt) +
+ 61491: When using the permessage-deflate + extension, correctly handle the sending of empty messages after + non-empty messages to avoid the IllegalArgumentException. + (markt) +

Web applications

+ Show connector cipher list in the manager web application in the + correct cipher order. (rjung) +

Tribes

+ To avoid unexpected session timeout notification from backup session, + update the access time when receiving the map member notification + message. (kfujino) +
+ Add member info to the log message when the failure detection check + fails in TcpFailureDetector. (kfujino) +
+ Avoid Ping timeout until the added map member by receiving + MSG_START message is completely started. (kfujino) +
+ When sending a channel message, make sure that the Sender has connected. + (kfujino) +
+ Correct the backup node selection logic that node 0 is returned twice + consecutively. (kfujino) +
+ Fix race condition of responseMap in + RpcChannel. (kfujino) +

jdbc-pool

+ 61391: Ensure that failed queries are logged if the + SlowQueryReport interceptor is configured to do so and the + connection has been abandoned. Patch provided by Craig Webb. (markt) +
+ 61425: Ensure that transaction of idle connection has + terminated when the testWhileIdle is set to + true and defaultAutoCommit is set to + false. Patch provided by WangZheng. (kfujino) +

Other

+ 61419: Replace a Unix style comment in the DOS bat file + catalina.bat with the correct rem markup. + (rjung) +
+ 61439: Remove the Java Annotation API classes from + tomcat-embed-core.jar and package them in a separate JAR in the + embedded distribution to provide end users with greater flexibility to + handle potential conflicts with the JRE and/or other JARs. (markt) +
+ 61441: Improve the detection of JAVA_HOME by the + daemon.sh script when running on a platform where Java has + been installed from an RPM. (rjung) +
+ Update the packaged version of the Tomcat Native Library to 1.2.14 to + pick up the latest Windows binaries built with APR 1.6.2 and OpenSSL + 1.0.2l. (markt) +
+ 61599: Update to Commons Daemon 1.1.0 for improved Java 9 + support. (markt) +

2017-08-08 Tomcat 9.0.0.M26 (markt)

Catalina

+ Correct multiple regressions in the fix for 49464 that could + corrupt static content served by the DefaultServlet.(markt) +
+ Correct a bug in the PushBuilder implementation that + meant push URLs containing %nn sequences were not correctly + decoded. Identified by FindBugs. (markt) +
+ 61164: Add support for the %X pattern in the + AccessLogValve that reports the connection status at the + end of the request. Patch provided by Zemian Deng. (markt) +
+ 61351: Correctly handle %nn decoding of URL patterns in + web.xml and similar locations that may legitimately contain characters + that are not permitted by RFC 3986. (markt) +
+ 61366: Add a new attribute, localDataSource, to + the JDBCStore that allows the Store to be configured to use + a DataSource defined by the web application rather than the default of + using a globally defined DataSource. Patch provided by Jonathan + Horowitz. (markt) +

Coyote

+ 61086: Ensure to explicitly signal an empty request body for + HTTP 205 responses. Additional fix to r1795278. Based on a patch + provided by Alexandr Saperov. (violetagg) +
+ 61345: Add a server listener that can be used to do system + property replacement from the property source configured in the + digester. (remm) +
+ Add additional logging to record problems that occur while waiting for + the NIO pollers to stop during the Connector stop process. (markt) +

Jasper

+ 61364: Ensure that files are closed after detecting encoding + of JSPs so that files do not remain locked by the file system. (markt) +

WebSocket

+ 57767: Add support to the WebSocket client for following + redirects when attempting to establish a WebSocket connection. Patch + provided by J Fernandez. (markt) +

2017-07-28 Tomcat 9.0.0.M25 (markt)

Catalina

+ Performance improvements for service loader look-ups (and look-ups of + other class loader resources) when the web application is deployed in a + packed WAR file. (markt) +
+ 60963: Add ExtractingRoot, a new + WebResourceRoot implementation that extracts JARs to the + work directory for improved performance when deploying packed WAR files. + (markt) +
+ 61253: Add warn message when Digester.updateAttributes + throws an exception instead of ignoring it. (csutherl) +
+ Correct a further regression in the fix for 49464 that could + cause an byte order mark character to appear at the start of content + included by the DefaultServlet. (markt) +
+ 61313: Make the read timeout configurable in the + JNDIRealm and ensure that a read timeout will result in an + attempt to fail over to the alternateURL. Based on patches by Peter + Maloney and Felix Schumacher. (markt) +

Web applications

+ Correct the documentation for how StandardRoot is + configured. (markt) +

Other

+ 61316: Fix corruption of UTF-16 encoded source files in + released source distributions. (markt) +

not released Tomcat 9.0.0.M24 (markt)

Catalina

+ 52924: Add support for a Tomcat specific deployment + descriptor, /WEB-INF/tomcat-web.xml. This descriptor has an + identical format to /WEB-INF/web.xml. The Tomcat descriptor + takes precedence over any settings in conf/web.xml but does + not take precedence over any settings in /WEB-INF/web.xml. + (markt) +
+ 61232: When log rotation is disabled only one separator will + be used when generating the log file name. For example if the prefix is + catalina. and the suffix is .log then the log + file name will be catalina.log instead of + catalina..log. Patch provided by Katya Stoycheva. + (violetagg) +
+ 61264: Correct a regression in the refactoring to use + Charset rather than String to store request + character encoding that prevented getReader() throwing an + UnsupportedEncodingException if the user agent specifies + an unsupported character encoding. (markt) +
+ Correct a regression in the fix for 49464 that could cause an + incorrect Content-Length header to be sent by the + DefaultServlet if the encoding of a static is not + consistent with the encoding of the response. (markt) +

Coyote

+ Enable TLS connectors to use Java key stores that contain multiple keys + where each key has a separate password. Based on a patch by Frank + Taffelt. (markt) +
+ Improve the handling of HTTP/2 stream resets due to excessive headers + when a continuation frame is used. (markt) +

Jasper

+ 53031: Add support for the fork option when + compiling JSPs with the Jasper Ant task and javac. (markt) +

Other

+ 52791: Add the ability to set the defaults used by the + Windows installer from a configuration file. Patch provided by Sandra + Madden. (markt) +

not released Tomcat 9.0.0.M23 (markt)

Catalina

+ 49464: Improve the Default Servlet's handling of static files + when the file encoding is not compatible with the required response + encoding. (markt) +
+ 61214: Remove deleted attribute servlets from + the Context MBean description. Patch provided by Alexis Hassler. (markt) +
+ 61215: Correctly define addConnectorPort and + invalidAuthenticationWhenDeny in the + mbean-descriptors.xml file for the + org.apache.catalina.valves package so that the attributes + are accessible via JMX. (markt) +
+ 61216: Improve layout for CompositeData and + TabularData when viewing via the JMX proxy servlet. Patch + provided by Alexis Hassler. (markt) +
+ Additional permission for deleting files is granted to JULI as it is + required by FileHandler when running under a Security Manager. The + thread that cleans the log files is marked as daemon thread. + (violetagg) +
+ 61229: Correct a regression in 9.0.0.M21 that broke WebDAV + handling for resources with names that included a & + character. (markt) +

Coyote

+ Restore the ability to configure support for SSLv3. Enabling this + protocol will trigger a warning in the logs since it is known to be + insecure. (markt) +
+ Add LoadBalancerDrainingValve, a Valve designed to reduce the amount of + time required for a node to drain its authenticated users. (schultz) +
+ Do not log a warning when a null session is returned for an + OpenSSL based TLS session since this is expected when session tickets + are enabled. (markt) +
+ When the access log valve logs a TLS related request attribute and the + NIO2 connector is used with OpenSSL, ensure that the TLS attributes are + available to the access log valve when the connection is closing. + (markt) +
+ 60461: Sync SSL session access for the APR connector. (remm) +
+ 61224: Make the GlobalRequestProcessor MBean + attributes read-only. Patch provided by Alexis Hassler. (markt) +

Jasper

+ 49176: When generating JSP runtime error messages that quote + the relevant JSP source code, switch from using the results of the JSP + page parsing process to using the JSR 045 source map data to identify + the correct part of the JSP source from the stack trace. This + significantly reduces the memory footprint of Jasper in development + mode, provides a small performance improvement for error page generation + and enables source quotes to continue to be provided after a Tomcat + restart. (markt) +

Web applications

+ Remove references to the Loader attribute + searchExternalFirst from the documentation since the + attribute is no longer supported. (markt) +

Tribes

+ 51513: Add support for the compressionMinSize + attribute to the GzipInterceptor, add optional statistics + collection and expose the Interceptor over JMX. Based on a patch by + Christian Stöber. (markt) +
+ 61127: Allow human-readable names for channelSendOptions and + mapSendOptions. Patch provided by Igal Sapir. (schultz) +

Other

+ Restore the local definition of the web service annotations since the + JRE provided versions are deprecated and Java 9 does not provide them by + default. (markt) +
+ Add necessary Java 9 configuration options to the startup scripts to + prevent warnings being generated on web application stop. (markt) +

2017-06-26 Tomcat 9.0.0.M22 (markt)

Catalina

+ 48543: Add the option to specify an alternative file name for + the catalina.config system property. Also document that + relative, as well as absolute, URLs are permitted. (markt) +
+ 61072: Respect the documentation statements that allow + using the platform default secure random for session id generation. + (remm) +
+ Correct the javadoc for + o.a.c.connector.CoyoteAdapter#parseSessionCookiesId. + Patch provided by John Andrew (XUZHOUWANG) via Github. (violetagg) +
+ 61101: CORS filter should set Vary header in response. + Submitted by Rick Riemer. (remm) +
+ 61105: Add a new JULI FileHandler configuration for + specifying the maximum number of days to keep the log files. By default + the log files will be kept 90 days as configured in + logging.properties. (violetagg) +
+ Update the Servlet 4.0 implementation to add support for setting + trailer fields for HTTP responses. (markt) +
+ 61125: Ensure that WarURLConnection returns the + correct value for calls to getLastModified() as this is + required for the correct detection of JSP modifications when the JSP is + packaged in a WAR file. (markt) +
+ Improve the SSLValve so it is able to handle client + certificate headers from Nginx. Based on a patch by Lucas Ventura Carro. + (markt) +
+ 61134: Do not use '[' and ']' symbols around substituted + text fragments when generating the default error pages. Patch provided + by Katya Todorova. (violetagg) +
+ 61154: Allow the Manager and Host Manager web applications to + start by default when running under a security manager. This was + accomplished by adding a custom permission, + org.apache.catalina.security.DeployXmlPermission, that + permits an application to use a META-INF/context.xml file + and then granting that permission to the Manager and Host Manager. + (markt) +
+ 61173: Polish the javadoc for + o.a.catalina.startup.Tomcat. Patch provided by + peterhansson_se. (violetagg) +
+ A new configuration property crawlerIps is added to the + o.a.catalina.valves.CrawlerSessionManagerValve. Using this + property one can specify a regular expression that will be used to + identify crawlers based on their IP address. Based on a patch provided + by Tetradeus. (violetagg) +
+ 61180: Log a warning message rather than an information + message if it takes more than 100ms to initialised a + SecureRandom instance for a web application to use to + generate session identifiers. Patch provided by Piotr Chlebda. (markt) +
+ 61185: When an asynchronous request is dispatched via + AsyncContext.dispatch() ensure that + getRequestURI() for the dispatched request matches that of + the original request. (markt) +
+ 61197: Ensure that the charset name used in the + Content-Type header has exactly the same form as that + provided by the application. This reverts a behavioural change in + 9.0.0.M21 that caused problems for some clients. (markt) +
+ 61201: Ensure that the SCRIPT_NAME environment + variable for CGI executables is populated in a consistent way regardless + of how the CGI servlet is mapped to a request. (markt) +
+ Ensure to send a space between trailer field name and field value + for HTTP responses trailer fields. (huxing) +

Coyote

+ 61086: Explicitly signal an empty request body for HTTP 205 + responses. (markt) +
+ 61120: Do not ignore path parameters when processing HTTP/2 + requests. (markt) +
+ Revert a change introduced in the fix for bug 60718 that + changed the status code recorded in the access log when the client + dropped the connection from 200 to 500. (markt) +
+ Make asynchronous error handling more robust. In particular ensure that + onError() is called for any registered + AsyncListeners after an I/O error on a non-container + thread. (markt) +
+ Add additional syncs to the SSL session object provided by the OpenSSL + engine so that a concurrent destruction cannot cause a JVM crash. + (remm) +

Jasper

+ 44787: Improve error message when JSP compiler configuration + options are not valid. (markt) +
+ 45931: Extend Jasper's timeSpaces option to add + support for single which replaces template text that + consists entirely of whitespace with a single space character. Based on + a patch by Meetesh Karia. (markt) +
+ 53011: When pre-compiling with JspC, report all compilation + errors rather than stopping after the first error. A new option + -failFast can be used to restore the previous behaviour of + stopping after the first error. Based on a patch provided by Marc Pompl. + (markt) +
+ 61137: j.s.jsp.tagext.TagLibraryInfo#uri and + j.s.jsp.tagext.TagLibraryInfo#prefix fields should not be + final. Patch provided by Katya Todorova. (violetagg) +

WebSocket

+ Correct the log message when a MessageHandler for + PongMessage does not implement + MessageHandler.Whole. (rjung) +
+ Improve thread-safety of Futures used to report the result + of sending WebSocket messages. (markt) +
+ 61183: Correct a regression in the previous fix for + 58624 that could trigger a deadlock depending on the locking + strategy employed by the client code. (markt) +

Web applications

+ Better document the meaning of the trimSpaces option for Jasper. (markt) +
+ 61150: Configure the Manager and Host-Manager web + applications to permit serialization and deserialization of + CRSFPreventionFilter related session objects to avoid warning messages + and/or stack traces on web application stop and/or start when running + under a security manager. (markt) +
+ Correct the TLS configuration documentation to remove SSLv2 and SSLv3 + from the list of supported protocols. (markt) +

Other

+ 45832: Add HTTP DIGEST authentication support to the Catalina + Ant tasks used to communicate with the Manager application. (markt) +
+ 45879: Add the RELEASE-NOTES file to the root of + the installation created by the Tomcat installer for Windows to make it + easier for users to identify the installed Tomcat version. (markt) +
+ 61055: Clarify the code comments in the rewrite valve to make + clear that there are no plans to provide proxy support for this valve + since Tomcat does not have proxy capabilities. (markt) +
+ 61076: Document the altDDName attribute for the + Context element. (markt) +
+ Correct typo in Jar Scan Filter Configuration Reference. + Issue reported via comments.apache.org. (violetagg) +
+ Correct the requirement for the minimum Java SE version in Application + Developer's Guide. Issue reported via comments.apache.org. (violetagg) +
+ 61145: Add missing @Documented annotation to + annotations in the annotations API. Patch provided by Katya Todorova. + (markt) +
+ 61146: Add missing lookup() method to + @EJB annotation in the annotations API. Patch provided by + Katya Todorova. (markt) +
+ Correct typo in Context Container Configuration Reference. + Patch provided by Katya Todorova. (violetagg) +

2017-05-10 Tomcat 9.0.0.M21 (markt)

General

+ Allow to exclude JUnit test classes using the build property + test.exclude and document the property in + BUILDING.txt. (rjung) +

Catalina

+ Review those places where Tomcat re-encodes a URI or URI component and + ensure that the correct encoding (path differs from query string) is + applied and that the encoding is applied consistently. (markt) +
+ Avoid a NullPointerException when reading attributes for a + initialised HTTP connector where TLS is enabled. (markt) +
+ Always quote the hostName of an SSLHostConfig + element when using it as part of the JMX object name to avoid errors that + prevent the associated TLS connector from starting if a wild card + hostName is configured (because * is a + reserved character for JMX object names). (markt) +
+ Update the default URIEncoding for a Connector + to UTF-8 as required by the Servlet 4.0 specification. + (markt) +
+ Switch to using Charset rather than String to + store encoding settings (including for configuration and for the + Content-Type header) to reduce the number of places the + associated Charset needs to be looked up. (markt) +
+ Use a more reliable mechanism for the DefaultServlet when + determining if the current request is for custom error page or not. + (markt) +
+ Ensure that when the Default or WebDAV servlets process an error + dispatch that the error resource is processed via the + doGet() method irrespective of the method used for the + original request that triggered the error. (markt) +
+ If a static custom error page is specified that does not exist or cannot + be read, ensure that the intended error status is returned rather than a + 404 or 403. (markt) +
+ When the WebDAV servlet is configured and an error dispatch is made to a + custom error page located below WEB-INF, ensure that the + target error page is displayed rather than a 404 response. (markt) +
+ Update the Servlet 4.0 implementation to add support for obtaining + trailer fields from chunked HTTP requests. (markt) +
+ 61047: Add MIME mapping for woff2 fonts in the default + web.xml. Patch provided by Justin Williamson. (violetagg) +
+ Correct the logic that selects the encoding to use to decode the query + string in the SSIServletExternalResolver so that the + useBodyEncodingForURI attribute of the + Connector is correctly taken into account. (markt) +
+ Within the Expires filter, make the content type value specified with the + ExpiresByType parameter, case insensitive. (markt) +

Coyote

+ When a TrustManager is configured that does not support + certificateVerificationDepth only log a warning about that + lack of support when certificateVerificationDepth has been + explicitly set. (markt) +
+ 60970: Extend the fix for large headers to push requests. + (markt) +
+ Do not include a Date header in HTTP/2 responses with + status codes less than 200. (markt) +
+ When sending an HTTP/2 push promise with the NIO2 connector, the pushed + stream ID should only be included with the initial push promise frame + and not any subsequent continuation frames. (markt) +

Jasper

+ When no BOM is present and an encoding is detected, do not skip the + bytes used to detect the encoding since they are not part of a BOM. + (markt) +
+ 61057: Update to Eclipse JDT Compiler 4.6.3. (violetagg) +
+ 61065: Ensure that once the class is resolved by + javax.el.ImportHandler#resolveClass it will be cached with + the proper name. (violetagg) +

WebSocket

+ Introduce new API o.a.tomcat.websocket.WsSession#suspend/ + o.a.tomcat.websocket.WsSession#resume that can be used to + suspend/resume reading of the incoming messages. (violetagg) +
+ 61003: Ensure the flags for reading/writing in + o.a.t.websocket.AsyncChannelWrapperSecure are correctly + reset even if some exceptions occurred during processing. (markt/violetagg) +

Web Applications

+ Add documents for maxIdleTime attribute to Channel Receiver + docs. (kfujino) +

Tribes

+ Add features to get the statistics of the thread pool of the + Receiver component and + MessageDispatchInterceptor. These statistics information + can be acquired via JMX. (kfujino) +
+ Add maxIdleTime attribute to NioReceiverMBean + in order to expose to JMX. (kfujino) +
+ Add JMX support for Channel Interceptors. The Interceptors + that implement JMX support are TcpFailureDetector, + ThroughputInterceptor, TcpPingInterceptor, + StaticMembershipInterceptor, + MessageDispatchInterceptor and + DomainFilterInterceptor. (kfujino) +

Other

+ Modify the Ant build script used to publish to a Maven repository so + that it no longer requires artifacts to be GPG signed. This is make it + possible for the CI system to upload snapshot builds to the ASF Maven + repository. (markt) +

2017-04-18 Tomcat 9.0.0.M20 (markt)

Catalina

+ Update the Servlet 4.0 API implementation to reflect the change in + method name from getPushBuilder() to + newPushBuilder(). (markt) +
+ Correct various edge cases in the new HTTP Host header validation + parser. Patch provided by Katya Todorova. (martk) +
+ Correct a regression in the X to comma refactoring that broke JMX + operations that take parameters. (markt) +
+ Avoid a NullPointerException when reading attributes for a + running HTTP connector where TLS is not enabled. (markt) +
+ 47214: Refactor code so that explicitly referenced inner + classes are given explicit names rather than being anonymous. (markt) +
+ 59825: Log a message that lists the components in the + processing chain that do not support async processing when a call to + ServletRequest.startAsync() fails. (markt) +
+ 60940: Improve the handling of the META-INF/ and + META-INF/MANIFEST.MF entries for Jar files located in + /WEB-INF/lib when running a web application from a packed + WAR file. (markt) +
+ Pre-load the ExceptionUtils class. Since the class is used + extensively in error handling, it is prudent to pre-load it to avoid any + failure to load this class masking the true problem during error + handling. (markt) +
+ Avoid potential NullPointerExceptions related to access + logging during shutdown, some of which have been observed when running + the unit tests. (markt) +
+ When there is no javax.servlet.WriteListener registered + then a call to javax.servlet.ServletOutputStream#isReady + will return false instead of throwing + IllegalStateException. (violetagg) +
+ When there is no javax.servlet.ReadListener registered + then a call to javax.servlet.ServletInputStream#isReady + will return false instead of throwing + IllegalStateException. (violetagg) +

Coyote

+ Align cipher configuration parsing with current OpenSSL master. (markt) +
+ 60970: Fix infinite loop if application tries to write a + large header to the response when using HTTP/2. (markt) +

Jasper

+ 47214: Refactor code so that explicitly referenced inner + classes are given explicit names rather than being anonymous. (markt) +
+ 60925: Improve the handling of access to properties defined + by interfaces when a BeanELResolver is used under a + SecurityManager. (markt) +

Tribes

+ Add JMX support for Tribes components. (kfujino) +

jdbc-pool

+ Refactor the creating a constructor for a proxy class to reduce + duplicate code. (kfujino) +
+ In StatementFacade, the method call on the statements that + have been closed throw SQLException rather than + NullPointerException. (kfujino) +

Other

+ 60932: Correctly escape single quotes when used in i18n + messages. Based on a patch by Michael Osipov. (markt) +
+ Review i18n property files, remove unnecessary escaping and consistently + use [...] to delimit inserted values. (markt) +
+ Update the custom Ant task that integrates with the Symantec code + signing service to use the now mandatory 2-factor authentication. + (markt) +
+ Refactoring in preparation for Java 9. Refactor to avoid using some + methods that will be deprecated in Java 9 onwards. (markt) +

2017-03-30 Tomcat 9.0.0.M19 (markt)

Catalina

+ 54618: Add support to the + HttpHeaderSecurityFilter for the HSTS preload parameter. + (markt) +
+ Correct a bug in the implementation of the Servlet 4.0 feature that + allows specifying a default request and/or response character encoding + per web application. null values passed via the + programmatic interface no longer trigger a + NullPointerException. (markt) +
+ Correct a potential exception during shutdown when one or more + Containers are configured with a value of 1 for startStopThreads. + (markt) +
+ 60853: Expose the SSLHostConfig and + SSLHostConfigCertificate objects via JMX. (markt) +
+ 60876: Ensure that Set-Cookie headers generated + by the Rfc6265CookieProcessor are aligned with the + specification. Patch provided by Jim Griswold. (markt) +
+ 60882: Fix a NullPointerException when obtaining + a RequestDispatcher for a request that will not have any + pathInfo associated with it. This was a regression in the changes in + 9.0.0.M18 for the Servlet 4.0 API changes. (markt) +
+ Align PushBuilder API with changes from the Servlet expert + group. (markt) +
+ Align web.xml parsing rules with changes from the Servlet expert group + for <request-character-encoding> and + <response-character-encoding>. (markt) +
+ Refactor the various implementations of X to comma separated list to a + single utility class and update the code to use the new utility class. + (markt) +
+ 60911: Ensure NPE will not be thrown when looking for SSL + session ID. Based on a patch by Didier Gutacker. (violetagg) +

Coyote

+ Add async based IO groundwork for HTTP/2. (remm) +
+ Fix HTTP/2 incorrect input unblocking on EOF. (remm) +
+ Close the connection sooner if an event occurs for a current connection + that is not consistent with the current state of that connection. + (markt) +
+ Speed up shutdown when using multiple acceptor threads by ensuring that + the code that unlocks the acceptor threads correctly handles the case + where there are multiple threads. (markt) +
+ 60851: Add application/xml and + application/json to the default list of compressible MIME + types. Patch by Michael Osipov. (markt) +
+ 60852: Correctly spell compressible when used in + configuration attributes and internal code. Based on a patch by Michael + Osipov. (markt) +
+ 60900: Avoid a NullPointerException in the APR + Poller if a connection is closed at the same time as new data arrives on + that connection. (markt) +
+ Improve HPACK specification compliance by fixing some test failures + reported by the h2spec tool written by Moto Ishizawa. (markt) +
+ Improve HTTP/2 specification compliance by fixing some test failures + reported by the h2spec tool written by Moto Ishizawa. (markt) +
+ 60918: Fix sendfile processing error that could lead to + subsequent requests experiencing an IllegalStateException. + (markt) +
+ Improve sendfile handling when requests are pipelined. (markt) +

Jasper

+ 60844: Correctly handle the error when fewer parameter values + than required by the method are used to invoke an EL method expression. + Patch provided by Daniel Gray. (markt) +

jdbc-pool

+ 60764: Implement equals() and + hashCode() in the StatementFacade in order to + enable these methods to be called on the closed statements if any + statement proxy is set. This behavior can be changed with + useStatementFacade attribute. (kfujino) +

Other

+ Refactor the build script and the NSIS installer script so that either + NSIS 2.x or NSIS 3.x can be used to build the installer. This is + primarily to re-enable building the installer on the Linux based CI + system where the combination of NSIS 3.x and wine leads to failed + installer builds. (markt) +

2017-03-13 Tomcat 9.0.0.M18 (markt)

Catalina

+ 60469: Refactor RealmBase for better code re-use + when implementing Realms that use a custom Principal. + (markt) +
+ 60490: Various formatting and layout improvements for the + ErrorReportValve. Patch provided by Michael Osipov. (markt) +
+ 60573: Remove the reason phrase when sending a + 100 response status for consistency with other response + status lines. Patch provided by Michael Osipov. (markt) +
+ 60596: Improve performance of DefaultServlet when sendfile + feature is disabled on connector. (kkolinko) +
+ Make it easier for sub-classes of Tomcat to modify the + default web.xml settings by over-riding + getDefaultWebXmlListener(). Patch provided by Aaron + Anderson. (markt) +
+ Reduce the contention in the default InstanceManager + implementation when multiple threads are managing objects and need to + reference the annotation cache. (markt) +
+ 60623: When startStopThreads is 1 (or a special value that + is equivalent to 1) then rather than using an + ExecutorService to start the children of the current + component, the children will be started on the current thread. (markt) +
+ 60674: Remove final marker from + CorsFilter to enable sub-classing. (markt) +
+ 60683: Security manager failure causing NPEs when doing IO + on some JVMs. (csutherl) +
+ 60688: Update the internal fork of Apache Commons BCEL to + r1782855 to add early access Java 9 support to the annotation scanning + code. (markt) +
+ 60694: Prevent NPE during authentication when no JASPIC + AuthConfigFactory is available. (markt) +
+ 60697: When HTTP TRACE requests are disabled on the + Connector, ensure that the HTTP OPTIONS response from custom servlets + does not include TRACE in the returned Allow header. (markt) +
+ 60718: Improve error handling for asynchronous processing and + correct a number of cases where the requestDestroyed() + event was not being fired and an entry wasn't being made in the access + logs. (markt) +
+ 60720: Replace "WWW-Authenticate" literal with static final + AUTH_HEADER_NAME in SpnegoAuthenticator. Patch provided by Michael + Osipov. (violetagg) +
+ The default JASPIC AuthConfigFactory now correctly notifies + registered RegistrationListeners when a new + AuthConfigProvider is registered. (markt) +
+ Improve the performance of AuthenticatorBase when there is + no JASPIC configuration available. (violetagg) +
+ When HTTP TRACE requests are disabled on the Connector, ensure that the + HTTP OPTIONS response from the WebDAV servlet does not include + TRACE in the returned Allow header. (markt) +
+ 60722: Take account of the + dispatchersUseEncodedPaths setting on the current + Context when generating paths for dispatches triggered + by AsyncContext.dispatch(). (markt) +
+ 60728: Make the separator Tomcat uses in the Tomcat specific + war:file:... URL protocol customizable via a system + property. The separator is equivalent to the use of the ! + character in jar:file:... URLs. The default separator of + * remains unchanged. (markt) +
+ Update the Servlet 4.0 API implementation to align with the latest + proposals from the Servlet 4.0 expert group. This includes updates to + the new Servlet mapping API, new methods on the + ServletContext to make the available API more equivalent to + the deployment descriptor, updates to the HTTP push API and the ability + to set default request and response character encoding per web + application. Note that the Servlet 4.0 API is still a work in progress + and further changes are likely. (markt) +
+ 60798: Correct a bug in the handling of JARs in unpacked WARs + that meant multiple attempts to read the same entry from a JAR in + succession would fail for the second and subsequent attempts. (markt) +
+ 60808: Ensure that the Map returned by + ServletRequest.getParameterMap() is fully immutable. Based + on a patch provided by woosan. (markt) +
+ 60824: Correctly cache the Subject in the + session - if there is a session - when running under a + SecurityManager. Patch provided by Jan Engehausen. (markt) +
+ Ensure request and response facades are used when firing application + listeners. (markt/remm) +

Coyote

+ Improve handling of case when an HTTP/2 client sends more data that is + subject to flow control than the current window size allows. (markt) +
+ Improve NIO2 look-ahead parsing of TLS client hello for SNI with large + client hello messages. (markt) +
+ Enable ALPN and also, therefore, HTTP/2 for the NIO and NIO2 HTTP + connectors when using the JSSE implementation for TLS when running on + Java 9. (markt) +
+ Restore Java 9 direct byte buffer compatibility. (remm) +
+ 59807: Provide a better error message when there is no + SSLHostConfig defined with a hostName that + matches the defaultSSLHostConfigName for the associated + Connector. (markt) +
+ 60627: Modify the Rfc6265CookieProcessor so that + in addition to cookie headers that start with an explicit RFC 2109 + $Version=1, cookies that start with $Version=0 + are also parsed as RFC 2109 cookies. (markt) +
+ Include the value of SslHostConfig.truststoreAlgorithm when + warning that the algorithm does not support the + certificateVerificationDepth configuration option. (markt) +
+ Ensure that executor thread pools used with connectors pre-start the + configured minimum number of idle threads. (markt) +
+ 60716: Add a new JSSE specific attribute, + revocationEnabled, to SSLHostConfig to permit + JSSE provider revocation checks to be enabled when no + certificateRevocationListFile has been configured. The + expectation is that configuration will be performed via a JSSE provider + specific mechanisms. (markt) +
+ Modify the cookie header generated by the + Rfc6265CookieProcessor so it always sends an + Expires attribute as well as a Max-Age + attribute to avoid problems with Microsoft browsers that do not support + the Max-Age attribute. (markt) +
+ 60761: Expose a protected getter and setter for + NioEndpoint.stopLatch to make the class easier to extend. + (markt) +
+ Prevent blocking reads after a stream exception occurs with HTTP/2. + (remm) +

Jasper

+ Follow up to the fix for 58178. When creating the + ELContext for a tag file, ensure that any registered + ELContextListeners are fired. (markt) +
+ Refactor code generated for JSPs to reduce the size of the code required + for tags. (markt) +
+ Improve the error handling for simple tags to ensure that the tag is + released and destroyed once used. (remm, violetagg) +
+ 60769: Correct a regression in the XML encoding detection + refactoring carried out for 9.0.0.M16 that incorrectly always used the + detected BOM encoding in preference to any encoding specified in the + prolog. (markt) +

Cluster

+ Make the accessTimeout configurable in + BackupManager and ClusterSingleSignOn. The + accessTimeout is used as a timeout period for PING in + replication map. (kfujino) +
+ 60806: To avoid ClassNotFoundException, make + sure that the web application class loader is passed to + ReplicatedContext. (kfujino) +

WebSocket

+ 60617: Correctly create a CONNECT request when + establishing a WebSocket connection via a proxy. Patch provided by + Svetlin Zarev. (markt) +

Tribes

+ Add log message that PING message has received beyond the timeout + period. (kfujino) +
+ When a PING message that beyond the time-out period has been received, + make sure that valid member is added to the map membership. (kfujino) +
+ Ensure that NoRpcChannelReply messages are not received on + RpcCallback. (kfujino) +

Web Applications

+ Add Specification and Javadoc references for JASPIC to the Docs + application. (csutherl) +

Other

+ Spelling corrections provided by Josh Soref. (violetagg) +
+ Remove local definition of web service annotations since these are + provided by the JRE. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.12 to + pick up the latest Windows binaries built with OpenSSL 1.0.2k. (violetagg) +
+ 60784: Update all unit tests that test the HTTP status line + to check for the required space after the status code. Patch provided by + Michael Osipov. (markt) +

2017-01-16 Tomcat 9.0.0.M17 (markt)

Catalina

+ 60620: + Extend the JreMemoryLeakPreventionListener to provide + protection against ForkJoinPool.commonPool() related memory + leaks. (markt) +

Coyote

+ Ensure UpgradeProcessor instances associated with closed connections are + removed from the map of current connections to Processors. (markt) +
+ Remove a workaround for a problem previously reported with WebSocket, + TLS and APR that treated some error conditions as not errors. The + original problem cannot be reproduced with the current code and the + work-around is now causing problems. (markt) +

Jasper

+ 60497: Follow up fix using a better variable name for the + tag reuse flag. (remm) +
+ Revert use of try/finally for simple tags. (remm) +

WebSocket

+ Prevent potential processing loop on unexpected WebSocket connection + closure. (markt) +

jdbc-pool

+ Enable reset the statistics without restarting the pool. (kfujino) +

Other

+ Update the NSIS Installer used to build the Windows installer to version + 3.01. (markt) +
+ Spelling corrections provided by Josh Soref. (violetagg) +

not released Tomcat 9.0.0.M16 (markt)

Catalina

+ 53602: Add HTTP status code 451 (RFC 7725) to the list of + HTTP status codes recognised by the ErrorReportValve. (markt) +
+ 60446: Handle the case where the stored user credential uses + a different key length than the length currently configured for the + CredentialHandler. Based on a patch by Niklas Holm. (markt) +
+ Update the warnings that reference required options for running on Java + 9 to use the latest syntax for those options. (markt) +
+ 60513: Fix thread safety issue with RMI cleanup code. (remm) +

Coyote

+ Expand the search process for a server certificate when OpenSSL is used + with a JSSE connector and an explicit alias has not been configured. + (markt) +
+ Extract the common Acceptor code from each Endpoint into a new Acceptor + class that is used by all Endpoints. (markt) +
+ 60450: Improve the selection algorithm for the default trust + store type for a TLS Virtual Host. In particular, don't use + PKCS12 as a default trust store type. Better document how + the default trust store type is selected for a TLS virtual host. (markt) +
+ 60451: Correctly handle HTTP/2 header values that contain + characters with unicode code points in the range 128 to 255. Reject + with a clear error message HTTP/2 header values that contain characters + with unicode code points above 255. (markt) +
+ Improve the logic that selects an address to use to unlock the Acceptor + to take account of platforms what do not listen on all local addresses + when configured with an address of 0.0.0.0 or + ::. (markt) +
+ Correct a regression in the refactoring to make wider use of + ByteBuffer that caused an intermittent failure in the unit + tests. (markt) +
+ 60482: HTTP/2 shouldn't do URL decoding on the query string. + (remm) +
+ Fix an HTTP/2 compression error. Once a new size has been agreed for the + dynamic HPACK table, the next header block must begin with a dynamic + table update. (markt) +
+ 60508: Set request start time for HTTP/2. (remm) +
+ The default output buffer size for AJP connectors is now based on the + configured AJP packet size rather than the minimum permitted AJP packet + size. (markt) +

Jasper

+ Implement a simpler JSP file encoding detector that delegates XML prolog + encoding detection to the JRE rather than using a custom XML parser. + (markt) +
+ 60497: Restore previous tag reuse behavior following the use + of try/finally. (remm) +
+ Improve the error handling for simple tags to ensure that the tag is + released and destroyed once used. (remm) +

WebSocket

+ Correctly handle blocking WebSocket writes when the write times out just + before the write is attempted. (markt) +

Web Applications

+ 60344: Add a note to BUILDING.txt regarding using the source + bundle with the correct line endings. (markt) +
+ 60467: remove problematic characters from XML documentation. + Based upon a patch by Michael Osipov. (schultz) +
+ In the documentation web application, be explicit that clustering + requires a secure network for all of the cluster network traffic. + (markt) +
+ Update the ASF logos to the new versions. +
+ 60468: Correct the format of the sample ISO-8601 date used + to report the build date for the documentation. Patch provided by + Michael Osipov. (markt) +

Other

+ Update the ASF logos used in the Apache Tomcat installer for Windows to + use the new versions. +

2016-12-08 Tomcat 9.0.0.M15 (markt)

Other

+ Increment version due a local build configuration error with 9.0.0.M14 + that wasn't caught until after digital signing had been completed + Signing requires unique names so a new tag was required. (markt) +

not released Tomcat 9.0.0.M14 (markt)

Catalina

+ 60202: Add an available flag to realms, to indicate the + state, or the realm backend. Update lockout realm to only register + auth failures if the realm is available. (remm) +
+ 60340: Readability improvements for CSS used in + DefaultServlet and ErrorReportValve. Patch provided by Michael + Osipov. (violetagg) +
+ 60351: Delay creating META-INF/war-tracker file + until after the WAR has been expanded to address the case where the + Tomcat process terminates during the expansion. (markt) +
+ Correctly generate URLs for resources located inside JARs that are + themselves located inside a packed WAR file. (markt) +
+ Correctly handle the configClass attribute of a Host when + embedding Tomcat. (markt) +
+ 60368: Stop creating a default connector on start in + embedded mode. (remm) +
+ 60379: Dispose of the GSS credential once it is no longer + required. Patch provided by Michael Osipov. (markt) +
+ 60380: Ensure that a call to + HttpServletRequest#logout() triggers a call to + TomcatPrincipal#logout(). Based on a patch by Michael + Osipov. (markt) +
+ 60381: Provide a standard toString() + implementation for components that implement Contained. + (markt) +
+ 60387: Correct the javadoc for + o.a.catalina.AccessLog.setRequestAttributesEnabled. + The default value is different for the different implementations. + (violetagg) +
+ 60393: Use consistent parameter naming in implementations of + Realm#authenticate(GSSContext, boolean). (markt) +
+ Refactor the org.apache.naming package to reduce duplicate + code. Duplicate code identified by the Simian tool. (markt) +
+ Refactor the implementations of + HttpServletRequest#getRequestURL() to reduce duplicate + code. Duplicate code identified by the Simian tool. (markt) +
+ Refactor Catalina interfaces to make wider use of the + Contained interface and reduce duplication. (markt) +
+ Remove the getName() method from RealmBase + along with the various constants used by the sub-classes to store the + return value. (markt) +
+ 60395: Log when an Authenticator passes an + incomplete GSSContext to a Realm since it indicates a bug + in the Authenticator. Patch provided by Michael Osipov. + (markt) +
+ 60400: When expanding the buffer used for reading the + request body, ensure the read position will be restored to the + original one. (violetagg) +
+ Refactor the MBean implementations for the internal Tomcat components + to reduce code duplication. (markt) +
+ 60410: Ensure that multiple calls to + JarInputStreamWrapper#close() do not incorrectly trigger + the closure of the underlying JAR or WAR file. (markt) +
+ 60411: Implement support in the RewriteValve for + symbolic names to specify the redirect code to use when returning a + redirect response to the user agent. Patch provided by Michael Osipov. + (markt) +
+ 60413: In the RewriteValve write empty capture + groups as the empty string rather than as "null" + when generating the re-written URL. Based on a patch by Michael Osipov. + (markt) +

Coyote

+ 60372: Ensure the response headers' buffer limit is reset to + the capacity of this buffer when IOException occurs while writing the + headers to the socket. (violetagg) +
+ Ensure that the availability of configured upgrade protocols that + require ALPN is correctly reported during Tomcat start. (markt) +
+ 60386: Implement a more sophisticated pruning algorithm for + removing closed streams from the priority tree to ensure that the tree + does not grow too large. (markt) +
+ 60409: When unable to complete sendfile request, ensure the + Processor will be added to the cache only once. (markt/violetagg) +
+ Ensure that the endpoint is able to unlock the acceptor thread during + shutdown if the endpoint is configured to listen to any local address + of a specific type such as 0.0.0.0 or ::. + (markt) +
+ Add a new configuration option, ipv6v6only to the APR + connectors that allows them to be configure to only accept IPv6 + connections when configured with an IPv6 address rather than the + default which is to accept IPv4 connections as well if the operating + system uses a dual network stack. (markt) +
+ Improve the logic that unlocks the acceptor thread so a better choice is + made for the address to connect to when a connector is configured for + any local port. This reduces the likelihood of the unlock failing. + (markt) +
+ 60436: Avoid a potential NPE when processing async timeouts. + (markt) +
+ Reduce the window in which an async request that has just started + processing on a container thread remains eligible for an async timeout. + (markt) +

Jasper

+ 60431: Improve handling of varargs in UEL expressions. Based + on a patch by Ben Wolfe. (markt) +

Web applications

+ Correct a typo in Host Configuration Reference. + Issue reported via comments.apache.org. (violetagg) +
+ 60412: Add information on the comment syntax for the + RewriteValve configuration. (markt) +

Tribes

+ Reduce the warning logs for a message received from a different domain + in order to avoid excessive log outputs. (kfujino) +

WebSocket

+ 60437: Avoid possible handshake overflows in the websocket + client. (remm) +

jdbc-pool

+ 58816: Implement the statistics of jdbc-pool. The stats infos + are borrowedCount, returnedCount, + createdCount, releasedCount, + reconnectedCount, releasedIdleCount and + removeAbandonedCount. (kfujino) +
+ 60194: If validationQuery is not specified, + connection validation is done by calling the isValid() + method. (kfujino) +
+ 60398: Fix testcase of TestSlowQueryReport. + (kfujino) +

Other

+ Allow customization of service.bat, such as heap memory size, service + startup mode and JVM args. Patch provided by isapir via Github. + (violetagg) +
+ 60366: Change catalina.bat to use directly + LOGGING_MANAGER and LOGGING_CONFIG variables + in order to configure logging, instead of modifying + JAVA_OPTS. Patch provided by Petter Isberg. (violetagg) +
+ 60383: JASPIC API is added as a dependency to the + org.apache.tomcat:tomcat-catalina maven artifact. + (violetagg) +
+ Update the comments associated with the TLS Connector examples in + server.xml. (markt) +
+ New property is added test.verbose in order to control + whether the output of the tests is displayed on the console or not. + Patch provided by Emmanuel Bourg. (violetagg) +
+ TestOpenSSLCipherConfigurationParser.testSpecification + - if there are test failures, provide more detailed information. Patch + provided by Emmanuel Bourg. (violetagg) +

2016-11-08 Tomcat 9.0.0.M13 (markt)

Coyote

+ Check that threadPriority values used in AbstractProtocol are valid. + (fschumacher) +

not released Tomcat 9.0.0.M12 (markt)

Catalina

+ When creating a new Connector via JMX, ensure that both HTTP/1.1 and + AJP/1.3 connectors can be created. (markt) +
+ Reduce multiple error messages when Connector fails to instantiate the + associated ProtocolHandler. (markt) +
+ 60152: Provide an option for Connector Lifecycle exceptions + to be re-thrown rather than logged. This is controlled by the new + throwOnFailure attribute of the Connector. (markt) +
+ Include the Context name in the log message when an item cannot be + added to the cache. (markt) +
+ Exclude JAR files in /WEB-INF/lib from the static resource + cache. (markt) +
+ When calling getResourceAsStream() on a directory, ensure + that null is returned. (markt) +
+ 60161: Allow creating subcategories of the container logger, + and use it for the rewrite valve. (remm) +
+ Correctly test for control characters when reading the provided shutdown + password. (markt) +
+ 60297: Simplify connector creation in embedded mode. (remm) +
+ Refactor creation of containers in embedded mode for more consistency + and flexibility. (remm) +
+ Log a warning if running on Java 9 with the ThreadLocal memory leak + detection enabled (the default) but without the command line option it + now requires. (markt) +
+ When a Connector is configured to use an executor, ensure that the + StoreConfig component includes the executor name when writing the + Connector configuration. (markt) +
+ When configuring the JMX remote listener, specify the allowed types for + the credentials. (markt) +

Coyote

+ Correct the HPACK header table size configuration that transposed the + client and server table sizes when creating the encoder and decoder. + (markt) +
+ Review HTTP/2 implementation removing unused code, reducing visibility + where possible and using final where appropriate. (markt) +
+ Don't continue to process an HTTP/2 stream if it is reset during header + parsing. (markt) +
+ HTTP/2 uses separate headers for each Cookie. As required by RFC 7540, + merge these into a single Cookie header before processing continues. + (markt) +
+ Align the HTTP/2 implementation with the HTTP/1.1 implementation and + return a 500 response when an unhandled exception occurs during request + processing. (markt) +
+ Correct the HTTP header parser so that DEL is not treated as a valid + token character. (markt) +
+ Add checks around the handling of HTTP/2 pseudo headers. (markt) +
+ Add support for trailer headers to the HTTP/2 implementation. (markt) +
+ 60232: When processing headers for an HTTP/2 stream, ensure + that the read buffer is large enough for the header being processed. + (markt) +
+ Add configuration options to the HTTP/2 implementation to control the + maximum number of headers allowed, the maximum size of headers allowed, + the maximum number of trailer headers allowed, the maximum size of + trailer headers allowed and the maximum number of cookies allowed. + (markt) +
+ Correctly differentiate between sending and receiving a reset frame when + tracking the state of an HTTP/2 stream. (markt) +
+ Remove the undocumented support for using the old Connector attribute + names backlog, soLinger and + soTimeout that were renamed several major versions ago. + (markt) +
+ 60319: When using an Executor, disconnect it from the + Connector attributes maxThreads, + minSpareThreads and threadPriority to enable + the configuration settings to be consistently reported. These Connector + attributes will be reported as -1 when an Executor is in + use. The values used by the executor may be set and obtained via the + Executor. (markt) +
+ If an I/O error occurs during async processing on a non-container + thread, ensure that the onError() event is triggered. + (markt) +
+ Improve detection of I/O errors during async processing on non-container + threads and trigger async error handling when they are detected. (markt) +
+ Add additional checks for valid characters to the HTTP request line + parsing so invalid request lines are rejected sooner. (markt) +

Jasper

+ Update to the Eclipse JDT Compiler 4.6.1. (markt) +

Web applications

+ Add HTTP/2 configuration information to the documentation web + application. (markt) +
+ Fix default value of validationInterval attribute in + jdbc-pool. (kfujino) +
+ Correct a typo in CGI How-To. + Issue reported via comments.apache.org. (violetagg) +

Tribes

+ When the proxy node sends a backup retrieve message, ensure that using + the channelSendOptions that has been set rather than the + default channelSendOptions. (kfujino) +

Other

+ Add the JASPIC API jar to the Maven Central publication script. (markt) +
+ Remove classes from tomcat-util-scan.jar that are duplicates of those in + tomcat-util.jar. (markt) +
+ Update the NSIS Installer used to build the Windows installer to version + 3.0. (markt) +

2016-10-10 Tomcat 9.0.0.M11 (markt)

Catalina

+ 59961: Add an option to the StandardJarScanner + to control whether or not JAR Manifests are scanned for additional + class path entries. (markt) +
+ 60013: Refactor the previous fix to align the behaviour of + the Rewrite Valve with mod_rewrite. As part of this, provide an + implementation for the B and NE flags and + improve the handling for the QSA flag. Includes multiple + test cases by Santhana Preethiand a patch by Tiago Oliveira. (markt) +
+ 60087: Refactor the web resources handling to use the Tomcat + specific war:file:... URL protocol to refer to WAR files + and their contents rather than the standard jar:file:... + form since some components of the JRE, such as JAR verification, give + unexpected results when the standard form is used. A side-effect of the + refactoring is that when using packed WARs, it is now possible to + reference a WAR and/or specific JARs within a WAR in the security policy + file used when running under a SecurityManager. (markt) +
+ 60116: Fix a problem with the rewrite valve that caused back + references evaluated in conditions to be forced to lower case when using + the NC flag. (markt) +
+ Ensure Digester.useContextClassLoader is considered in + case the class loader is used. (violetagg) +
+ 60117: Ensure that the name of LogLevel is + localized when using OneLineFormatter. Patch provided by + Tatsuya Bessho. (kfujino) +
+ 60138: Fix the SSLHostConfig so that the + protocols attribute is limited to the protocols supported + by the current JSSE implementation rather than the default protocols + used by the implementation. (markt) +
+ 60146: Improve performance for resource retrieval by making + calls to WebResource.getInputStream() trigger caching if the resource is + small enough. Patch provided by mohitchugh. (markt) +
+ 60151: Improve the exception error messages when a + ResourceLink fails to specify the type, specifies an + unknown type or specifies the wrong type. (markt) +
+ 60167: Ignore empty lines in /etc/passwd files + when using the PasswdUserDatabase. (markt) +
+ 60170: Exclude the compressed test file + index.html.br from RAT analysis. Patch provided by Gavin + McDonald. (markt) +
+ When starting web resources, ensure that class resources are only + started once. (markt) +
+ Improve the access checks for linked global resources to handle the case + where the current class loader is a child of the web application class + loader. (markt) +
+ 60196: Ensure that the isMandatory flag is + correctly set when using JASPIC authentication. (markt) +
+ 60199: Log a warning if deserialization issues prevent a + session attribute from being loaded. (markt) +
+ 60208: When using RFC6265 compliant cookies, the + / character should not be allowed in a cookie name since + the RFC6265 will drop such cookies as invalid. (markt) +
+ Introduce new methods read(ByteBuffer)/ + write(ByteBuffer) in + o.a.catalina.connector.CoyoteInputStream/ + o.a.catalina.connector.CoyoteOutputStream. (violetagg) +

Coyote

+ Refactor the code that implements the requirement that a call to + complete() or dispatch() made from a + non-container thread before the container initiated thread that called + startAsync() completes must be delayed until the container + initiated thread has completed. Rather than implementing this by + blocking the non-container thread, extend the internal state machine to + track this. This removes the possibility that blocking the non-container + thread could trigger a deadlock. (markt) +
+ Fail earlier if the client closes the connection during SNI processing. + (markt) +
+ 60123: Avoid potential threading issues that could cause + excessively large values to be returned for the processing time of + a current request. (markt) +
+ 60174: Log instances of HeadersTooLargeException + during request processing. (markt) +
+ 60173: Allow up to 64kB HTTP/2 header table size limit. (remm) +
+ Java 9 compatibility of direct ByteBuffer cleaner. (remm) +

Jasper

+ 60101: Remove preloading of the class that was deleted. + (violetagg) +

Web applications

+ Expand the documentation for the nested elements within a + Resources element to clarify the behaviour of different + configuration options with respect to the order in which resources are + searched. (markt) +
+ Add an example of using the classesToInitialize attribute + of the JreMemoryLeakPreventionListener to the documentation + web application. Based on a patch by Cris Berneburg. (markt) +
+ 60192: Correct a typo in the status output of the Manager + application. Patch provided by Radhakrishna Pemmasani. (markt) +

jdbc-pool

+ Notify jmx when returning the connection that has been marked suspect. + (kfujino) +
+ Ensure that the POOL_EMPTY notification has been added to + the jmx notification types. (kfujino) +
+ 60099: Ensure that use all method arguments as a cache key + when using StatementCache. (kfujino) +

Other

+ Update the download location for Objenesis. (violetagg) +
+ 60164: Replace log4j-core*.jar with + log4j-web*.jar since it is log4j-web*.jar that + contains the ServletContainerInitializer. (markt) +
+ Add documentation to the bin/catalina.bat script to remind users that + environment variables don't affect the configuration of Tomcat when + run as a Windows Service. Based upon a documentation patch by + James H.H. Lampert. (schultz) +
+ Update the packaged version of the Tomcat Native Library to 1.2.10 to + pick up the latest Windows binaries built with OpenSSL 1.0.2j. (markt) +

2016-09-05 Tomcat 9.0.0.M10 (markt)

Catalina

+ 59813: Ensure that circular relations of the Class-Path + attribute from JAR manifests will be processed correctly. (violetagg) +
+ Ensure that reading the singleThreadModel attribute of a + StandardWrapper via JMX does not trigger initialisation of + the associated servlet. With some frameworks this can trigger an + unexpected initialisation thread and if initialisation is not thread-safe + the initialisation can then fail. (markt) +
+ Compatibility with rewrite from httpd for non existing headers. + (jfclere) +
+ By default, treat paths used to obtain a request dispatcher as encoded. + This behaviour can be changed per web application via the + dispatchersUseEncodedPaths attribute of the Context. + (markt) +
+ Provide a mechanism that enables the container to check if a component + (typically a web application) has been granted a given permission when + running under a SecurityManager without the current execution stack + having to have passed through the component. Use this new mechanism to + extend SecurityManager protection to the system property replacement + feature of the digester. (markt) +
+ When retrieving an object via a ResourceLink, ensure that + the object obtained is of the expected type. (markt) +
+ 59823: Ensure that JASPIC configuration is taken into account + when calling HttpServletRequest.authenticate(). (markt) +
+ 59824: Mark the RewriteValve as supporting async + processing by default. (markt) +
+ 59839: Apply roleSearchAsUser to all nested + searches in JNDIRealm. (fschumacher) +
+ 59859: Fix resource leak in WebDAV servlet. Based on patch by + Coty Sutherland. (fschumacher) +
+ 59862: Allow nested jar files scanning to be filtered with + the system property + tomcat.util.scan.StandardJarScanFilter.jarsToSkip. Patch + is provided by Terence Bandoian. (violetagg) +
+ 59866: When scanning WEB-INF/classes for + annotations, don't scan the contents of + WEB-INF/classes/META-INF (if present) since classes will + never be loaded from that location. (markt) +
+ 59888: Correctly handle tabs and spaces in quoted version one + cookies when using the Rfc6265CookieProcessor. (markt) +
+ A number of the JRE memory leaks addressed by the + JreMemoryLeakPreventionListener have been fixed in Java 9 + so the associated protection is now disabled when running on Java 9 + onwards. (markt) +
+ 59912: Fix an edge case in input stream handling where an + IOException could be thrown when reading a POST body. + (markt) +
+ 59913: Correct a regression introduced with the support for + the Servlet 4 HttpServletRequest.getMapping() API that + caused the attributes for forwarded requests to be lost if requested + from within a subsequent include. (markt) +
+ 59966: Do not start the web application if the error page + configuration in web.xml is invalid. (markt) +
+ Switch the CGI servlet to the standard logging mechanism and remove + support for the debug attribute. (markt) +
+ 60012: Improvements in the log messages. Based on + suggestions by Nemo Chen. (violetagg) +
+ Changes to the allowLinking attribute of a + StandardRoot instance now invalidate the cache if caching + is enabled. (markt) +
+ Add a new initialisation parameter, envHttpHeaders, to + the CGI Servlet to mitigate httpoxy + (CVE-2016-5388) by default and to provide a mechanism that can be + used to mitigate any future, similar issues. (markt) +
+ When adding and removing ResourceLinks dynamically, ensure + that the global resource is only visible via the + ResourceLinkFactory when it is meant to be. (markt) +
+ 60008: When processing CORs requests, treat any origin with a + URI scheme of file as a valid origin. (markt) +
+ Improve handling of exceptions during a Lifecycle events triggered by a + state transition. The exception is now caught and the component is now + placed into the FAILED state. (markt) +
+ 60013: Fix encoding issues when using the RewriteValve with + UTF-8 query strings or UTF-8 redirect URLs. (markt) +
+ 60022: Improve handling when a WAR file and/or the associated + exploded directory are symlinked into the appBase. (markt) +
+ Fix a file descriptor leak when reading the global web.xml. (markt) +
+ Consistently decode URL patterns provided via web.xml using the encoding + of the web.xml file where specified or UTF-8 where no explicit encoding + is specified. (markt) +
+ Make timing attacks against the Realm implementations harder. (schultz) +

Coyote

+ Correct a regression in refactoring to enable injection of custom + keystores that broke the automatic conversion of OpenSSL style PEM + key and certificate files for use with JSSE TLS connectors. (markt) +
+ 59910: Don't hardcode key alias value to "tomcat" for JSSE. + When using a keystore, OpenSSL will still default to it. (remm) +
+ 59904: Add a limit (default 200) for the number of cookies + allowed per request. Based on a patch by gehui. (markt) +
+ 59925: Correct regression in r1628368 and ensure that HTTP + separators are handled as configured in the + LegacyCookieProcessor. Patch provided by Kyohei Nakamura. + (markt) +
+ 59950: Correct log message when reporting that the current + number of HTTP/2 streams for a connection could not be pruned to below + the limit. (markt) +
+ Ensure that Semaphore.release is called in all cases. Even + when there is an exception. (violetagg) +
+ 60030: Correct a potential infinite loop in the SNI parsing + code triggered by failing to handle an end of stream condition. (markt) +
+ Refactor the JSSE client certificate validation so that the + effectiveness of the certificateVerificationDepth + configuration attribute does not depend on the presence of a certificate + revocation list. (markt) +
+ Small logging optimization in the Rfc6265CookieProcessor. + Patch provided by Svetlin Zarev. (markt) +
+ OpenSSL now disables 3DES by default so reflect this when using OpenSSL + syntax to select ciphers. (markt) +
+ Use the proper ERROR socket status code for async errors with NIO2. + (remm) +
+ 60035: Fix a potential connection leak if the client drops a + TLS connection before the handshake completes. (markt) +
+ Log a warning at start up if a JSSE TLS connector is configured with + a trusted certificate that is either not yet valid or has expired. + (markt) +

Jasper

+ When writing out a full web.xml file with JspC ensure that the encoding + used in the XML prolog matches the encoding used to write the contents + of the file. (markt) +
+ Improve the error handling for custom tags to ensure that the tag is + returned to the pool or released and destroyed once used. (markt) +
+ 60032: Fix handling of method calls that use varargs within + EL value expressions. (markt) +
+ Ignore engineOptionsClass and scratchdir when + running under a security manager. (markt) +
+ Fixed StringIndexOutOfBoundsException. Based on a patch provided by + wuwen via Github. (violetagg) +

WebSocket

+ 59908: Ensure that a reason phrase is included in the close + message if a session is closed due to a timeout. (markt) +

Web applications

+ 59867: Correct the documentation provided by Manager's + 403.jsp. (violetagg) +
+ 59868: Clarify the documentation for the Manager web + application to make clearer that the host name and IP address in the + server section are the primary host name and IP address. (markt) +
+ 59940: Correct the name of the + truststorePassword attribute of the + SSLHostConfig element in the configuration documentation. + (markt) +
+ MBeans Descriptors How-To is moved to + mbeans-descriptors-howto.html. Patch provided by Radoslav + Husar. (violetagg) +
+ Update NIO Connector configuration documentation with an information + about socket.directSslBuffer. (violetagg) +
+ 60034: Correct a typo in the Manager How-To page of the + documentation web application. (markt) +
+ Correct the name of the CRL location configuration attributes in the + documentation web application. (markt) +

jdbc-pool

+ In order to avoid the unintended skip of PoolCleaner, + remove the check code of the execution interval in the task that has + been scheduled. (kfujino) +
+ 59850: Ensure that the ResultSet is closed when + enabling the StatementCache interceptor. (kfujino) +
+ 59923: Reduce the default value of + validationInterval in order to avoid the potential issue + that continues to return an invalid connection after database restart. + (kfujino) +
+ Ensure that the ResultSet is returned as Proxy object when + enabling the StatementDecoratorInterceptor. (kfujino) +
+ 60043: Ensure that the suspectTimeout works + without removing connection when the removeAbandoned is + disabled. (kfujino) +
+ Add log message of when returning the connection that has been marked + suspect. (kfujino) +
+ Correct Javadoc for ConnectionPool.suspect(). Based on a + patch by Yahya Cahyadi. (markt) +

Other

+ 59871: Add a property (timeFormat) to + JULI's OneLineFormatter to enable the format of the + time stamp used in log messages to be configured. (markt) +
+ 59899: Update Tomcat's copy of the Java Persistence + annotations to include the changes made in 2.1 / JavaEE 7. (markt) +
+ Fixed typos in mbeans-descriptors.xml files. (violetagg) +
+ Update the internal fork of Commons BCEL to r1757132 to align with the + BCEL 6 release. (markt) +
+ Update the internal fork of Commons DBCP 2 to r1757164 to pick up a + couple of bug fixes. (markt) +
+ Update the internal fork of Commons Codec to r1757174. Code formatting + changes only. (markt) +
+ Update the internal fork of Commons FileUpload to afdedc9. This pulls in + a fix to improve the performance with large multipart boundaries. + (markt) +

2016-07-12 Tomcat 9.0.0.M9 (markt)

Catalina

+ 18500: Add limited support for wildcard host names and host + aliases. Names of the form *.domainname are now permitted. + Note that an exact host name match takes precedence over a wild card + host name match. (markt) +
+ 57705: Add debug logging for requests denied by the remote + host and remote address valves and filters. Based on a patch by Graham + Leggett. (markt) +
+ Correct a regression in the fix for 58588 that removed the + entire org.apache.juli package from the embedded JARs + rendering them unusable. (markt) +
+ 59399: Add a new option to the Realm implementations that + ship with Tomcat that allows the HTTP status code used for HTTP -> HTTPS + redirects to be controlled per Realm. (markt) +
+ 59708: Modify the LockOutRealm logic. Valid authentication + attempts during the lock out period will no longer reset the lock out + timer to zero. (markt) +
+ Change the default of the + sessionCookiePathUsesTrailingSlash attribute of the + Context element to false since the problems + caused when a Servlet is mapped to /* are more significant + than the security risk of not enabling this option by default. (markt) +
+ Follow-up to 59655. Improve the documentation for configuring + permitted cookie names. Patch provided by Kyohei Nakamura. (markt) +
+ Do not attempt to start web resources during a web application's + initialisation phase since the web application is not fully configured + at that point and the web resources may not be correctly configured. + (markt) +
+ Improve error handling around user code prior to calling + InstanceManager.destroy() to ensure that the method is + executed. (markt) +

Coyote

+ Fix a cause of multiple attempts to close the same socket. (markt) +
+ Refactor the certificate keystore and trust store generation to make it + easier for embedded users to inject their own key stores. (markt) +
+ Add a maxConcurrentStreamExecution on the HTTP/2 + protocol handler to allow restricting the amount of concurrent stream + that are being executed in a single connection. The default is to + not limit it. (remm) +
+ 59233: Add the ability to add TLS virtual hosts dynamically. + (markt) +
+ Correct a problem with ServletRequest.getServerPort() for + secure HTTP/2 connections that meant an incorrect value was returned when + using the default port. (markt) +
+ Improve error handling around user code prior to calling + InstanceManager.destroy() to ensure that the method is + executed. (markt) +
+ Document the default for the HTTP/2 configuration parameter + maxConcurrentStreamExecution as 20. (markt) +

Jasper

+ Improve error handling around user code prior to calling + InstanceManager.destroy() to ensure that the method is + executed. (markt) +

WebSocket

+ Now the WebSocket implementation is not built directly on top of the + Servlet API and can use Tomcat internals, there is no need for the + dedicated WebSocket Executor. It has been replaced by the use of the + Connector/Endpoint provided Executor. (markt) +
+ Improve error handling around user code prior to calling + InstanceManager.destroy() to ensure that the method is + executed. (markt) +

Web Applications

+ Do not log an additional case of IOExceptions in the + error handler for the Drawboard WebSocket example when the root cause is + the client disconnecting since the logs add no value. (markt) +
+ 59642: Mention the localDataSource in the + DataSourceRealm section of the Realm How-To. (markt) +
+ 59672: Update the security considerations page of the + documentation web application to take account of the fact that the + Manager and HostManager applications now have a + RemoteAddrValve configured by default. (markt) +
+ Follow-up to the fix for 59399. Ensure that the new attribute + transportGuaranteeRedirectStatus is documented for all + Realms. Also document the NullRealm and + when it is automatically created for an Engine. (markt) +
+ Fix the description of maxAge attribute in jdbc-pool doc. + This attribute works both when a connection is returned and when a + connection is borrowed. (kfujino) +
+ 59774: Correct the prefix values in the + documented examples for configuring the AccessLogValve. + Patch provided by Mike Noordermeer. (markt) +

Tribes

+ Add log message when the ping has timed-out. (kfujino) +
+ If the ping message has been received at the + AbstractReplicatedMap#leftOver method, ensure that notify + the member is alive than ignore it. (kfujino) +

jdbc-pool

+ Fix the duplicated connection release when connection verification + failed. (kfujino) +
+ Ensure that do not remove the abandoned connection that has been already + released. (kfujino) +

Other

+ Remove JULI plus log4j extras and embedded artifacts from Maven release + script. (markt) +
+ Use the mirror network rather than the ASF master site to download the + current ASF dependencies. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.8 to + pick up the latest fixes and make 1.2.8 the minimum recommended version. + (markt) +

2016-06-13 Tomcat 9.0.0.M8 (markt)

Coyote

+ Remove accidentally committed debug code. (markt) +

not released Tomcat 9.0.0.M7 (markt)

Catalina

+ RMI Target related memory leaks are avoidable which makes them an + application bug that needs to be fixed rather than a JRE bug to work + around. Therefore, start logging RMI Target related memory leaks on web + application stop. Add an option that controls if the check for these + leaks is made. Log a warning if running on Java 9 with this check + enabled but without the command line option it requires. (markt) +
+ Ensure NPE will not be thrown during deployment when scanning jar files + without MANIFEST.MF file. (violetagg) +
+ Remove the clearReferencesStatic option from + StandardContext. It was known to cause problems with some + libraries (such as log4j) and was only linked to suspected memory leaks + rather than known memory leaks. It had been disabled by default with no + increase in the reports of memory leaks for some time. (markt) +
+ 59604: Correct the assumption made in the URL decoding that + the default platform encoding is always compatible with ISO-8859-1. This + assumption is not always valid, e.g. on z/OS. (markt) +
+ 59608: Skip over any invalid Class-Path attribute + from JAR manifests. Log errors at debug level due to many bad libraries. + (remm) +
+ Fix error message when failed to register MBean. (kfujino) +
+ 59655: Configure the cookie name validation to use RFC6265 + rules by default to align it with the default cookie parser. Document + the impact system properties have on cookie name validation. (mark) +

Coyote

+ Ensure that requests with HTTP method names that are not tokens (as + required by RFC 7231) are rejected with a 400 response. (markt) +
+ When an asynchronous request is processed by the AJP connector, ensure + that request processing has fully completed before starting the next + request. (markt) +
+ Improve handling of HTTP/2 stream resets. (markt) +
+ 58750: The HTTP Server header is no longer set by default. A + Server header may be configured by setting the server + attribute on the Connector. A new Connector + attribute, serverRemoveAppProvidedValues may be used to + remove any Server header set by a web application. (markt) +
+ 59564: Correct offset when reading into HTTP/2 input buffer + that could cause problems reading request bodies. (violetagg/markt) +
+ Modify the handling of read/write timeouts so that the appropriate error + handling (ReadListener.onError(), + WriteListener.onError() or + AsyncListener.onError()) is called. (markt) +
+ If an async dispatch results in the completion of request processing, + ensure that any remaining request body is swallowed before starting the + processing of the next request else the remaining body may be read as the + start of the next request leading to a 400 response. (markt) +

Jasper

+ 59567: Fix NPE scanning webapps for TLDs when an exploded + JAR has an empty WEB-INF/classes/META-INF folder. (remm) +
+ Fix a memory leak in the expression language implementation that caused + the class loader of the first web application to use expressions to be + pinned in memory. (markt) +
+ 59654: Improve error message when attempting to use a TLD + file from an invalid location. Patch provided by Huxing Zhang. (markt) +

WebSocket

+ 59659: Fix possible memory leak in WebSocket handling of + unexpected client disconnects. (markt) +

Web applications

+ 58891: Update the SSL How-To. Based on a suggestion by + Alexander Kjäll. (markt) +

Extras

+ 58588: Remove the JULI extras package from the distribution. + It was only useful for switching Tomcat's internal logging to log4j + 1.2.x and that version of log4j is no longer supported. No additional + Tomcat code is required if switching Tomcat's internal logging to log + via log4j 2.x. (markt) +

jdbc-pool

+ Fix a memory leak with the pool cleaner thread that retained a reference + to the web application class loader for the first web application to use + a connection pool. (markt) +

Other

+ Update the internal fork of Commons DBCP 2 to r1743696 (2.1.1 plus + additional fixes). (markt) +
+ Update the internal fork of Commons Pool 2 to r1743697 (2.4.2 plus + additional fixes). (markt) +
+ Update the internal fork of Commons File Upload to r1743698 (1.3.1 plus + additional fixes). (markt) +
+ Use UTF-8 with a standard prolog for all XML files. (markt) +
+ 58626: Add support for a new environment variable + (USE_NOHUP) that causes nohup to be used when + starting Tomcat. It is disabled by default except on HP-UX where it is + enabled by default since it is required when starting Tomcat at boot on + HP-UX. (markt) +

2016-05-16 Tomcat 9.0.0.M6 (markt)

Catalina

+ Ensure that annotated web components packed in web fragments will be + processed when unpackWARs is enabled. (violetagg) +

not released Tomcat 9.0.0.M5 (markt)

Catalina

+ 48922: Apply a very small performance improvement to the + date formatting in Tomcat's internal request object. Based on a patch + provided by Ondrej Medek. (markt) +
+ 59206: Ensure NPE will not be thrown by + o.a.tomcat.util.file.ConfigFileLoader when + catalina.base is not specified. (violetagg) +
+ 59217: Remove duplication in the recycling of the path in + o.a.tomcat.util.http.ServerCookie. Patch is provided by + Kyohei Nakamura. (violetagg) +
+ Fixed possible NPE in + o.a.catalina.loader.WebappClassLoaderBase.getResourceAsStream + (violetagg) +
+ 59213: Async dispatches should be based off a wrapped + request. (remm) +
+ Ensure that javax.servlet.ServletRequest and + javax.servlet.ServletResponse provided during + javax.servlet.AsyncListener registration are made + available via javax.servlet.AsyncEvent.getSuppliedRequest + and javax.servlet.AsyncEvent.getSuppliedResponse + (violetagg) +
+ 59219: Ensure AsyncListener.onError() is called + if an Exception is thrown during async processing. (markt) +
+ 59220: Ensure that AsyncListener.onComplete() is + called if the async request times out and the response is already + committed. (markt) +
+ 59226: Process the Class-Path attribute from + JAR manifests for JARs on the class path excluding JARs packaged in + WEB-INF/lib. (markt) +
+ 59255: Fix possible NPE in mapper. (kkolinko/remm) +
+ 59256: slf4j-taglib*.jar should not be excluded + from the standard JAR scanning by default. (violetagg) +
+ Clarify the log message that specifying both urlPatterns and value + attributes in @WebServlet and @WebFilter annotations is not allowed. + (violetagg) +
+ Ensure the exceptions caused by Valves will be available in the log + files so that they can be evaluated when + o.a.catalina.valves.ErrorReportValve.showReport is + disabled. Patch is provided by Svetlin Zarev. (violetagg) +
+ Remove unused distributable attribute that is defined as + TransientAttribute of Manager in StoreConfig. + (kfujino) +
+ Fix handling of Cluster Receiver in StoreConfig. The bind + and host attributes define as + TransientAttribute. (kfujino) +
+ 59261: ServletRequest.getAsyncContext() now + throws an IllegalStateException as required by the Servlet + specification if the request is not in asynchronous mode when called. + (markt) +
+ 59269: Correct the implementation of + PersistentManagerBase so that minIdleSwap + functions as designed and sessions are swapped out to keep the active + session count below maxActiveSessions. (markt) +
+ Update the implementation of the proposed Servlet 4.0 API to provide + mapping type information for the current request to reflect discussions + within the EG. (markt) +
+ Correctly configure the base path for a resources directory provided by + an expanded JAR file. Patch provided by hengyunabc. (markt) +
+ When multiple compressed formats are available and the client does not + express a preference, use the server order to determine the preferred + format. Based on a patch by gmokki. (markt) +
+ 59284: Allow the Tomcat provided JASPIC + SimpleServerAuthConfig to pick up module configuration + properties from either the property set passed to its constructor or + from the properties passed in the call to getAuthContext. + Based on a patch by Thomas Maslen. (markt) +
+ 59310: Do not add a Content-Length: 0 header for + custom responses to HEAD requests that do not set a + Content-Length value. (markt) +
+ When normalizing paths, improve the handling when paths end with + /. or /.. and ensure that input and output are + consistent with respect to whether or not they end with /. + (markt) +
+ 59317: Ensure that + HttpServletRequest.getRequestURI() returns an encoded URI + rather than a decoded URI after a dispatch. (markt) +
+ Use the correct URL for the fragment when reporting errors processing + a web-fragment.xml file from a JAR located in an unpacked + WAR. (markt) +
+ Ensure that JarScanner only uses the explicit call-back to + process WEB-INF/classes and only when configured to treat + the contents of WEB-INF/classes as a possible exploded JAR. + (markt) +
+ Remove the java2DDisposerProtection option from the + JreMemoryLeakPreventionListener. The leak is fixed in Java + 7 onwards and Tomcat 9 requires Java 8 so the option is unnecessary. + (markt) +
+ Remove the securityPolicyProtection option from the + JreMemoryLeakPreventionListener. The leak is fixed in Java + 8 onwards and Tomcat 9 requires Java 8 so the option is unnecessary. + (markt) +
+ Remove the securityLoginConfigurationProtection option from + the JreMemoryLeakPreventionListener. The leak is fixed in + Java 8 onwards and Tomcat 9 requires Java 8 so the option is + unnecessary. (markt) +
+ Ensure that the value for the header X-Frame-Options is + constructed correctly according to the specification when + ALLOW-FROM option is used. (violetagg) +
+ Fix an IllegalArgumentException if the first use of an + internal Response object requires JASPIC authentication. + (markt) +
+ Do not trigger unnecessary session ID changes when using JASPIC and the + user is authenticated using cached credentials. (markt) +
+ 59437: Ensure that the JASPIC CallbackHandler is + thread-safe. (markt) +
+ 59449: In ContainerBase, ensure that the process + to remove a child container is the reverse of the process to add one. + Patch provided by Huxing Zhang. (markt) +

Coyote

+ Improves OpenSSL engine robustness when SSL allocation fails for + some reason. (remm) +
+ OpenSSL engine code cleanups. (remm) +
+ Align cipher configuration parsing with current OpenSSL master. (markt) +
+ Change the default for honorCipherOrder to + false. With the current default TLS configuration, it is no + longer necessary for this to be true for a reasonably + secure configuration. (markt) +
+ Add a new environment variable JSSE_OPTS that is intended + to be used to pass JVM wide configuration to the JSSE implementation. + The default value is -Djdk.tls.ephemeralDHKeySize=2048 + which protects against weak Diffie-Hellman keys. (markt) +
+ 58970: Fix a connection counting bug in the NIO connector + that meant some dropped connections were not removed from the current + connection count. (markt) +
+ 59289: Do not recycle upgrade processors in unexpected close + situations. (remm) +
+ 59295: Use Locale.toLanguageTag() to construct + the Content-Language HTTP header to ensure the locale is + correctly represented. Patch provided by zikfat. (markt) +
+ 59344: Add support for using pem encoded certificates with + JSSE SSL. Submitted by Emmanuel Bourg with additional tweaks. (remm) +
+ Make the TLS certificate chain available to clients when using + JSSE+OpenSSL with the certificate chain stored in a Java KeyStore. + (markt) +
+ Work around a + known issue in OpenSSL that does not permit the TLS handshake to be + failed if the ALPN negotiation fails. (markt) +
+ 59421: Add direct HTTP/2 connection support. (remm) +
+ Correctly handle a call to AsyncContext.complete() from a + non-container thread when non-blocking I/O is being used. (markt) +
+ 59451: Correct Javadoc for MessageBytes. Patch + provided by Kyohei Nakamura. (markt) +
+ 59450: Correctly handle the case where the + LegacyCookieProcessor is configured with + allowHttpSepsInV0 set to false and + forwardSlashIsSeparator set to true. Patch + provided by Kyohei Nakamura. (markt) +

Jasper

+ When scanning JARs for TLDs, correctly handle the (rare) case where a + JAR has been exploded into WEB-INF/classes and the web + application is deployed as a packed WAR. (markt) +
+ 59640: NPEs with not found TLDs. (remm) +

WebSocket

+ 59189: Explicitly release the native memory held by the + Inflater and Deflater when using + PerMessageDeflate and the WebSocket session ends. Based on a patch by + Henrik Olsson. (markt) +
+ Restore the WsServerContainer.doUpgrade() method which was + accidentally removed since it is not used by Tomcat. (markt) +
+ Fix a regression caused by the connector refactoring and ensure that the + thread context class loader is set to the web application + classloader when processing WebSocket messages on the server. (markt) +
+ Ensure that a client disconnection triggers the error handling for the + associated WebSocket end point. (markt) +
+ Make WebSocket client more robust when handling errors during the close + of a WebSocket session. (markt) +

Web applications

+ 59218: Correct the path to jaspic-providers.xml + in Jaspic How-To. Patch is provided by Tatsuya Bessho. (violetagg) +
+ Remove button that has accidentally been added to the host manager. + Submitted by Coty Sutherland. (remm) +
+ Update in the documentation the link to the maven repository where + Tomcat snapshot artifacts are deployed. (markt/violetagg) +
+ Clarify in the documentation that calls to + ServletContext.log(String, Throwable) or + GenericServlet.log(String, Throwable) are logged at the + SEVERE level. (violetagg) +
+ Correct a typo in SSL/TLS Configuration How-To. + Issue reported via comments.apache.org. (violetagg) +

Tribes

+ Avoid NPE when a proxy node failed to retrieve a backup entry. (kfujino) +
+ Add the flag indicating that member is a localMember. (kfujino) +
+ Fix potential NPE that depends on the setting order of attributes of + static member when using the static cluster. (kfujino) +
+ Add get/set method for the channel that is related to + ChannelInterceptor. (kfujino) +
+ As with the multicast cluster environment, in the static cluster + environment, the local member inherits properties from the cluster + receiver. (kfujino) +
+ Add get/set method for the channel that is related to each Channel + services. (kfujino) +
+ Add name to channel in order to identify channels. In tomcat cluster + environment, it is set the cluster name + "-Channel" as default value. + (kfujino) +
+ Add the channel name to the thread which is invoked by channel services + in order to identify the associated channel. (kfujino) +
+ Ensure that clear the channel instance from channel services when + stopping channel. (kfujino) +
+ Implement map state in the replication map. (kfujino) +
+ Ensure that the ping is not executed during the start/stop of the + replication map. (kfujino) +
+ In ping processing in the replication map, send not the + INIT message but the newly introduced PING + message. (kfujino) +

Other

+ 59211: Add hamcrest to Eclipse classpath. Patch is provided + by Huxing Zhang. (violetagg) +
+ 59276: Update optional Checkstyle library to 6.17. + (kkolinko) +
+ 59280: Update the NSIS Installer used to build the + Windows Installers to version 2.51. (kkolinko) +
+ Update the packaged version of the Tomcat Native Library to 1.2.7 to + pick up the Windows binaries that are based on OpenSSL 1.0.2h and APR + 1.5.2. (markt) +

2016-03-16 Tomcat 9.0.0.M4 (markt)

Catalina

+ Ensure that /WEB-INF/classes is never processed as a web + fragment. (markt) +
+ Switch default connector when native is installed. Unless configured + otherwise, the NIO endpoint will be used by default. If SSL is + configured, OpenSSL will be used rather than JSSE. (remm) +
+ Correct a regression in the fix for 58867. When configuring a + Context to use an external directory for the docBase, and + that directory happens to be located along side the original WAR, use + the directory as the docBase rather than expanding the + WAR into the appBase and using the newly created expanded + directory as the docBase. (markt) +
+ 58351: Make the server build date and server version number + accessible via JMX. Patch provided by Huxing Zhang. (markt) +
+ 58988: Special characters in the substitutions for the + RewriteValve can now be quoted with a backslash. (fschumacher) +
+ 58999: Fix class and resource name filtering in + WebappClassLoader. It throws a StringIndexOutOfBoundsException if the + name is exactly "org" or "javax". (rjung) +
+ Add JASPIC (JSR-196) support. (markt) +
+ Make checking for var and map replacement in RewriteValve a bit stricter + and correct detection of colon in var replacement. (fschumacher) +
+ Refactor the web application class loader to reduce the impact of JAR + scanning on the memory footprint of the web application. (markt) +
+ Fix some resource leaks in the error handling for accessing files from + JARs and WARs. (markt) +
+ Refactor the JAR and JAR-in-WAR resource handling to reduce the memory + footprint of the web application. (markt) +
+ Refactor the web.xml parsing so a new parser is created every time the + web application starts rather than creating and caching the parser when + the Context is created. This enables the parser to take account of + modified Context configuration parameters and reduces (slightly) the + memory footprint of a running Tomcat instance. (markt) +
+ Switch the web application class loader to the + ParallelWebappClassLoader by default. (markt) +
+ 57809: Remove the custom context attribute that held the + effective web.xml. Components needing access to configuration + information may access it via the Servlet API. (markt) +
+ Refactor JAR scanning to reduce memory footprint. (markt) +
+ 59001: Correctly handle the case when Tomcat is installed on + a path where one of the segments ends in an exclamation mark. (markt) +
+ Expand the fix for 59001 to cover the special sequences used + in Tomcat's custom jar:war: URLs. (markt) +
+ 59043: Avoid warning while expiring sessions associated with + a single sign on if HttpServletRequest.logout() is used. + (markt) +
+ 59054: Ensure that using the + CrawlerSessionManagerValve in a distributed environment + does not trigger an error when the Valve registers itself in the + session. (markt) +
+ Add socket properties support to storeconfig. (remm) +
+ Fix incorrect parsing of the NE and NC flags in rewrite rules. (remm) +
+ 59065: Correct the timing of the check for colons in paths + on non-Windows systems implemented in catalina.sh so it + works correctly with Cygwin. Patch provided by Ed Randall. (markt) +
+ When a Host is configured with an appBase that does not exist, create + the appBase before trying to expand an external WAR file into it. + (markt) +
+ 59115: When using the Servlet 3.0 file upload, the submitted + file name may be provided as a token or a quoted-string. If a + quoted-string, unquote the string before returning it to the user. + (markt) +
+ 59123: Close NamingEnumeration objects used by + the JNDIRealm once they are no longer required. + (fschumacher/markt) +
+ Implement the proposed Servlet 4.0 API to provide mapping type + information for the current request. (markt) +
+ 59138: Correct a false positive warning for ThreadLocal + related memory leaks when the key class but not the value class has been + loaded by the web application class loader. (markt) +
+ 59017: Make the pre-compressed file support in the Default + Servlet generic so any compression may be used rather than just gzip. + Patch provided by Mikko Tiihonen. (markt) +
+ 59145: Don't log an invalid warning when a user logs out of + a session associated with SSO. (markt) +
+ 59150: Add an additional flag on APR listener to allow + disabling automatic use of OpenSSL. (remm) +
+ 59151: Fix a regression in the fix for 56917 that + added additional (and arguably unnecessary) validation to the provided + redirect location. (markt) +
+ 59154: Fix a NullPointerException in the + JAASMemoryLoginModule resulting from the introduction of + the CredentialHandler to Realms. + (schultz/markt) +

Coyote

+ Handle the case in the NIO2 connector where the required TLS buffer + sizes increase after the connection has been initiated. (markt/remm) +
+ Bad processing of handshake errors in NIO2. (remm) +
+ Use JSSE session configuration options with OpenSSL. (remm) +
+ 59015: Fix potential cause of endless APR Poller loop during + shutdown if the Poller experiences an error during the shutdown process. + (markt) +
+ Align cipher aliases for kECDHE and ECDHE with + the current OpenSSL implementation. (markt) +
+ 59081: Retain the user defined cipher order when defining + ciphers. (markt) +
+ 59089: Correctly ignore HTTP headers that include non-token + characters in the header name. (markt) +

Jasper

+ Update to the Eclipse JDT Compiler 4.5.1. (markt) +
+ 57583: Improve the performance of + javax.servlet.jsp.el.ScopedAttributeELResolver when + resolving attributes that do not exist. This improvement only works when + Jasper is used with Tomcat's EL implementation. (markt) +

WebSocket

+ Fix a timing issue on session close that could result in an exception + being thrown for an incomplete message even through the message was + completed. (markt) +
+ Correctly handle compression of partial messages when the final message + fragment has a zero length payload. (markt) +
+ 59119: Correct read logic for WebSocket client when using + secure connections. (markt) +
+ 59134: Correct client connect logic for secure connections + made through a proxy. (markt) +

Web applications

+ Correct an error in the documentation of the expected behaviour for + automatic deployment. If a WAR is updated and an expanded directory is + present, the directory will always be deleted and recreated by expanding + the WAR if unpackWARs is true. (markt) +
+ 48674: Implement an option within the Host Manager web + application to persist the current configuration. Based on a patch by + Coty Sutherland. (markt) +
+ 58935: Remove incorrect references in the documentation to + using jar:file: URLs with the Manager application. (markt) +
+ Correct the description of the + ServletRequest.getServerPort() in Proxy How-To. + Issue reported via comments.apache.org. (violetagg) +
+ The Manager and Host Manager applications are now only accessible via + localhost by default. (markt) +

Tribes

+ If promoting a proxy node to a primary node when getting a session, + notify the change of the new primary node to the original backup node. + (kfujino) +

Other

+ 58283: Change the default download location for libraries + during the build process from /usr/share/java to + ${user.home}/temp. Patch provided by Ahmed Hosni. (markt) +
+ 59031: When using the Windows uninstaller, do not remove the + contents of any directories that have been symlinked into the Tomcat + directory structure. (markt) +
+ Update the packaged version of the Tomcat Native Library to 1.2.5 to + pick up the Windows binaries that are based on OpenSSL 1.0.2g and APR + 1.5.1. (markt) +
+ Modify the default tomcat-users.xml file to make it harder + for users to configure the entries intended for use with the examples + web application for the Manager application. (markt) +

2016-02-05 Tomcat 9.0.0.M3 (markt)

General

+ Allow to configure multiple JUnit test class patterns with the build + property test.name and document the property in + BUILDING.txt. (rjung) +

Catalina

+ Protect initialization of ResourceLinkFactory when + running with a SecurityManager. (kkolinko) +
+ Correct a thread safety issue in the filtering of session attributes + based on the implementing class name of the value object. (markt) +
+ Fix class loader decision on the delegation for class loading and + resource lookup and make it faster too. (rjung) +
+ 58768: Log a warning if a redirect fails because of an + invalid location. (markt) +
+ 58827: Remove remains of JSR-77 implementation. (markt) +
+ 58946: Ensure that the request parameter map remains + immutable when processing via a RequestDispatcher. (markt) +
+ 58905: Ensure that Tomcat.silence() silences the + correct logger and respects the current setting. (markt) +

Coyote

+ Correct a regression in the connector refactoring in 9.0.0.M2 that broke + TLS support for the APR/native connector. (remm) +
+ Correct an NPE when listing the enabled ciphers (e.g. via the Manager + web application) for a TLS enabled APR/native connector. (markt) +
+ New configuration option ajpFlush for the AJP connectors + to disable the sending of AJP flush packets. (rjung) +
+ Handle the case in the NIO connector where the required TLS buffer sizes + increase after the connection has been initiated. (markt) +

not released Tomcat 9.0.0.M2 (markt)

Catalina

+ Refactor creation of MapperListener to ensure that the + Mapper used is the Mapper associated with the + Service for which the listener was created. (markt) +
+ Move the functionality that provides redirects for context roots and + directories where a trailing / is added from the Mapper to + the DefaultServlet. This enables such requests to be + processed by any configured Valves and Filters before the redirect is + made. This behaviour is configurable via the + mapperContextRootRedirectEnabled and + mapperDirectoryRedirectEnabled attributes of the Context + which may be used to restore the previous behaviour. (markt) +
+ Refactor Service.getContainer() to return an + Engine rather than a Container. (markt) +
+ 34319: Only load those keys in StoreBase.processExpire + from JDBCStore, that are old enough, to be expired. Based on a patch + by Tom Anderson. (fschumacher) +
+ 56917: As per RFC7231 (HTTP/1.1), allow HTTP/1.1 and later + redirects to use relative URIs. This is controlled by a new attribute + useRelativeRedirects on the Context and + defaults to true. (markt) +
+ 58629: Allow an embedded Tomcat instance to start when the + Service has no Engine configured. (markt) +
+ Correctly notify the MapperListener associated with a Service if the + Engine for that Service is changed. (markt) +
+ Make a web application's CredentialHandler available through a context + attribute. This allows a web application to use the same algorithm + for validating or generating new stored credentials from cleartext + ones. (schultz) +
+ 58635: Enable break points to be set within agent code when + running Tomcat with a Java agent. Based on a patch by Huxing Zhang. + (markt) +
+ Fixed potential NPE in HostConfig while deploying an + application. Issue reported by coverity scan. (violetagg) +
+ 58655: Fix an IllegalStateException when + calling HttpServletResponse.sendRedirect() with the + RemoteIpFilter. This was caused by trying to correctly + generate the absolute URI for the redirect. With the fix for + 56917, redirects may now be relative making the + sendRedirect() implementation for the + RemoteIpFilter much simpler. This also addresses issues + where the redirect may not have behaved as expected when redirecting + from http to https to from https to http. (markt) +
+ 58657: Exceptions in a Servlet 3.1 ReadListener + or WriteListener do not need to be immediately fatal to the + connection. Allow an error response to be written. (markt) +
+ Correct implementation of + validateClientProvidedNewSessionId so client provided + session IDs may be rejected if validation is enabled. (markt) +
+ 58701: Reset the instanceInitialized field in + StandardWrapper when unloading a Servlet so that a new + instance may be correctly initialized. (markt) +
+ Add a new flag aprPreferred to the Apr listener. if set to + false, when using the connector defaults, it will use + NIO + OpenSSL if tomcat-native is available, rather than the APR + connector. (remm) +
+ Add path parameter handling to + HttpServletRequest.getContextPath(). This is a follow-up to + the fix for 57215. (markt) +
+ 58692: Make StandardJarScanner more robust. Log + a warning if a class path entry cannot be scanned rather than triggering + the failure of the web application. Includes a test case written by + Derek Abdine. (markt) +
+ 58702: Ensure an access log entry is generated if the client + aborts the connection. (markt) +
+ Fixed various issues reported by Findbugs. (violetagg) +
+ 58735: Add support for the X-XSS-Protection + header to the HttpHeaderSecurityFilter. Patch provided by + Jacopo Cappellato. (markt) +
+ Add the StatusManagerServlet to the list of Servlets that + can only be loaded by privileged applications. (markt) +
+ Simplify code and fix messages in + org.apache.catalina.core.DefaultInstanceManager class. + (kkolinko) +
+ 58751: Correctly handle the case where an + AsyncListener dispatches to a Servlet on an asynchronous + timeout and the Servlet uses sendError() to trigger an + error page. Includes a test case based on code provided by Andy + Wilkinson.(markt) +
+ Ensure that the proper file encoding if specified will be used when + a readme file is served by DefaultServlet. (violetagg) +
+ Fix declaration of localPort attribute of Connector MBean: + it is read-only. (kkolinko) +
+ 58766: Make skipping non-class files during annotation + scanning faster by checking the file name first. Improve debug logging. + (kkolinko) +
+ 58836: Correctly merge query string parameters when + processing a forwarded request where the target includes a query string + that contains a parameter with no value. (markt/kkolinko) +
+ Make sure that shared Digester is reset in an unlikely error case + in HostConfig.deployWAR(). (kkolinko) +
+ Extend the feature available in the cluster session manager + implementations that enables session attribute replication to be + filtered based on attribute name to all session manager implementations. + Note that configuration attribute name has changed from + sessionAttributeFilter to + sessionAttributeNameFilter. Apply the filter on load as + well as unload to ensure that configuration changes made while the web + application is stopped are applied to any persisted data. (markt) +
+ Extend the session attribute filtering options to include filtering + based on the implementation class of the value and optional + WARN level logging if an attribute is filtered. These + options are available for all of the Manager implementations that ship + with Tomcat. When a SecurityManager is used filtering will + be enabled by default. (markt) +
+ Remove distributable and maxInactiveInterval + from the Manager interface because the attributes are never + used. The equivalent attributes from the Context always + take precedence. (markt) +
+ 58867: Improve checking on Host start for WAR files that have + been modified while Tomcat has stopped and re-expand them if + unpackWARs is true. (markt) +
+ 58900: Correctly undeploy symlinked resources and prevent an + infinite cycle of deploy / undeploy. (markt) +

Coyote

+ 58621: The certificate chain cannot be set using the main + certificate attribute, so restore the certificate chain property. (remm) +
+ Allow a new SSL config type where a connector can use either JSSE or + OpenSSL. Both could be allowed, but it would likely create support + issues. This type is used by the OpenSSL implementation for NIOx. (remm) +
+ Improve upgrade context classloader handling by using Context.bind and + unbind. (remm) +
+ Improve OpenSSL keystore/truststore configuration by using the code + from the JSSE implementation. (remm, jfclere) +
+ Fix a potential loop when a client drops the connection unexpectedly. + (markt) +
+ OpenSSL renegotiation support for client certificate authentication. + (remm) +
+ Fix NIO connector renegotiation. (remm) +
+ 58659: Fix a potential deadlock during HTTP/2 processing when + the connection window size is limited. (markt) +

Jasper

+ 57136#c25: Change default value of + quoteAttributeEL setting in Jasper to be true + for better compatibility with other implementations and older versions + of Tomcat. Add command line option -no-quoteAttributeEL in + JspC. (kkolinko) +
+ Fix handling of missing messages in + org.apache.el.util.MessageFactory. (violetagg) +

Cluster

+ Enable an explicit configuration of local member in the static cluster + membership. (kfujino) +
+ Fix potential integer overflow in DeltaSession. + Reported by coverity scan. (fschumacher) +
+ In order to avoid that the heartbeat thread and the background thread to + run Channel.heartbeat simultaneously, if + heartbeatBackgroundEnabled of SimpleTcpCluster + set to true, ensure that the heartbeat thread does not + start. (kfujino) +

WebSocket

+ 55006: The WebSocket client now honors the + java.net.java.net.ProxySelector configuration (using the + HTTP type) when establishing WebSocket connections to servers. Based on + a patch by Niki Dokovski. (markt) +
+ 58624: Correct a potential deadlock if the WebSocket + connection is closed when a message write is in progress. (markt) +
+ 57489: Ensure onClose() is called when a + WebSocket connection is closed even if the sending of the close message + fails. Includes test cases by Barry Coughlan. (markt) +

Web Applications

+ 58631: Correct the continuation character use in the Windows + Service How-To page of the documentation web application. (markt) +
+ Correct the SSL documentation for deprecated attributes to point to the + correct, new location for attributes related to individual certificates. + (markt) +
+ Correct some typos in the JNDI resources How-To. (markt) +
+ Don't create session unnecessarily in the Manager application. (markt) +
+ Don't create session unnecessarily in the Host Manager application. + (markt) +
+ 58723: Clarify documentation and error messages for the text + interface of the manager to make clear that version must be used with + path when referencing contexts deployed using parallel deployment. + (markt) +
+ Document test.threads option in BUILDING.txt. (kkolinko) +

Tribes

+ Ensure that the static member is registered to the add suspect list even + if the static member that is registered to the remove suspect list has + disappeared. (kfujino) +
+ When using a static cluster, add the members that have been cached in + the membership service to the map members list in order to ensure that + the map member is a static member. (kfujino) +
+ Add support for the startup notification of local members in the static + cluster. (kfujino) +
+ Ignore the unnecessary member remove operation from different domain. + (kfujino) +
+ Add support for the shutdown notification of local members in the static + cluster. (kfujino) +

jdbc-pool

+ Correct evaluation of system property + org.apache.tomcat.jdbc.pool.onlyAttemptCurrentClassLoader. + It was basically ignored before. Reported by coverity scan. (fschumacher) +
+ Fix potential integer overflow in ConnectionPool and + PooledConnection. Reported by coverity scan. (fschumacher) +

Other

+ Update optional Checkstyle library to 6.14.1. (kkolinko) +
+ Update the packaged version of the Tomcat Native Library to 1.2.4 to + pick up the Windows binaries that are based on OpenSSL 1.0.2e and APR + 1.5.1. (markt) +
+ Update the NSIS Installer used to build the Windows Installers to + version 2.50. (markt/kkolinko) +
+ Update the internal fork of Commons BCEL to r1725718 to align with the + refactoring for BCEL 6, the next major BCEL release. (markt) +
+ Update the internal fork of Commons DBCP 2 to r1725730 (2.1.1 plus + additional fixes). (markt) +
+ Update the internal fork of Commons Pool 2 to r1725738 (2.4.2 plus + additional fixes). (markt) +
+ Update the internal fork of Commons Codec to r1725746 (1.9 plus + additional fixes). (markt) +

2015-11-17 Tomcat 9.0.0.M1 (markt)

General

+ Make Java 8 the minimum required version to build and run Tomcat 9. + (markt) +
+ Remove support for Comet. (markt) +
+ Tighten up the default file permissions for the .tar.gz + distribution so no files or directories are world readable by default. + Configure Tomcat to run with a default umask of 0027 which + may be overridden by setting UMASK in + setenv.sh. (markt) +
+ Remove native code (Windows Service Wrapper, APR/native connector) + support for Windows Itanium. (markt) +

Catalina

+ The default HTTP cookie parser has been changed to + org.apache.tomcat.util.http.Rfc6265CookieProcessor. (markt) +

Coyote

+ Remove support for the HTTP BIO and AJP BIO connectors. (markt) +
+ Refactor HTTP upgrade and AJP implementations to reduce duplication. + (markt) +
+ Add support for HPACK header encoding and decoding, contributed + by Stuart Douglas. (remm) +
+ 57108: Add support for Server Name Indication (SNI). There + has been significant changes to the SSL configuration in server.xml to + support this. (markt) +
+ Add SSL engine for JSSE backed by OpenSSL. Includes ALPN support. + Based on code contributed by Numa de Montmollin and derived from code + developed by Twitter and Netty. (remm) +
+ RFC 7230 states that clients should ignore reason phrases in HTTP/1.1 + response messages. Since the reason phrase is optional, Tomcat no longer + sends it. As a result the system property + org.apache.coyote.USE_CUSTOM_STATUS_MSG_IN_HEADER is no + longer used and has been removed. (markt) +
+ The minimum required Tomcat Native version has been increased to 1.2.2. + The 1.2.x branch includes ALPN and SNI support which are required for + HTTP/2. (markt) +
+ Add support for HTTP/2 including server push. (markt) +

Tribes

+ Clarify the handling of Copy message and Copy nodes. (kfujino) +

Other

+ Support the use of the threads attribute on Ant's + junit task. Note that using this with a value of greater than one will + disable Cobertura code coverage. (markt) +

Name	Description	MBean ObjectName - Engine	MBean ObjectName - Host
Cluster	The complete cluster element	`type=Cluster`	`type=Cluster,host=${HOST}`
DeltaManager	This manager control the sessions and handle session replication	`type=Manager,context=${APP.CONTEXT.PATH}, host=${HOST}`	`type=Manager,context=${APP.CONTEXT.PATH}, host=${HOST}`
FarmWarDeployer	Manages the process of deploying an application to all nodes in the cluster	Not supported	`type=Cluster, host=${HOST}, component=deployer`
Member	Represents a node in the cluster	type=Cluster, component=member, name=${NODE_NAME}	`type=Cluster, host=${HOST}, component=member, name=${NODE_NAME}`
ReplicationValve	This valve control the replication to the backup nodes	`type=Valve,name=ReplicationValve`	`type=Valve,name=ReplicationValve,host=${HOST}`
JvmRouteBinderValve	This is a cluster fallback valve to change the Session ID to the current tomcat jvmroute.	`type=Valve,name=JvmRouteBinderValve, + context=${APP.CONTEXT.PATH}`	`type=Valve,name=JvmRouteBinderValve,host=${HOST}, + context=${APP.CONTEXT.PATH}`

+ Attribute +	+ Description +
`allowTrace`	+ A boolean value which can be used to enable or disable the TRACE + HTTP method. If not specified, this attribute is set to false. As per RFC + 7231 section 4.3.8, cookie and authorization headers will be excluded from + the response to the TRACE request. If you wish to include these, you can + implement the `doTrace()` method for the target Servlet and + gain full control over the response. +
`asyncTimeout`	+ The default timeout for asynchronous requests in milliseconds. If not + specified, this attribute is set to the Servlet specification default of + 30000 (30 seconds). +
`discardFacades`	+ A boolean value which can be used to enable or disable the recycling + of the facade objects that isolate the container internal request + processing objects. If set to `true` the facades will be + set for garbage collection after every request, otherwise they will be + reused. This setting has no effect when the security manager is enabled. + If not specified, this attribute is set to `true`. +
`enableLookups`	+ Set to `true` if you want calls to + `request.getRemoteHost()` to perform DNS lookups in + order to return the actual host name of the remote client. Set + to `false` to skip the DNS lookup and return the IP + address in String form instead (thereby improving performance). + By default, DNS lookups are disabled. +
`encodedReverseSolidusHandling`	+ When set to `reject` request paths containing a + `%5c` sequence will be rejected with a 400 response. When set + to `decode` request paths containing a `%5c` + sequence will have that sequence decoded to `\` at the same + time other `%nn` sequences are decoded. When set to + `passthrough` request paths containing a `%5c` + sequence will be processed with the `%5c` sequence unchanged. + + When set to `decoded`, the allowBackslash + attribute will be applied after decoding. + + If `passthrough` is used then it is the application's + responsibility to perform any further `%nn` decoding required. + Any `%25` sequences (encoded `%`) in the request + path with also be processed with the `%25` sequence unchanged + to avoid potential corruption and/or decoding failure when the path is + subsequently `%nn` decoded by the application. + If not specified, the default value is `decode`. +
`encodedSolidusHandling`	+ When set to `reject` request paths containing a + `%2f` sequence will be rejected with a 400 response. When set + to `decode` request paths containing a `%2f` + sequence will have that sequence decoded to `/` at the same + time other `%nn` sequences are decoded. When set to + `passthrough` request paths containing a `%2f` + sequence will be processed with the `%2f` sequence unchanged. + + If `passthrough` is used then it is the application's + responsibility to perform any further `%nn` decoding required. + Any `%25` sequences (encoded `%`) in the request + path with also be processed with the `%25` sequence unchanged + to avoid potential corruption and/or decoding failure when the path is + subsequently `%nn` decoded by the application. + If not specified the default value is `reject`. This default + may be modified if the deprecated system + property + `org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH` is + set. +
`maxCookieCount`	+ The maximum number of cookies that are permitted for a request. A value + of less than zero means no limit. If not specified, a default value of 200 + will be used. +
`maxParameterCount`	+ The maximum total number of request parameters (including uploaded + files) obtained from the query string and, for POST requests, the request + body if the content type is + `application/x-www-form-urlencoded` or + `multipart/form-data`. Request parameters beyond this limit + will be ignored. A value of less than 0 means no limit. If not specified, + a default of 10000 is used. The `FailedRequestFilter` + filter can be used to reject requests that + exceed the limit. +
`maxPartCount`	+ The maximum total number of parts permitted in a request where the + content type is `multipart/form-data`. This limit is in + addition to `maxParameterCount`. A value of less than 0 means + no limit. If not specified, a default of 50 is used. Requests that exceed + this limit may be ignored depending on how the application processes the + request. The `FailedRequestFilter` + filter can be used to always reject requests + that exceed the limit. + The nature of multipart requests and the associated Servlet API + requirements for processing them is such that they can place a significant + demand on memory. Applications utilising multipart requests need to ensure + sufficient memory is available to avoid a potential denial of service. As + a guide, the memory required is `maxPartHeaderSize` x + `maxPartCount` x `maxConnections` x 2 (due to the + implementation). For the defaults that is `512 x 50 x 8192 x 2` + which is 400MB. If running on Java 8, this is increased by a further + factor of 2 due to the way Java stores Strings internally which increases + the default memory requirements to 800MB. +
`maxPartHeaderSize`	+ The maximum number of header bytes permitted per part in a request + where the content type is `multipart/form-data`. Requests that + exceed this limit will be rejected. A value of less than 0 means no limit. + If not specified, a default of 512 is used. +
`maxPostSize`	+ The maximum size in bytes of the POST which will be handled by + the container FORM URL parameter parsing. The limit can be disabled by + setting this attribute to a value less than zero. If not specified, this + attribute is set to 2097152 (2 MiB). Note that the + `FailedRequestFilter` + can be used to reject requests that exceed this limit. +
`maxSavePostSize`	+ The maximum size in bytes of the POST which will be saved/buffered by + the container during FORM or CLIENT-CERT authentication. For both types + of authentication, the POST will be saved/buffered before the user is + authenticated. For CLIENT-CERT authentication, the POST is buffered for + the duration of the SSL handshake and the buffer emptied when the request + is processed. For FORM authentication the POST is saved whilst the user + is re-directed to the login form and is retained until the user + successfully authenticates or the session associated with the + authentication request expires. The limit can be disabled by setting this + attribute to -1. Setting the attribute to zero will disable the saving of + POST data during authentication. If not specified, this attribute is set + to 4096 (4 KiB). +
`parseBodyMethods`	+ A comma-separated list of HTTP methods for which request + bodies using `application/x-www-form-urlencoded` will be parsed + for request parameters identically to POST. This is useful in RESTful + applications that want to support POST-style semantics for PUT requests. + Note that any setting other than `POST` causes Tomcat + to behave in a way that goes against the intent of the servlet + specification. + The HTTP method TRACE is specifically forbidden here in accordance + with the HTTP specification. + The default is `POST` +
`port`	+ The TCP port number on which this Connector + will create a server socket and await incoming connections. Your + operating system will allow only one server application to listen + to a particular port number on a particular IP address. If the special + value of 0 (zero) is used, then Tomcat will select a free port at random + to use for this connector. This is typically only useful in embedded and + testing applications. +
`protocol`	+ Sets the protocol to handle incoming traffic. To configure an AJP + connector this must be specified. If no value for protocol is provided, + an HTTP connector rather than an AJP connector + will be configured. + The standard protocol value for an AJP connector is `AJP/1.3` + which uses an auto-switching mechanism to select either a Java NIO based + connector or an APR/native based connector. If the + `PATH` (Windows) or `LD_LIBRARY_PATH` (on most unix + systems) environment variables contain the Tomcat native library, the + native/APR connector will be used. If the native library cannot be + found, the Java NIO based connector will be used. + To use an explicit protocol rather than rely on the auto-switching + mechanism described above, the following values may be used: + `org.apache.coyote.ajp.AjpNioProtocol` + - non blocking Java NIO connector. + `org.apache.coyote.ajp.AjpNio2Protocol` + - non blocking Java NIO2 connector. + `org.apache.coyote.ajp.AjpAprProtocol` + - the APR/native connector. + Custom implementations may also be used. + Take a look at our Connector + Comparison chart. + +
`proxyName`	+ If this Connector is being used in a proxy + configuration, configure this attribute to specify the server name + to be returned for calls to `request.getServerName()`. + See Proxy Support for more + information. +
`proxyPort`	+ If this Connector is being used in a proxy + configuration, configure this attribute to specify the server port + to be returned for calls to `request.getServerPort()`. + See Proxy Support for more + information. +
`redirectPort`	+ If this Connector is supporting non-SSL + requests, and a request is received for which a matching + `<security-constraint>` requires SSL transport, + Catalina will automatically redirect the request to the port + number specified here. +
`scheme`	+ Set this attribute to the name of the protocol you wish to have + returned by calls to `request.getScheme()`. For + example, you would set this attribute to "`https`" + for an SSL Connector. The default value is "`http`". + +
`secure`	+ Set this attribute to `true` if you wish to have + calls to `request.isSecure()` to return `true` + for requests received by this Connector. You would want this on an + SSL Connector or a non SSL connector that is receiving data from a + SSL accelerator, like a crypto card, an SSL appliance or even a webserver. + The default value is `false`. +
`URIEncoding`	+ This specifies the character encoding used to decode the URI bytes, + after %xx decoding the URL. The default value is `UTF-8`. +
`useBodyEncodingForURI`	+ This specifies if the encoding specified in contentType should be used + for URI query parameters, instead of using the URIEncoding. This + setting is present for compatibility with Tomcat 4.1.x, where the + encoding specified in the contentType, or explicitly set using + Request.setCharacterEncoding method was also used for the parameters from + the URL. The default value is `false`. + + Notes: See notes on this attribute in + HTTP Connector documentation. +
`useIPVHosts`	+ Set this attribute to `true` to cause Tomcat to use + the IP address passed by the native web server to determine the Host + to send the request to. The default value is `false`. +
`xpoweredBy`	+ Set this attribute to `true` to cause Tomcat to advertise + support for the Servlet specification using the header recommended in the + specification. The default value is `false`. +

+ Attribute +	+ Description +
`acceptCount`	+ The maximum length of the operating system provided queue for incoming + connection requests when `maxConnections` has been reached. The + operating system may ignore this setting and use a different size for the + queue. When this queue is full, the operating system may actively refuse + additional connections or those connections may time out. The default + value is 100. +
`acceptorThreadCount`	+ The number of threads to be used to accept connections. Increase this + value on a multi CPU machine, although you would never really need more + than `2`. Also, with a lot of non keep alive connections, you + might want to increase this value as well. Default value is + `1`. +
`acceptorThreadPriority`	+ The priority of the acceptor threads. The threads used to accept + new connections. The default value is `5` (the value of the + `java.lang.Thread.NORM_PRIORITY` constant). See the JavaDoc + for the `java.lang.Thread` class for more details on what + this priority means. +
`address`	+ For servers with more than one IP address, this attribute specifies + which address will be used for listening on the specified port. By + default, the connector will listen on the loopback address. Unless the JVM + is configured otherwise using system properties, the Java based connectors + (NIO, NIO2) will listen on both IPv4 and IPv6 addresses when configured + with either `0.0.0.0` or `::`. The APR/native + connector will only listen on IPv4 addresses if configured with + `0.0.0.0` and will listen on IPv6 addresses (and optionally + IPv4 addresses depending on the setting of ipv6v6only) if + configured with `::`. +
`ajpFlush`	+ A boolean value which can be used to enable or disable sending + AJP flush messages to the fronting proxy whenever an explicit + flush happens. The default value is `true`. + An AJP flush message is a SEND_BODY_CHUNK packet with no body content. + Proxy implementations like mod_jk or mod_proxy_ajp will flush the + data buffered in the web server to the client when they receive + such a packet. Setting this to `false` can reduce + AJP packet traffic but might delay sending packets to the client. + At the end of the response, AJP does always flush to the client. +
`allowedRequestAttributesPattern`	+ The AJP protocol passes some information from the reverse proxy to the + AJP connector using request attributes. These attributes are: + + javax.servlet.request.cipher_suite + javax.servlet.request.key_size + javax.servlet.request.ssl_session + javax.servlet.request.X509Certificate + AJP_LOCAL_ADDR + AJP_REMOTE_PORT + AJP_SSL_PROTOCOL + JK_LB_ACTIVATION + CERT_ISSUER (IIS only) + CERT_SUBJECT (IIS only) + CERT_COOKIE (IIS only) + HTTPS_SERVER_SUBJECT (IIS only) + CERT_FLAGS (IIS only) + HTTPS_SECRETKEYSIZE (IIS only) + CERT_SERIALNUMBER (IIS only) + HTTPS_SERVER_ISSUER (IIS only) + HTTPS_KEYSIZE (IIS only) + + The AJP protocol supports the passing of arbitrary request attributes. + Requests containing arbitrary request attributes will be rejected with a + 403 response unless the entire attribute name matches this regular + expression. If not specified, the default value is `null`. +
`bindOnInit`	+ Controls when the socket used by the connector is bound. If set to + `true` it is bound when the connector is initiated and unbound + when the connector is destroyed. If set to `false`, the socket + will be bound when the connector is started and unbound when it is + stopped. If not specified, the default is `true`. +
`clientCertProvider`	+ When client certificate information is presented in a form other than + instances of `java.security.cert.X509Certificate` it needs to + be converted before it can be used and this property controls which JSSE + provider is used to perform the conversion. For example it is used with + the AJP connectors, the HTTP APR connector and + with the + org.apache.catalina.valves.SSLValve.If not specified, the default + provider will be used. +
`connectionLinger`	+ The number of seconds during which the sockets used by this + Connector will linger when they are closed. The default + value is `-1` which disables socket linger. +
`connectionTimeout`	+ The number of milliseconds this Connector will wait, + after accepting a connection, for the request URI line to be + presented. The default value for AJP protocol connectors + is `-1` (i.e. infinite). +
`executor`	+ A reference to the name in an Executor + element. If this attribute is set, and the named executor exists, the + connector will use the executor, and all the other thread attributes will + be ignored. Note that if a shared executor is not specified for a + connector then the connector will use a private, internal executor to + provide the thread pool. +
`executorTerminationTimeoutMillis`	+ The time that the private internal executor will wait for request + processing threads to terminate before continuing with the process of + stopping the connector. If not set, the default is `5000` (5 + seconds). +
`keepAliveTimeout`	+ The number of milliseconds this Connector will wait for + another AJP request before closing the connection. + The default value is to use the value that has been set for the + connectionTimeout attribute. +
`maxConnections`	+ The maximum number of connections that the server will accept and + process at any given time. When this number has been reached, the server + will accept, but not process, one further connection. This additional + connection be blocked until the number of connections being processed + falls below maxConnections at which point the server will + start accepting and processing new connections again. Note that once the + limit has been reached, the operating system may still accept connections + based on the `acceptCount` setting. The default value + is `8192`. + For NIO/NIO2 only, setting the value to -1, will disable the + maxConnections feature and connections will not be counted. +
`maxHeaderCount`	+ The maximum number of headers in a request that are allowed by the + container. A request that contains more headers than the specified limit + will be rejected. A value of less than 0 means no limit. + If not specified, a default of 100 is used. +
`maxThreads`	+ The maximum number of request processing threads to be created + by this Connector, which therefore determines the + maximum number of simultaneous requests that can be handled. If + not specified, this attribute is set to 200. If an executor is associated + with this connector, this attribute is ignored as the connector will + execute tasks using the executor rather than an internal thread pool. Note + that if an executor is configured any value set for this attribute will be + recorded correctly but it will be reported (e.g. via JMX) as + `-1` to make clear that it is not used. +
`minSpareThreads`	+ The minimum number of threads always kept running. This includes both + active and idle threads. If not specified, the default of `10` + is used. If an executor is associated with this connector, this attribute + is ignored as the connector will execute tasks using the executor rather + than an internal thread pool. Note that if an executor is configured any + value set for this attribute will be recorded correctly but it will be + reported (e.g. via JMX) as `-1` to make clear that it is not + used. +
`packetSize`	+ This attribute sets the maximum AJP packet size in Bytes. The maximum + value is 65536. It should be the same as the `max_packet_size` + directive configured for mod_jk. Normally it is not necessary to change + the maximum packet size. Problems with the default value have been + reported when sending certificates or certificate chains. The default + value is 8192. If set to less than 8192 then the setting will ignored and + the default value of 8192 used. +
`processorCache`	+ The protocol handler caches Processor objects to speed up performance. + This setting dictates how many of these objects get cached. + `-1` means unlimited, default is `200`. If not using + Servlet 3.0 asynchronous processing, a good default is to use the same as + the maxThreads setting. If using Servlet 3.0 asynchronous processing, a + good default is to use the larger of maxThreads and the maximum number of + expected concurrent requests (synchronous and asynchronous). +
`secret`	+ Only requests from workers with this secret keyword will be accepted. + The default value is `null`. This attribute must be specified + with a non-null, non-zero length value unless + secretRequired is explicitly configured to be + `false`. If this attribute is configured with a non-null, + non-zero length value then the workers must provide a + matching value else the request will be rejected irrespective of the + setting of secretRequired. +
`secretRequired`	+ If this attribute is `true`, the AJP Connector will only + start if the secret attribute is configured with a + non-null, non-zero length value. This attribute only controls whether + the secret attribute is required to be specified for the + AJP Connector to start. It does not control whether + workers are required to provide the secret. The default value is + `true`. This attribute should only be set to `false` + when the Connector is used on a trusted network. +
`tcpNoDelay`	+ If set to `true`, the TCP_NO_DELAY option will be + set on the server socket, which improves performance under most + circumstances. This is set to `true` by default. +
`threadPriority`	+ The priority of the request processing threads within the JVM. + The default value is `5` (the value of the + `java.lang.Thread.NORM_PRIORITY` constant). See the JavaDoc + for the `java.lang.Thread` class for more details on what + this priority means.If an executor is associated + with this connector, this attribute is ignored as the connector will + execute tasks using the executor rather than an internal thread pool. Note + that if an executor is configured any value set for this attribute will be + recorded correctly but it will be reported (e.g. via JMX) as + `-1` to make clear that it is not used. +
`throwOnFailure`	+ If the Connector experiences an Exception during a Lifecycle transition + should the Exception be rethrown or logged? If not specified, the default + of `false` will be used. Note that the default can be changed + by the `org.apache.catalina.startup.EXIT_ON_INIT_FAILURE` + system property. +
`tomcatAuthentication`	+ If set to `true`, the authentication will be done in Tomcat. + Otherwise, the authenticated principal will be propagated from the native + webserver and used for authorization in Tomcat. + The web server must send the user principal (username) as a request + attribute named `REMOTE_USER`. + Note that this principal will have no roles associated with it. + The default value is `true`. If + `tomcatAuthorization` is set to `true` this + attribute has no effect. +
`tomcatAuthorization`	+ If set to `true`, the authenticated principal will be + propagated from the native webserver and considered already authenticated + in Tomcat. If the web application has one or more security constraints, + authorization will then be performed by Tomcat and roles assigned to the + authenticated principal. If the appropriate Tomcat Realm for the request + does not recognise the provided user name, a Principal will be still be + created but it will have no roles. The default value is + `false`. +
`useVirtualThreads`	+ (bool) Use this attribute to enable or disable usage of virtual threads + with the internal executor. If an executor is associated with this + connector, this attribute is ignored. The default value is + `false`. +

+ Attribute +	+ Description +
`socket.rxBufSize`	+ (int)The socket receive buffer (SO_RCVBUF) size in bytes. JVM default + used if not set. +
`socket.txBufSize`	+ (int)The socket send buffer (SO_SNDBUF) size in bytes. JVM default + used if not set. Care should be taken if explicitly setting this value. + Very poor performance has been observed on some JVMs with values less + than ~8k. +
`socket.tcpNoDelay`	+ (bool)This is equivalent to standard attribute + tcpNoDelay. +
`socket.soKeepAlive`	+ (bool)Boolean value for the socket's keep alive setting + (SO_KEEPALIVE). JVM default used if not set. +
`socket.ooBInline`	+ (bool)Boolean value for the socket OOBINLINE setting. JVM default + used if not set. +
`socket.soReuseAddress`	+ (bool)Boolean value for the sockets reuse address option + (SO_REUSEADDR). JVM default used if not set. +
`socket.soLingerOn`	+ (bool)Boolean value for the sockets so linger option (SO_LINGER). + A value for the standard attribute connectionLinger + that is >=0 is equivalent to setting this to `true`. + A value for the standard attribute connectionLinger + that is <0 is equivalent to setting this to `false`. + Both this attribute and `soLingerTime` must be set else the + JVM defaults will be used for both. +
`socket.soLingerTime`	+ (int)Value in seconds for the sockets so linger option (SO_LINGER). + This is equivalent to standard attribute + connectionLinger. + Both this attribute and `soLingerOn` must be set else the + JVM defaults will be used for both. +
`socket.soTimeout`	+ This is equivalent to standard attribute + connectionTimeout. +
`socket.performanceConnectionTime`	+ (int)The first value for the performance settings. See + Socket Performance Options + All three performance attributes must be set else the JVM defaults will + be used for all three. +
`socket.performanceLatency`	+ (int)The second value for the performance settings. See + Socket Performance Options + All three performance attributes must be set else the JVM defaults will + be used for all three. +
`socket.performanceBandwidth`	+ (int)The third value for the performance settings. See + Socket Performance Options + All three performance attributes must be set else the JVM defaults will + be used for all three. +
`socket.unlockTimeout`	+ (int) The timeout for a socket unlock. When a connector is stopped, it will try to release the acceptor thread by opening a connector to itself. + The default value is `250` and the value is in milliseconds +

+ Attribute +	+ Description +
`socket.directBuffer`	+ (bool)Boolean value, whether to use direct ByteBuffers or java mapped + ByteBuffers. Default is `false`. + When you are using direct buffers, make sure you allocate the + appropriate amount of memory for the direct memory space. On Sun's JDK + that would be something like `-XX:MaxDirectMemorySize=256m`. + +
`socket.appReadBufSize`	+ (int)Each connection that is opened up in Tomcat get associated with + a read ByteBuffer. This attribute controls the size of this buffer. By + default this read buffer is sized at `8192` bytes. For lower + concurrency, you can increase this to buffer more data. For an extreme + amount of keep alive connections, decrease this number or increase your + heap size. +
`socket.appWriteBufSize`	+ (int)Each connection that is opened up in Tomcat get associated with + a write ByteBuffer. This attribute controls the size of this buffer. By + default this write buffer is sized at `8192` bytes. For low + concurrency you can increase this to buffer more response data. For an + extreme amount of keep alive connections, decrease this number or + increase your heap size. + The default value here is pretty low, you should up it if you are not + dealing with tens of thousands concurrent connections. +
`socket.bufferPool`	+ (int)The NIO connector uses a class called NioChannel that holds + elements linked to a socket. To reduce garbage collection, the NIO + connector caches these channel objects. This value specifies the size of + this cache. The default value is `500`, and represents that + the cache will hold 500 NioChannel objects. Other values are + `-1` for unlimited cache and `0` for no cache. +
`socket.bufferPoolSize`	+ (int)The NioChannel pool can also be size based, not used object + based. The size is calculated as follows: + NioChannel + `buffer size = read buffer size + write buffer size` + SecureNioChannel `buffer size = application read buffer size + + application write buffer size + network read buffer size + + network write buffer size` + The value is in bytes, the default value is `10241024100` + (100 MiB). +
`socket.processorCache`	+ (int)Tomcat will cache SocketProcessor objects to reduce garbage + collection. The integer value specifies how many objects to keep in the + cache at most. The default is `500`. Other values are + `-1` for unlimited cache and `0` for no cache. +
`socket.keyCache`	+ (int)Tomcat will cache KeyAttachment objects to reduce garbage + collection. The integer value specifies how many objects to keep in the + cache at most. The default is `500`. Other values are + `-1` for unlimited cache and `0` for no cache. +
`socket.eventCache`	+ (int)Tomcat will cache PollerEvent objects to reduce garbage + collection. The integer value specifies how many objects to keep in the + cache at most. The default is `500`. Other values are + `-1` for unlimited cache and `0` for no cache. +

+ Attribute +	+ Description +
`useCaches`	+ (bool)Use this attribute to enable or disable object caching to + reduce the amount of GC objects produced. + The default value is `false`. +
`socket.directBuffer`	+ (bool)Boolean value, whether to use direct ByteBuffers or java mapped + ByteBuffers. Default is `false`. + When you are using direct buffers, make sure you allocate the + appropriate amount of memory for the direct memory space. On Sun's JDK + that would be something like `-XX:MaxDirectMemorySize=256m`. + +
`socket.appReadBufSize`	+ (int)Each connection that is opened up in Tomcat get associated with + a read ByteBuffer. This attribute controls the size of this buffer. By + default this read buffer is sized at `8192` bytes. For lower + concurrency, you can increase this to buffer more data. For an extreme + amount of keep alive connections, decrease this number or increase your + heap size. +
`socket.appWriteBufSize`	+ (int)Each connection that is opened up in Tomcat get associated with + a write ByteBuffer. This attribute controls the size of this buffer. By + default this write buffer is sized at `8192` bytes. For low + concurrency you can increase this to buffer more response data. For an + extreme amount of keep alive connections, decrease this number or + increase your heap size. + The default value here is pretty low, you should up it if you are not + dealing with tens of thousands concurrent connections. +
`socket.bufferPoolSize`	+ (int)The NIO2 connector uses a class called Nio2Channel that holds + elements linked to a socket. To reduce garbage collection, the NIO + connector caches these channel objects. This value specifies the size of + this cache. The default value is `500`, and represents that + the cache will hold 500 Nio2Channel objects. Other values are + `-1` for unlimited cache and `0` for no cache. +
`socket.processorCache`	+ (int)Tomcat will cache SocketProcessor objects to reduce garbage + collection. The integer value specifies how many objects to keep in the + cache at most. The default is `500`. Other values are + `-1` for unlimited cache and `0` for no cache. +

+ Attribute +	+ Description +
`ipv6v6only`	+ If listening on an IPv6 address on a dual stack system, should the + connector only listen on the IPv6 address? If not specified the default + is `false` and the connector will listen on the IPv6 address + and the equivalent IPv4 address if present. +
`pollTime`	+ Duration of a poll call in microseconds. Lowering this value will + slightly decrease latency of connections being kept alive in some cases + , but will use more CPU as more poll calls are being made. The default + value is 2000 (2ms). + +

	Java Nio Connector NIO	Java Nio2 Connector NIO2	APR/native Connector APR
Classname	`AjpNioProtocol`	`AjpNio2Protocol`	`AjpAprProtocol`
Tomcat Version	7.x onwards	8.x onwards	5.5.x onwards
Support Polling	YES	YES	YES
Polling Size	`maxConnections`	`maxConnections`	`maxConnections`
Read Request Headers	Blocking	Blocking	Blocking
Read Request Body	Blocking	Blocking	Blocking
Write Response Headers and Body	Blocking	Blocking	Blocking
Wait for next Request	Non Blocking	Non Blocking	Non Blocking
Max Connections	`maxConnections`	`maxConnections`	`maxConnections`

Term	Description
XML	An XML configuration file located in the Host's + configBase. It must contain a single <Context> element + and may contain optional nested elements. It does not define an + explicit docBase attribute. It represents a single web + application. It is often referred to as a context.xml file.
XML+EW	An XML configuration file located in the Host's + configBase. It must contain a single <Context> element + and may contain optional nested elements. It includes an explicit + docBase attribute that points to an external WAR. It + represents a single web application. It is often referred to as a + context.xml file.
XML+ED	An XML configuration file located in the Host's + configBase. It must contain a single <Context> element + and may contain optional nested elements. It includes an explicit + docBase attribute that points to an external directory. It + represents a single web application. It is often referred to as a + context.xml file.
WAR	A WAR file located in the Host's appBase. The WAR does + not include an embedded context.xml file.
WAR+XML	A WAR file located in the Host's appBase. The WAR does + include an embedded context.xml file.
DIR	A directory located in the Host's appBase. The directory + does not include an embedded context.xml file.
DIR+XML	A directory located in the Host's appBase. The directory + does include an embedded context.xml file.
redeploy	The Context object that represents the web application is destroyed + and a new Context object is created. If present and permitted by the + configuration, this new Context object is created by parsing the + context.xml file. The web.xml file is parsed during the application + start process. Any sessions stored in the standard Manager in the + default configuration will not be persisted. Any requests to the web + application during the redeploy will be handled as if the web + application is not deployed.
reload	The Context object that represents the web application is stopped and + then started. The web.xml file is parsed during the application start + process. Any sessions stored in the standard Manager in the default + configuration will not be persisted. Any requests to the web + application during the reload will be held until the reload completes + at which point they will continue using the reloaded web application. +

Starting artifact(s)	Configuration Settings	Result
deployXML	copyXML	unpackWARs	XML	WAR	DIR	Notes
XML	either	either	either	Y	N	N	1, 2, 3
XML+EW	either	either	false	Y	N	N	1
XML+EW	either	either	true	Y	N	Y	1
XML+ED	either	either	either	Y	N	N	1, 2
WAR+XML	false	either	false	N	Y	N	4
WAR+XML	false	either	true	N	Y	Y	4
WAR+XML	true	false	false	N	Y	N
WAR+XML	true	false	true	N	Y	Y
WAR+XML	true	true	false	Y	Y	N
WAR+XML	true	true	true	Y	Y	Y
WAR	either	either	false	N	Y	N
WAR	either	either	true	N	Y	Y
DIR+XML	false	either	either	N	N	Y	4
DIR+XML	true	false	either	N	N	Y
DIR+XML	true	true	either	Y	N	Y
DIR	false	either	either	N	N	Y

Artifacts present	Artifact removed	Artifacts remaining
XML	WAR	DIR	XML	WAR	DIR	Notes
N	N	Y	DIR	-	-	N
N	Y	N	WAR	-	N	-
N	Y	Y	DIR	-	Y	R
N	Y	Y	WAR	-	N	N
Y	N	N	XML	N	-	-
Y	N	Y	DIR	N	-	N	5
Y	N	Y	XML	XD	-	Y
Y	Y	N	WAR	N	N	-	5
Y	Y	N	XML	XW	Y	-
Y	Y	Y	DIR	XW	Y	R
Y	Y	Y	WAR	N	N	N
Y	Y	Y	XML	XW	Y	Y
Y	Y (external)	N	WAR	Y	N	-	3
Y	Y (external)	N	XML	N	Y (external)	-	6
Y	N	Y (external)	DIR	Y	-	N	3
Y	N	Y (external)	XML	N	-	Y (external)	6
Y	Y (external)	Y	DIR	Y	Y (external)	R
Y	Y (external)	Y	WAR	Y	N	N	3
Y	Y (external)	Y	XML	N	Y (external)	N	6

Artifacts present	Artifact modified	Artifacts remaining
XML	WAR	DIR	XML	WAR	DIR	Action
N	N	Y	DIR	-	-	M	None
N	Y	N	WAR	-	M	-	Redeploy
N	Y	Y	DIR	-	Y	M	None
N	Y	Y	WAR	-	M	R	Redeploy
Y	N	N	XML	M	-	-	Redeploy
Y	N	Y	DIR	Y	-	M	None
Y	N	Y	XML	M	-	Y	Redeploy
Y	Y	N	WAR	Y	M	-	Reload
Y	Y	N	XML	M	Y	-	Redeploy
Y	Y	Y	DIR	Y	Y	M	None
Y	Y	Y	WAR	Y	M	R	Reload
Y	Y	Y	XML	M	Y	Y	Redeploy
Y	Y(external)	N	WAR	Y	M(external)	-	Reload
Y	Y(external)	N	XML	M	Y(external)	-	Redeploy
Y	N	Y(external)	DIR	Y	-	M(external)	None
Y	N	Y(external)	XML	M	-	Y(external)	Redeploy
Y	Y(external)	Y	DIR	Y	Y(external)	M	None
Y	Y(external)	Y	WAR	Y	M(external)	R	Reload
Y	Y(external)	Y	XML	M	Y(external)	Y	Redeploy

+ Attribute +	+ Description +
`className`	+ The default value here is `org.apache.catalina.tribes.group.GroupChannel` and is + currently the only implementation available. +

+ Attribute +	+ Description +
`heartbeat`	+ Flag whether the channel manages its own heartbeat. + If set to true, the channel start a local thread for the heart beat. + If set this flag to false, you must set SimpleTcpCluster#heartbeatBackgroundEnabled + to true. default value is true. +
`heartbeatSleeptime`	+ If heartbeat == true, specifies the interval of heartbeat thread in milliseconds. + The default is 5000 (5 seconds). +
`optionCheck`	+ If set to true, the GroupChannel will check the option flags that each + interceptor is using. Reports an error if two interceptor share the same + flag. The default is false. +
`jmxEnabled`	+ Flag whether the channel components register with JMX or not. + The default value is true. +
`jmxDomain`	+ if `jmxEnabled` set to true, specifies the jmx domain which + this channel should be registered. The ClusterChannel is used as the + default value. +
`jmxPrefix`	+ if `jmxEnabled` set to true, specifies the jmx prefix which + will be used with channel ObjectName. +

+ Attribute +	+ Description +
`className`	+ The cluster deployer class, currently only one is available, + `org.apache.catalina.ha.deploy.FarmWarDeployer.` +
`deployDir`	+ Deployment directory. This is the pathname of a directory where deploy + the web applications. You may specify an absolute pathname, or a + pathname that is relative to the $CATALINA_BASE directory. In the + current implementation, this attribute must be the same value as the + Host's appBase. +
`tempDir`	+ The temporaryDirectory to store binary data when downloading a war from + the cluster. You may specify an absolute pathname, or a pathname that is + relative to the $CATALINA_BASE directory. +
`watchDir`	+ This is the pathname of a directory where watch for changes(add/modify/remove) + of web applications. You may specify an absolute pathname, or a pathname + that is relative to the $CATALINA_BASE directory. + Note: if watchEnabled is false, this + attribute will have no effect. +
`watchEnabled`	+ Set to true if you want to watch for changes of web applications. + Only when this attribute set to true, you can trigger a deploy/undeploy + of web applications. The flag's value defaults to false. +
`processDeployFrequency`	+ Frequency of the Farm watchDir check. Cluster wide deployment will be + done once for the specified amount of backgroundProcess calls (ie, the + lower the amount, the most often the checks will occur). The minimum + value is 1, and the default value is 2. + Note: if watchEnabled is false, this + attribute will have no effect. +
`maxValidTime`	+ FileMessageFactory instances used by the FarmWarDeployer are only + retained while they are required. When receiving a WAR file, the + associated FileMessageFactory instance is deleted once the WAR file has + been fully received. To avoid memory leaks under various error + conditions (part of the file never received, very slow message transfer, + etc.), this attribute defines the maximum time permitted between + receiving valid messages that contain part of the WAR file. If that + maximum time is exceeded, the FileMessageFactory will be deleted and the + WAR file transfer will fail for that node. If a negative value is + specified, the FileMessageFactory will only be removed once the WAR file + is fully received. If not specified, the default value of 300 (5 + minutes) will be used. +

+ Attribute +	+ Description +
`className`	+ Required, as there is no default +
`optionFlag`	+ If you want the interceptor to trigger on certain message depending on the message's option flag, + you can setup the interceptors flag here. + The default value is `0`, meaning this interceptor will trigger on all messages. +

+ Attribute +	+ Description +
`domain`	+ The logical cluster domain that this Interceptor accepts. + Two different type of values are possible: + 1. Regular string values like "staging-domain" or "tomcat-cluster" will be converted into bytes + using ISO-8859-1 encoding. + 2. byte array in string form, for example {216,123,12,3} +
`logInterval`	+ This value indicates the interval for logging for messages from different domains. + The default is 100, which means that to log per 100 messages. +

+ Attribute +	+ Description +
`expire`	+ How long do we keep the fragments in memory and wait for the rest to arrive. + The default is 60000 ms. +
`maxSize`	+ The maximum message size in bytes. If the message size exceeds this value, this interceptor fragments the message and sends them. + If it is less than this value, this interceptor does not fragment the message and sent in as one message. The default is 1024*100. +

+ Attribute +	+ Description +
`optionFlag`	+ The default and hard coded value is `8 (org.apache.catalina.tribes.Channel.SEND_OPTIONS_ASYNCHRONOUS)`. + The dispatcher will trigger on this value only, as it is predefined by Tribes. +
`alwaysSend`	+ What behavior should be executed when the dispatch queue is full. If `true` (default), then the message is + is sent synchronously, if `false` an error is thrown. +
`maxQueueSize`	+ Size in bytes of the dispatch queue, the default value is `1024102464 (64 MiB)` sets the maximum queue size for the dispatch queue + if the queue fills up, one can trigger the behavior, if `alwaysSend` is set to true, the message will be sent synchronously + if the flag is false, an error is thrown +
`maxThreads`	+ The maximum number of threads in this pool, default is 10. +
`maxSpareThreads`	+ The number of threads to keep in the pool, default is 2. +
`keepAliveTime`	+ Maximum number of milliseconds of until Idle thread terminates. Default value is 5000(5 seconds). +

+ Attribute +	+ Description +
`connectTimeout`	+ Specifies the timeout, in milliseconds, to use when attempting a TCP connection + to the suspect node. Default is 1000. +
`performSendTest`	+ If true is set, send a test message to the suspect node. Default is true. +
`performReadTest`	+ If true is set, read the response of the test message that sent. Default is false. + Note: if `performSendTest` is false, this attribute will have no effect. +
`readTestTimeout`	+ Specifies the timeout, in milliseconds, to use when performing a read test + to the suspicious node. Default is 5000. +
`removeSuspectsTimeout`	+ The maximum time(in seconds) for remove from removeSuspects. Member of + removeSuspects will be automatically removed after removeSuspectsTimeout. + If a negative value specified, the removeSuspects members never be + removed until disappeared really. If the attribute is not provided, + a default of 300 seconds (5 minutes) is used. +

+ Attribute +	+ Description +
`interval`	+ If useThread == true, defines the interval of sending a ping message. + default is 1000 ms. +
`useThread`	+ Flag of whether to start a thread for sending a ping message. + If set to true, this interceptor will start a local thread for sending a ping message. + if set to false, channel heartbeat will send a ping message. + default is false. +

+ Attribute +	+ Description +
`interval`	+ Defines the interval in number of messages when we are to report the throughput statistics. + The report is logged to the `org.apache.juli.logging.LogFactory.getLog(ThroughputInterceptor.class)` + logger under the `INFO` level. + Default value is to report every `10000` messages. +

+ Attribute +	+ Description +
`encryptionAlgorithm`	+ The encryption algorithm to be used, including the mode and padding. Please see + https://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html + for the standard JCA names that can be used. + + EncryptInterceptor currently supports the following + block-cipher modes: + CBC, OFB, CFB, and GCM. + + The length of the key will specify the flavor of the encryption algorithm + to be used, if applicable (e.g. AES-128 versus AES-256). + + The default algorithm is `AES/CBC/PKCS5Padding`. +
`encryptionKey`	+ The key to be used with the encryption algorithm. + + The key should be specified as hex-encoded bytes of the appropriate + length for the algorithm (e.g. 16 bytes / 32 characters / 128 bits for + AES-128, 32 bytes / 64 characters / 256 bits for AES-256, etc.). +

+ Attribute +	+ Description +
`className`	+ Only one implementation available:`org.apache.catalina.tribes.membership.StaticMember` +
`port`	+ There is no need to set. + The value of this attribute inherits from the cluster receiver setting. +
`securePort`	+ There is no need to set. + The value of this attribute inherits from the cluster receiver setting. +
`host`	+ There is no need to set. + The value of this attribute inherits from the cluster receiver setting. +
`domain`	+ The logical cluster domain for that this static member listens for cluster messages. + Two different type of values are possible: + 1. Regular string values like "staging-domain" or "tomcat-cluster" will be converted into bytes + using ISO-8859-1 encoding. + 2. byte array in string form, for example {216,123,12,3} +
`uniqueId`	+ A universally uniqueId for this static member. + The values must be 16 bytes in the following form: + 1. byte array in string form, for example {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15} +

+ Attribute +	+ Description +
`className`	+ Only one implementation available:`org.apache.catalina.tribes.membership.StaticMember` +
`port`	+ The port that this static member listens to for cluster messages +
`securePort`	+ The secure port this static member listens to for encrypted cluster messages + default value is `-1`, this value means the member is not listening on a secure port +
`host`	+ The host (or network interface) that this static member listens for cluster messages. + Three different type of values are possible: + 1. IP address in the form of "216.123.1.23" + 2. Hostnames like "tomcat01.mydomain.com" or "tomcat01" as long as they resolve correctly + 3. byte array in string form, for example {216,123,12,3} +
`domain`	+ The logical cluster domain for that this static member listens for cluster messages. + Two different type of values are possible: + 1. Regular string values like "staging-domain" or "tomcat-cluster" will be converted into bytes + using ISO-8859-1 encoding. + 2. byte array in string form, for example {216,123,12,3} +
`uniqueId`	+ A universally uniqueId for this static member. + The values must be 16 bytes in the following form: + 1. byte array in string form, for example {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15} +

+ Attribute +	+ Description +
`className`	+ Set value to `org.apache.catalina.ha.session.ClusterSessionListener` +

+ Attribute +	+ Description +
`className`	+
`name`	+ The name of this cluster manager, the name is used to identify a + session manager on a node. The name might get modified by the + `Cluster` element to make it unique in the container. +
`notifyListenersOnReplication`	+ Set to `true` if you wish to have session listeners notified + when session attributes are being replicated or removed across Tomcat + nodes in the cluster. +
`processExpiresFrequency`	+ Frequency of the session expiration, and related manager operations. + Manager operations will be done once for the specified amount of + backgroundProcess calls (i.e., the lower the amount, the more often the + checks will occur). The minimum value is 1, and the default value is 6. + +
`secureRandomClass`	+ Name of the Java class that extends + `java.security.SecureRandom` to use to generate session IDs. + If not specified, the default value is + `java.security.SecureRandom`. +
`secureRandomProvider`	+ Name of the provider to use to create the + `java.security.SecureRandom` instances that generate session + IDs. If an invalid algorithm and/or provider is specified, the Manager + will use the platform default provider and the default algorithm. If not + specified, the platform default provider will be used. +
`secureRandomAlgorithm`	+ Name of the algorithm to use to create the + `java.security.SecureRandom` instances that generate session + IDs. If an invalid algorithm and/or provider is specified, the Manager + will use the platform default provider and the default algorithm. If not + specified, the default algorithm of SHA1PRNG will be used. If the + default algorithm is not supported, the platform default will be used. + To specify that the platform default should be used, do not set the + secureRandomProvider attribute and set this attribute to the empty + string. +
`recordAllActions`	+ Flag whether send all actions for session across Tomcat cluster + nodes. If set to false, if already done something to the same attribute, + make sure don't send multiple actions across Tomcat cluster nodes. + In that case, sends only the actions that have been added at last. + Default is `false`. +

+ Attribute +	+ Description +
`enableStatistics`	+ Tracks statistics for the session and events of the cluster. + Default value is `true`. +
`expireSessionsOnShutdown`	+ When a web application is being shutdown, Tomcat issues an expire call + to each session to notify all the listeners. If you wish for all + sessions to expire on all nodes when a shutdown occurs on one node, set + this value to `true`. + Default value is `false`. +
`maxActiveSessions`	+ The maximum number of active sessions that will be created by this + Manager, or -1 (the default) for no limit. For this manager, all + sessions are counted as active sessions irrespective if whether or not + the current node is the primary node for the session. +
`notifySessionListenersOnReplication`	+ Set to `true` if you wish to have session listeners notified + when sessions are created and expired across Tomcat nodes in the + cluster. +
`notifyContainerListenersOnReplication`	+ Set to `true` if you wish to have container listeners notified + across Tomcat nodes in the cluster. +
`persistAuthenticationNotes`	+ Should authentication notes (used during FORM authentication) be + included when sessions are replicated? If `true`, the + session's authentication notes (used during FORM authentication) are + replicated so that an in progress FORM authentication can continue if + failover occurs during FORM authentication. If not specified, the + default value of `false` will be used. + + Please note that all nodes must be upgraded to at least 9.0.66 (the + version where this feature was introduced) before this feature is + enabled else session replication may fail. + + This attribute has been removed for Tomcat 10.1.x onwards which + always replicates FORM authenticaton notes. +
`stateTransferTimeout`	+ The time in seconds to wait for a session state transfer to complete + from another node when a node is starting up. + Default value is `60` seconds. +
`sendAllSessions`	+ Flag whether send sessions as split blocks. + If set to `true`, send all sessions as one big block. + If set to `false`, send sessions as split blocks. + Default value is `true`. +
`sendAllSessionsSize`	+ The number of sessions in a session block message. This value is + effective only when `sendAllSessions` is `false`. + Default is `1000`. +
`sendAllSessionsWaitTime`	+ Wait time between sending of session block messages. This value is + effective only when `sendAllSessions` is `false`. + Default is `2000` milliseconds. +
`sessionAttributeNameFilter`	+ A regular expression used to filter which session attributes will be + replicated. An attribute will only be replicated if its name matches + this pattern. If the pattern is zero length or `null`, all + attributes are eligible for replication. The pattern is anchored so the + session attribute name must fully match the pattern. As an example, the + value `(userName\|sessionHistory)` will only replicate the + two session attributes named `userName` and + `sessionHistory`. If not specified, the default value of + `null` will be used. +
`sessionAttributeValueClassNameFilter`	+ A regular expression used to filter which session attributes will be + replicated. An attribute will only be replicated if the implementation + class name of the value matches this pattern. If the pattern is zero + length or `null`, all attributes are eligible for + replication. The pattern is anchored so the fully qualified class name + must fully match the pattern. If not specified, the default value of + `null` will be used unless a `SecurityManager` is + enabled in which case the default will be + `java\\.lang\\.(?:Boolean\|Integer\|Long\|Number\|String)`. +
`stateTimestampDrop`	+ When this node sends a `GET_ALL_SESSIONS` message to other + node, all session messages that are received as a response are queued. + If this attribute is set to `true`, the received session + messages (except any `GET_ALL_SESSIONS` sent by other nodes) + are filtered by their timestamp. A message is dropped if it is not a + `GET_ALL_SESSIONS` message and its timestamp is earlier than + the timestamp of our `GET_ALL_SESSIONS` message. + If set to `false`, all queued session messages are handled. + Default is `true`. +
`warnOnSessionAttributeFilterFailure`	+ If sessionAttributeNameFilter or + sessionAttributeValueClassNameFilter blocks an + attribute, should this be logged at `WARN` level? If + `WARN` level logging is disabled then it will be logged at + `DEBUG`. The default value of this attribute is + `false` unless a `SecurityManager` is enabled in + which case the default will be `true`. +

+ Attribute +	+ Description +
`mapSendOptions`	+ The backup manager uses a replicated map, this map is sending and + receiving messages. You can setup the flag for how this map is sending + messages, the default value is `6`(synchronous). + Note that if you use asynchronous messaging it is possible for update + messages for a session to be processed by the receiving node in a + different order to the order in which they were sent. +
`maxActiveSessions`	+ The maximum number of active sessions that will be created by this + Manager, or -1 (the default) for no limit. For this manager, only + sessions where the current node is the primary node for the session are + considered active sessions. +
`persistAuthenticationNotes`	+ Should authentication notes (used during FORM authentication) be + included when sessions are replicated? If `true`, the + session's authentication notes (used during FORM authentication) are + replicated so that an in progress FORM authentication can continue if + failover occurs during FORM authentication. If not specified, the + default value of `false` will be used. + + Please note that all nodes must be upgraded to at least 9.0.66 (the + version where this feature was introduced) before this feature is + enabled else session replication may fail. + + This attribute has been removed for Tomcat 10.1.x onwards which + always replicates FORM authenticaton notes. +
`rpcTimeout`	+ Timeout for RPC message used for broadcast and transfer state from + another map. + Default value is `15000` milliseconds. +
`sessionAttributeNameFilter`	+ A regular expression used to filter which session attributes will be + replicated. An attribute will only be replicated if its name matches + this pattern. If the pattern is zero length or `null`, all + attributes are eligible for replication. The pattern is anchored so the + session attribute name must fully match the pattern. As an example, the + value `(userName\|sessionHistory)` will only replicate the + two session attributes named `userName` and + `sessionHistory`. If not specified, the default value of + `null` will be used. +
`sessionAttributeValueClassNameFilter`	+ A regular expression used to filter which session attributes will be + replicated. An attribute will only be replicated if the implementation + class name of the value matches this pattern. If the pattern is zero + length or `null`, all attributes are eligible for + replication. The pattern is anchored so the fully qualified class name + must fully match the pattern. If not specified, the default value of + `null` will be used unless a `SecurityManager` is + enabled in which case the default will be + `java\\.lang\\.(?:Boolean\|Integer\|Long\|Number\|String)`. +
`terminateOnStartFailure`	+ Set to true if you wish to terminate replication map when replication + map fails to start. If replication map is terminated, associated context + will fail to start. If you set this attribute to false, replication map + does not end. It will try to join the map membership in the heartbeat. + Default value is `false` . +
`warnOnSessionAttributeFilterFailure`	+ If sessionAttributeNameFilter or + sessionAttributeValueClassNameFilter blocks an + attribute, should this be logged at `WARN` level? If + `WARN` level logging is disabled then it will be logged at + `DEBUG`. The default value of this attribute is + `false` unless a `SecurityManager` is enabled in + which case the default will be `true`. +
`accessTimeout`	+ The timeout for a ping message. If a remote map does not respond within + this timeout period, its regarded as disappeared. + Default value is `5000` milliseconds. +

+ Attribute +	+ Description +
`sessionIdLength`	+ The length of the session ID may be changed with the + sessionIdLength attribute. + +

+ Attribute +	+ Description +
`className`	+ + The implementation of the membership component. + Two implementations available, `org.apache.catalina.tribes.membership.McastService` + and `org.apache.catalina.tribes.membership.StaticMembershipService`. + +

+ Attribute +	+ Description +
`className`	+ + The value is `org.apache.catalina.tribes.membership.McastService`. + This implementation uses multicast heartbeats for member discovery. + +
`address`	+ + The multicast address that the membership will broadcast its presence and listen + for other heartbeats on. The default value is `228.0.0.4` + Make sure your network is enabled for multicast traffic. + The multicast address, in conjunction with the `port` is what + creates a cluster group. To divide up your farm into several different group, or to + split up QA from production, change the `port` or the `address` + Previously known as mcastAddr. + +
`port`	+ + The multicast port, the default value is `45564` + The multicast port, in conjunction with the `address` is what + creates a cluster group. To divide up your farm into several different group, or to + split up QA from production, change the `port` or the `address` + +
`frequency`	+ + The frequency in milliseconds in which heartbeats are sent out. The default value is `500` ms. + In most cases the default value is sufficient. Changing this value, simply changes the interval in between heartbeats. + +
`dropTime`	+ + The membership component will time out members and notify the Channel if a member fails to send a heartbeat within + a give time. The default value is `3000` ms. This means, that if a heartbeat is not received from a + member in that timeframe, the membership component will notify the cluster of this. + On a high latency network you may wish to increase this value, to protect against false positives. + Apache Tribes also provides a `TcpFailureDetector` that will + verify a timeout using a TCP connection when a heartbeat timeout has occurred. This protects against false positives. + +
`bind`	+ + Use this attribute if you wish to bind your multicast traffic to a specific network interface. + By default, or when this attribute is unset, it tries to bind to `0.0.0.0` and sometimes on multihomed hosts + this becomes a problem. + +
`ttl`	+ + The time-to-live setting for the multicast heartbeats. + This setting should be a value between 0 and 255. The default value is VM implementation specific. + +
`domain`	+ + Apache Tribes has the ability to logically group members into domains, by using this domain attribute. + The `org.apache.catalina.tribes.Member.getDomain()` method returns the value specified here. + +
`soTimeout`	+ + The sending and receiving of heartbeats is done on a single thread, hence to avoid blocking this thread forever, + you can control the `SO_TIMEOUT` value on this socket. + If a value smaller or equal to 0 is presented, the code will default this value to frequency + +
`recoveryEnabled`	+ + In case of a network failure, Java multicast socket don't transparently fail over, instead the socket will continuously + throw IOException upon each receive request. When recoveryEnabled is set to true, this will close the multicast socket + and open a new socket with the same properties as defined above. + The default is `true`. + +
`recoveryCounter`	+ + When `recoveryEnabled==true` this value indicates how many + times an error has to occur before recovery is attempted. The default is + `10`. + +
`recoverySleepTime`	+ + When `recoveryEnabled==true` this value indicates how long time (in milliseconds) + the system will sleep in between recovery attempts, until it recovers successfully. + The default is `5000` (5 seconds). + +
`localLoopbackDisabled`	+ + Membership uses multicast, it will call `java.net.MulticastSocket.setLoopbackMode(localLoopbackDisabled)`. + When `localLoopbackDisabled==true` multicast messages will not reach other nodes on the same local machine. + The default is `false`. + +

+ Attribute +	+ Description +
`className`	+ + The value is `org.apache.catalina.tribes.membership.StaticMembershipService`. + +
`connectTimeout`	+ + Timeout for attempting a TCP connection to address of predefined static member. + Default is `500` ms. + +
`expirationTime`	+ + If members have failed to update their alive time within the given time, + this membership will notify the memberDisappeared event to cluster. + Default is `5000` ms. + +
`rpcTimeout`	+ + Timeout for messages that used for member notification to/from othee nodes. + Default is `3000` ms. + +
`useThread`	+ + If set to true, this membership service will start a local thread for + sending a ping message. if set to `false`, channel heartbeat + will send a ping message. Default is `false`. + +
`pingInterval`	+ + If `useThread` == `true`, defines the interval of + sending a ping message. Default is `1000` ms. + +

+ Attribute +	+ Description +
`className`	+ Only one implementation available:`org.apache.catalina.tribes.membership.StaticMember` +
`port`	+ There is no need to set. + The value of this attribute inherits from the cluster receiver setting. +
`securePort`	+ There is no need to set. + The value of this attribute inherits from the cluster receiver setting. +
`host`	+ There is no need to set. + The value of this attribute inherits from the cluster receiver setting. +
`domain`	+ The logical cluster domain for that this static member listens for cluster messages. + Two different type of values are possible: + 1. Regular string values like "staging-domain" or "tomcat-cluster" will be converted into bytes + using ISO-8859-1 encoding. + 2. byte array in string form, for example {216,123,12,3} +
`uniqueId`	+ A universally uniqueId for this static member. + The values must be 16 bytes in the following form: + 1. byte array in string form, for example {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15} +

+ Attribute +	+ Description +
`className`	+ Only one implementation available:`org.apache.catalina.tribes.membership.StaticMember` +
`port`	+ The port that this static member listens to for cluster messages +
`securePort`	+ The secure port this static member listens to for encrypted cluster messages + default value is `-1`, this value means the member is not listening on a secure port +
`host`	+ The host (or network interface) that this static member listens for cluster messages. + Three different type of values are possible: + 1. IP address in the form of "216.123.1.23" + 2. Hostnames like "tomcat01.mydomain.com" or "tomcat01" as long as they resolve correctly + 3. byte array in string form, for example {216,123,12,3} +
`domain`	+ The logical cluster domain for that this static member listens for cluster messages. + Two different type of values are possible: + 1. Regular string values like "staging-domain" or "tomcat-cluster" will be converted into bytes + using ISO-8859-1 encoding. + 2. byte array in string form, for example {216,123,12,3} +
`uniqueId`	+ A universally uniqueId for this static member. + The values must be 16 bytes in the following form: + 1. byte array in string form, for example {0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15} +

+ Attribute +	+ Description +
`className`	+ The implementation of the receiver component. Two implementations available, + `org.apache.catalina.tribes.transport.nio.NioReceiver` and + `org.apache.catalina.tribes.transport.bio.BioReceiver`. + The `org.apache.catalina.tribes.transport.nio.NioReceiver` is the + preferred implementation +
`address`	+ The address (network interface) to listen for incoming traffic. + Same as the bind address. The default value is `auto` and translates to + `java.net.InetAddress.getLocalHost().getHostAddress()`. +
`direct`	+ Possible values are `true` or `false`. + Set to true if you want the receiver to use direct bytebuffers when reading data + from the sockets. +
`port`	+ The listen port for incoming data. The default value is `4000`. + To avoid port conflicts the receiver will automatically bind to a free port within the range of + `port <= bindPort < port+autoBind` + So for example, if port is 4000, and autoBind is set to 10, then the receiver will open up + a server socket on the first available port in the range 4000-4009. +
`autoBind`	+ Default value is `100`. + Use this value if you wish to automatically avoid port conflicts the cluster receiver will try to open a + server socket on the `port` attribute port, and then work up `autoBind` number of times. +
`securePort`	+ The secure listen port. This port is SSL enabled. If this attribute is omitted no SSL port is opened up. + There default value is unset, meaning there is no SSL socket available. +
`udpPort`	+ The UDP listen port. If this attribute is omitted no UDP port is opened up. + There default value is unset, meaning there is no UDP listener available. +
`selectorTimeout`	+ The value in milliseconds for the polling timeout in the `NioReceiver`. On older versions of the JDK + there have been bugs, that should all now be cleared out where the selector never woke up. + The default value is a very high `5000` milliseconds. +
`maxThreads`	+ The maximum number of threads in the receiver thread pool. The default value is `15` + Adjust this value relative to the number of nodes in the cluster, the number of messages being exchanged and + the hardware you are running on. A higher value doesn't mean more efficiency, tune this value according to your + own test results. +
`minThreads`	+ Minimum number of threads to be created when the receiver is started up. Default value is `6` +
`maxIdleTime`	+ Maximum number of milliseconds of until Idle thread terminates. Default value is `60000` milliseconds. +
`ooBInline`	+ Boolean value for the socket OOBINLINE option. Possible values are `true` or `false`. +
`rxBufSize`	+ The receiver buffer size on the receiving sockets. Value is in bytes, the default value is `65536` bytes. +
`txBufSize`	+ The sending buffer size on the receiving sockets. Value is in bytes, the default value is `25188` bytes. +
`udpRxBufSize`	+ The receive buffer size on the datagram socket. + Default value is `25188` bytes. +
`udpTxBufSize`	+ The send buffer size on the datagram socket. + Default value is `65536` bytes. +
`soKeepAlive`	+ Boolean value for the socket SO_KEEPALIVE option. Possible values are `true` or `false`. +
`soLingerOn`	+ Boolean value to determine whether to use the SO_LINGER socket option. + Possible values are `true` or `false`. Default value is `true`. +
`soLingerTime`	+ Sets the SO_LINGER socket option time value. The value is in seconds. + The default value is `3` seconds. +
`soReuseAddress`	+ Boolean value for the socket SO_REUSEADDR option. Possible values are `true` or `false`. +
`tcpNoDelay`	+ Boolean value for the socket TCP_NODELAY option. Possible values are `true` or `false`. + The default value is `true` +
`timeout`	+ Sets the SO_TIMEOUT option on the socket. The value is in milliseconds and the default value is `3000` + milliseconds. +
`useBufferPool`	+ Boolean value whether to use a shared buffer pool of cached `org.apache.catalina.tribes.io.XByteBuffer` + objects. If set to true, the XByteBuffer that is used to pass a message up the channel, will be recycled at the end + of the requests. This means that interceptors in the channel must not maintain a reference to the object + after the `org.apache.catalina.tribes.ChannelInterceptor#messageReceived` method has exited. +

+ Attribute +	+ Description +
`className`	+ Required, only available implementation is `org.apache.catalina.tribes.transport.ReplicationTransmitter` +

+ Attribute +	+ Description +
`className`	+ Required, an implementation of the `org.apache.catalina.tribes.transport.MultiPointSender`. + Non-blocking implementation is `org.apache.catalina.tribes.transport.nio.PooledParallelSender` + Blocking implementation is `org.apache.catalina.tribes.transport.bio.PooledMultiSender` +
`rxBufSize`	+ The receive buffer size on the socket. + Default value is `25188` bytes. +
`txBufSize`	+ The send buffer size on the socket. + Default value is `65536` bytes. +
`udpRxBufSize`	+ The receive buffer size on the datagram socket. + Default value is `25188` bytes. +
`udpTxBufSize`	+ The send buffer size on the datagram socket. + Default value is `65536` bytes. +
`directBuffer`	+ Possible values are `true` or `false`. + Set to true if you want the receiver to use direct bytebuffers when writing data + to the sockets. Default value is `false` +
`keepAliveCount`	+ The number of requests that can go through the socket before the socket is closed, and reopened + for the next request. The default value is `-1`, which is unlimited. +
`keepAliveTime`	+ The number of milliseconds a connection is kept open after its been opened. + The default value is `-1`, which is unlimited. +
`timeout`	+ Sets the SO_TIMEOUT option on the socket. The value is in milliseconds and the default value is `3000` + milliseconds.(3 seconds) This timeout starts when a message send attempt is starting, until the transfer has been completed. + For the NIO sockets, this will mean, that the caller can guarantee that we will not attempt sending the message + longer than this timeout value. For the blocking IO implementation, this translated directly to the soTimeout. + A timeout will not spawn a retry attempt, in order to guarantee the return of the application thread. +
`maxRetryAttempts`	+ How many times do we retry a failed message, that received a IOException at the socket level. + The default value is `1`, meaning we will retry a message that has failed once. + In other words, we will attempt a message send no more than twice. One is the original send, and one is the + `maxRetryAttempts`. +
`ooBInline`	+ Boolean value for the socket OOBINLINE option. Possible values are `true` or `false`. +
`soKeepAlive`	+ Boolean value for the socket SO_KEEPALIVE option. Possible values are `true` or `false`. +
`soLingerOn`	+ Boolean value to determine whether to use the SO_LINGER socket option. + Possible values are `true` or `false`. Default value is `true`. +
`soLingerTime`	+ Sets the SO_LINGER socket option time value. The value is in seconds. + The default value is `3` seconds. +
`soReuseAddress`	+ Boolean value for the socket SO_REUSEADDR option. Possible values are `true` or `false`. +
`soTrafficClass`	+ Sets the traffic class level for the socket, the value is between 0 and 255. + Default value is `int soTrafficClass = 0x04 \| 0x08 \| 0x010;` + Different values are defined in + java.net.Socket#setTrafficClass(int). +
`tcpNoDelay`	+ Boolean value for the socket TCP_NODELAY option. Possible values are `true` or `false`. + The default value is `true` +
`throwOnFailedAck`	+ Boolean value, default value is `true`. + If set to true, the sender will throw a `org.apache.catalina.tribes.RemoteProcessException` + when we receive a negative ack from the remote member. + Set to false, and Tribes will treat a positive ack the same way as a negative ack, that the message was received. +

+ Attribute +	+ Description +
`poolSize`	+ The maximum number of concurrent connections from A to B. + The value is based on a per-destination count. + The default value is `25` +
`maxWait`	+ The maximum number of milliseconds that the senderPool will wait when + there are no available senders. The default value is `3000` + milliseconds.(3 seconds). +

+ Attribute +	+ Description +
`className`	+ Set value to `org.apache.catalina.ha.tcp.ReplicationValve` +
`filter`	+ For known file extensions or urls, you can use this Valve to notify the + cluster that the session has not been modified during this request and + the cluster doesn't have to probe the session managers for changes. If + the request matches this filter pattern, the cluster assumes there has + been no session change. An example filter would look like `+ filter=".\.gif\|.\.js\|.\.jpeg\|.\.jpg\|.\.png\|.\.htm\|.\.html\|.\.css\|.*\.txt" +`. The filter is a regular expression using + `java.util.regex`. If no filter pattern specified or if the + filter pattern is configured to be the empty string, no filtering will + take place. +
`primaryIndicator`	+ Boolean value, so to true, and the replication valve will insert a request attribute with the name + defined by the `primaryIndicatorName` attribute. + The value inserted into the request attribute is either `Boolean.TRUE` or + `Boolean.FALSE` +
`primaryIndicatorName`	+ Default value is `org.apache.catalina.ha.tcp.isPrimarySession` + The value defined here is the name of the request attribute that contains the boolean value + if the session is primary on this server or not. +
`statistics`	+ Boolean value. Set to `true` if you want the valve to collect request statistics. + Default value is `false` +

element */ + display: block; +} + + +/* Layout */ + +#wrapper { + min-width: 400px; +} + +#header { + border-bottom: 1px solid #bbb; +} + +@media not print { + #header { + box-shadow: 0 0 7px #aaa; + } +} + +#header > div { + padding-left: 15px; + padding-right: 15px; + + /* Work-around for old browsers: */ + background-color: #F8F3E4; + background: linear-gradient(to bottom, #ffffff -10%, #F8F3E4 100%); + position: relative; +} + +#header .logo { + float: left; + padding-top: 10px; + min-width: 190px; +} + +#header .logo img{ + /* To avoid that the Font Descender being added to the parent div's height */ + vertical-align: middle; +} + +#header .asfLogo { + float: right; + position: relative; + top: 8px; +} + +#header h1 { + margin-top: 0.6em; + margin-bottom: 0; +} + +#header .versionInfo { + font-size: 13pt; + margin-bottom: 1em; +} + +#middle { + display: table; + table-layout: fixed; + margin: 0; + width: 100%; +} +#middle > div { display: table-row; } +#middle > div > div { display: table-cell; vertical-align: top; } + + + +#mainLeft { + width: 190px; +} + +#mainLeft > div { + margin-top: -1px; /* to overwrite border of element above */ + padding-left: 16px; + padding-right: 14px; + padding-top: 6px; + padding-bottom: 15px; + background-color: #F8F3E4; + border-right: 1px solid #bbb; + border-bottom: 1px solid #bbb; + font-size: 10pt; + border-bottom-right-radius: 20px; + box-shadow: 0 0 5px #aaa; +} + +#mainLeft h2 { + margin-bottom: 0.2em; + font-size: 1.2em; +} + +#mainLeft ul { + padding: 0; + margin: 0; + list-style-type: none; +} + +#mainLeft ul a { + text-indent: -0.6em; + padding-left: 1.4em; + display: block; + text-decoration: none; + color: #444; +} +#mainLeft ul a:hover { + color: #000; + background-color: #D1c9b9; +} + +#mainRight { + padding-left: 14px; + padding-right: 20px; + +} + +#footer { + margin-top: 30px; + padding-top: 20px; + padding-bottom: 20px; + padding-left: 20px; + padding-right: 20px; + border-top: 1px solid #ccc; + color: #444; + text-align: center; + /* font-style: italic; */ + font-size: 9pt; +} + + +/* Content */ + +#content div.text { + padding-left: 1em; + padding-left: 1em; +} + +#content h3, #content h4, #content h5, #content h6 { + padding-left: 5px; + padding-right: 5px; + background-color: #eaeaea; +} + +@media not print { + #content h3, #content h4, #content h5, #content h6 { + border: 1px solid #ccc; + border-radius: 4px; + } +} + +#content h4, #content h5, #content h6 { + background-color: #f6f6f6; +} + +code { + background-color: rgb(224,255,255); +} + +div.codeBox pre code, code.attributeName, code.propertyName, code.noHighlight, .noHighlight code { + background-color: transparent; +} +div.codeBox { + overflow: auto; + margin: 1em 0; +} +div.codeBox pre { + margin: 0; + padding: 4px; + border: 1px solid #999; + border-radius: 5px; + background-color: #eff8ff; + display: table; /* To prevent

s from taking the complete available width. */
+  /*
+  When it is officially supported, use the following CSS instead of display: table
+  to prevent big s from exceeding the browser window:
+  max-width: available;
+  width: min-content;
+  */
+}
+
+div.codeBox pre.wrap {
+  white-space: pre-wrap;
+}
+
+
+table.defaultTable tr, table.detail-table tr {
+    border: 1px solid #CCC;
+}
+
+table.defaultTable tr:nth-child(even), table.detail-table tr:nth-child(even) {
+    background-color: #FAFBFF;
+}
+
+table.defaultTable tr:nth-child(odd), table.detail-table tr:nth-child(odd) {
+    background-color: #EEEFFF;
+}
+
+table.defaultTable th, table.detail-table th {
+  background-color: #88b;
+  color: #fff;
+}
+
+table.defaultTable th, table.defaultTable td, table.detail-table th, table.detail-table td {
+  padding: 5px 8px;
+}
+
+
+p.notice {
+  border: 1px solid rgb(255, 0, 0);
+  background-color: rgb(238, 238, 238);
+  color: rgb(0, 51, 102);
+  padding: 0.5em;
+  margin: 1em 2em 1em 1em;
+}
+
+
+/* Changelog-Styles */
+
+ul.changelog {
+  padding-left: 1em;
+  list-style-type: none;
+}
+
+ul.changelog  li{
+  padding-top: 5px;
+  padding-bottom: 5px;
+}
+
+ul.changelog img {
+  vertical-align: middle
+}
+
+
+/* Printer-only Styles */
+@media print {
+    .noPrint { display: none; }
+    #middle > div > div#mainLeft { display: none; }
+    a { color: inherit; text-decoration: none; }
+}
+
+/* Fix for Comments section which contains a  */
+#comments_thread h1, #comments_thread h2, #comments_thread h3, #comments_thread h4, #comments_thread h5, #comments_thread h6 {
+    border: none;
+    background-color: transparent;
+}
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/docs.gif b/apache-tomcat-9.0.109/webapps/docs/images/docs.gif
new file mode 100644
index 0000000..d64a4a1
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/docs.gif differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/fix.gif b/apache-tomcat-9.0.109/webapps/docs/images/fix.gif
new file mode 100644
index 0000000..d59ad64
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/fix.gif differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans400.woff b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans400.woff
new file mode 100644
index 0000000..55b25f8
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans400.woff differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans400italic.woff b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans400italic.woff
new file mode 100644
index 0000000..cedefb8
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans400italic.woff differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans600.woff b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans600.woff
new file mode 100644
index 0000000..e83bb33
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans600.woff differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans600italic.woff b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans600italic.woff
new file mode 100644
index 0000000..983bb33
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans600italic.woff differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans700.woff b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans700.woff
new file mode 100644
index 0000000..27619e7
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans700.woff differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans700italic.woff b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans700italic.woff
new file mode 100644
index 0000000..e12c3a9
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/fonts/OpenSans700italic.woff differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/fonts/fonts.css b/apache-tomcat-9.0.109/webapps/docs/images/fonts/fonts.css
new file mode 100644
index 0000000..fa306fc
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/images/fonts/fonts.css
@@ -0,0 +1,54 @@
+@charset "utf-8";
+/*
+  Licensed to the Apache Software Foundation (ASF) under one or more
+  contributor license agreements.  See the NOTICE file distributed with
+  this work for additional information regarding copyright ownership.
+  The ASF licenses this file to You under the Apache License, Version 2.0
+  (the "License"); you may not use this file except in compliance with
+  the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+@font-face {
+  font-family: 'Open Sans';
+  font-style: normal;
+  font-weight: 400;
+  src: local('Open Sans'), local('OpenSans'), url('OpenSans400.woff') format('woff');
+}
+@font-face {
+  font-family: 'Open Sans';
+  font-style: italic;
+  font-weight: 400;
+  src: local('Open Sans Italic'), local('OpenSans-Italic'), url('OpenSans400italic.woff') format('woff');
+}
+@font-face {
+  font-family: 'Open Sans';
+  font-style: normal;
+  font-weight: 600;
+  src: local('Open Sans Semibold'), local('OpenSans-Semibold'), url('OpenSans600.woff') format('woff');
+}
+@font-face {
+  font-family: 'Open Sans';
+  font-style: italic;
+  font-weight: 600;
+  src: local('Open Sans Semibold Italic'), local('OpenSans-SemiboldItalic'), url('OpenSans600italic.woff') format('woff');
+}
+@font-face {
+  font-family: 'Open Sans';
+  font-style: normal;
+  font-weight: 700;
+  src: local('Open Sans Bold'), local('OpenSans-Bold'), url('OpenSans700.woff') format('woff');
+}
+@font-face {
+  font-family: 'Open Sans';
+  font-style: italic;
+  font-weight: 700;
+  src: local('Open Sans Bold Italic'), local('OpenSans-BoldItalic'), url('OpenSans700italic.woff') format('woff');
+}
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/tomcat.gif b/apache-tomcat-9.0.109/webapps/docs/images/tomcat.gif
new file mode 100644
index 0000000..f2aa6f8
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/tomcat.gif differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/tomcat.png b/apache-tomcat-9.0.109/webapps/docs/images/tomcat.png
new file mode 100644
index 0000000..209b07f
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/tomcat.png differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/update.gif b/apache-tomcat-9.0.109/webapps/docs/images/update.gif
new file mode 100644
index 0000000..31e22ab
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/update.gif differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/images/void.gif b/apache-tomcat-9.0.109/webapps/docs/images/void.gif
new file mode 100644
index 0000000..e565824
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/docs/images/void.gif differ
diff --git a/apache-tomcat-9.0.109/webapps/docs/index.html b/apache-tomcat-9.0.109/webapps/docs/index.html
new file mode 100644
index 0000000..4c71d5d
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/index.html
@@ -0,0 +1,195 @@
+
+Apache Tomcat 9 (9.0.109) - Documentation Index
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Documentation Index
Introduction

+
+This is the top-level entry point of the documentation bundle for the
+Apache Tomcat Servlet/JSP container.  Apache Tomcat version
+9.0 implements the Servlet 4.0 and JavaServer Pages 2.3
+specifications from the
+Java Community Process, and includes many
+additional features that make it a useful platform for developing and deploying
+web applications and web services.
+
+Select one of the links from the navigation menu (to the left) to drill
+down to the more detailed documentation that is available.  Each available
+manual is described in more detail below.
+
+
Apache Tomcat User Guide

+
+The following documents will assist you in downloading and installing
+Apache Tomcat, and using many of the Apache Tomcat features.
+
+
+Introduction - A
+    brief, high level, overview of Apache Tomcat.
+Setup - How to install and run
+    Apache Tomcat on a variety of platforms.
+First web application
+    - An introduction to the concepts of a web application as defined
+    in the Servlet Specification.  Covers basic organization of your web application
+    source tree, the structure of a web application archive, and an
+    introduction to the web application deployment descriptor
+    (/WEB-INF/web.xml).
+Deployer -
+    Operating the Apache Tomcat Deployer to deploy, precompile, and validate web
+    applications.
+Manager -
+    Operating the Manager web app to deploy, undeploy, and
+    redeploy applications while Apache Tomcat is running.
+Host Manager -
+    Operating the Host Manager web app to add and remove
+    virtual hosts while Apache Tomcat is running.
+Realms and Access Control
+    - Description of how to configure Realms (databases of users,
+    passwords, and their associated roles) for use in web applications that
+    utilize Container Managed Security.
+Security Manager
+    - Configuring and using a Java Security Manager to
+    support fine-grained control over the behavior of your web applications.
+    
+JNDI Resources
+    - Configuring standard and custom resources in the JNDI naming context
+    that is provided to each web application.
+
+    JDBC DataSource
+    - Configuring a JNDI DataSource with a DB connection pool.
+    Examples for many popular databases.
+Classloading
+    - Information about class loading in Apache Tomcat, including where to place
+    your application classes so that they are visible.
+JSPs
+    - Information about Jasper configuration, as well as the JSP compiler
+    usage.
+SSL/TLS -
+    Installing and configuring SSL/TLS support so that your Apache Tomcat will
+    serve requests using the https protocol.
+SSI -
+    Using Server Side Includes in Apache Tomcat.
+CGI -
+    Using CGIs with Apache Tomcat.
+Proxy Support -
+    Configuring Apache Tomcat to run behind a proxy server (or a web server
+    functioning as a proxy server).
+MBeans Descriptors -
+    Configuring MBean descriptors files for custom components.
+Default Servlet -
+    Configuring the default servlet and customizing directory listings.
+Apache Tomcat Clustering -
+    Enable session replication in a Apache Tomcat environment.
+Balancer -
+    Configuring, using, and extending the load balancer application.
+Connectors -
+    Connectors available in Apache Tomcat, and native web server integration.
+Monitoring and Management -
+    Enabling JMX Remote support, and using tools to monitor and manage Apache Tomcat.
+Logging -
+    Configuring logging in Apache Tomcat.
+Apache Portable Runtime -
+    Using APR to provide superior performance, scalability and better
+    integration with native server technologies.
+Virtual Hosting -
+    Configuring virtual hosting in Apache Tomcat.
+Advanced IO -
+    Extensions available over regular, blocking IO.
+Using Tomcat libraries with Maven -
+    Obtaining Tomcat jars through Maven.
+Security Considerations -
+    Options to consider when securing an Apache Tomcat installation.
+Windows Service -
+    Running Tomcat as a service on Microsoft Windows.
+Windows Authentication -
+    Configuring Tomcat to use integrated Windows authentication.
+High Concurrency JDBC Pool -
+    Configuring Tomcat to use an alternative JDBC pool.
+WebSocket support -
+    Developing WebSocket applications for Apache Tomcat.
+URL rewrite -
+    Using the regexp based rewrite valve for conditional URL and host rewrite.
+CDI and JAX-RS support -
+    Configuring CDI,JAX-RS and Eclipse Microprofile support.
+AOT compilation support -
+    Ahead of Time compilation support with GraalVM/Native Image.
+
+
+
Reference

+
+The following documents are aimed at System Administrators who
+are responsible for installing, configuring, and operating an Apache Tomcat server.
+
+
+Release notes
+    - Known issues in this Apache Tomcat release.
+    
+Apache Tomcat Server Configuration Reference
+    - Reference manual that documents all available elements and attributes
+      that may be placed into the Apache Tomcat conf/server.xml file.
+    
+JK Documentation
+    - Complete documentation and HOWTOs on the JK native webserver connector,
+      used to interface Apache Tomcat with servers like Apache HTTPd, IIS
+      and others.
+Servlet 4.0
+    
+    Specification and
+    
+    Javadoc
+    
+JSP 2.3
+    
+    Specification and
+    
+    Javadoc
+    
+EL 3.0
+    
+    Specification and
+    
+    Javadoc
+    
+WebSocket 1.1
+    
+    Specification and
+    
+    Javadoc
+    
+JASPIC 1.1
+    
+    Specification and
+    
+    Javadoc
+    
+
+
+
Apache Tomcat Developers

+
+The following documents are for Java developers who wish to contribute to
+the development of the Apache Tomcat project.
+
+Building from Source -
+    Details the steps necessary to download Apache Tomcat source code (and the
+    other packages that it depends on), and build a binary distribution from
+    those sources.
+    
+Changelog - Details the
+    changes made to Apache Tomcat.
+    
+Status -
+    Apache Tomcat development status.
+    
+Developers - List of active
+    Apache Tomcat contributors.
+    
+Javadocs
+    - Javadoc API documentation for Apache Tomcat's internals.
+Apache Tomcat Architecture
+    - Documentation of the Apache Tomcat Server Architecture.
+
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/introduction.html b/apache-tomcat-9.0.109/webapps/docs/introduction.html
new file mode 100644
index 0000000..e5f1a8e
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/introduction.html
@@ -0,0 +1,262 @@
+
+Apache Tomcat 9 (9.0.109) - Introduction
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Introduction
Table of Contents

+Introduction
Terminology
Directories and Files
CATALINA_HOME and CATALINA_BASEWhy Use CATALINA_BASE
Contents of CATALINA_BASE
How to Use CATALINA_BASE
Configuring Tomcat
Where to Go for Help
+
Introduction

+
+For administrators and web developers alike, there are some important bits
+of information you should familiarize yourself with before starting out. This
+document serves as a brief introduction to some of the concepts and
+terminology behind the Tomcat container. As well, where to go when you need
+help.
+
+
Terminology

+
+In the course of reading these documents, you will run across a number of
+terms; some specific to Tomcat, and others defined by the
+Servlet and
+JSP specifications.
+
+
+Context - In a nutshell, a Context is a
+    web application.
+
+That is it. If you find any more terms we need to add to this section, please
+do let us know.
+
+
Directories and Files

+
+These are some of the key tomcat directories:
+
+
+/bin - Startup, shutdown, and other scripts. The
+    *.sh files (for Unix systems) are functional duplicates of
+    the *.bat files (for Windows systems).  Since the Win32
+    command-line lacks certain functionality, there are some additional
+    files in here.
+/conf - Configuration files and related DTDs.  The most
+    important file in here is server.xml.  It is the main configuration file
+    for the container.
+/logs - Log files are here by default.
+/webapps - This is where your webapps go.
+
+
+
CATALINA_HOME and CATALINA_BASE

+  Throughout the documentation, there are references to the two following
+    properties:
+    

+      
+        CATALINA_HOME: Represents the root of your Tomcat
+        installation, for example /home/tomcat/apache-tomcat-9.0.10
+        or C:\Program Files\apache-tomcat-9.0.10.
+      
+      
+        CATALINA_BASE: Represents the root of a runtime
+        configuration of a specific Tomcat instance. If you want to have
+        multiple Tomcat instances on one machine, use the CATALINA_BASE
+        property.
+      
+    
+  
+  
+    If you set the properties to different locations, the CATALINA_HOME location
+    contains static sources, such as .jar files, or binary files.
+    The CATALINA_BASE location contains configuration files, log files, deployed
+    applications, and other runtime requirements.
+  
+  Why Use CATALINA_BASE

+    
+      By default, CATALINA_HOME and CATALINA_BASE point to the same directory.
+      Set CATALINA_BASE manually when you require running multiple Tomcat
+      instances on one machine. Doing so provides the following benefits:
+    
+    
+      
+        Easier management of upgrading to a newer version of Tomcat. Because all
+        instances with single CATALINA_HOME location share one set of
+        .jar files and binary files, you can easily upgrade the files
+        to newer version and have the change propagated to all Tomcat instances
+        using the same CATALINA_HOME directory.
+      
+      
+        Avoiding duplication of the same static .jar files.
+      
+      
+        The possibility to share certain settings, for example the setenv shell
+        or bat script file (depending on your operating system).
+      
+    
+  
+  Contents of CATALINA_BASE

+    
+      Before you start using CATALINA_BASE, first consider and create the
+      directory tree used by CATALINA_BASE. Note that if you do not create
+      all the recommended directories, Tomcat creates the directories
+      automatically. If it fails to create the necessary directory, for example
+      due to permission issues, Tomcat will either fail to start, or may not
+      function correctly.
+    
+    
+      Consider the following list of directories:
+      

+        
+          
+            The bin directory with the setenv.sh,
+            setenv.bat, and tomcat-juli.jar files.
+          
+          
+            Recommended: No.
+          
+          
+            Order of lookup: CATALINA_BASE is checked first; fallback is provided
+            to CATALINA_HOME.
+          
+        
+        
+          
+            The lib directory with further resources to be added on
+            classpath.
+          
+          
+            Recommended: Yes, if your application depends on external libraries.
+          
+          
+            Order of lookup: CATALINA_BASE is checked first; CATALINA_HOME is
+            loaded second.
+          
+        
+        
+          
+            The logs directory for instance-specific log files.
+          
+          
+            Recommended: Yes.
+          
+        
+        
+          
+            The webapps directory for automatically loaded web
+            applications.
+          
+          
+            Recommended: Yes, if you want to deploy applications.
+          
+          
+            Order of lookup: CATALINA_BASE only.
+          
+        
+        
+          
+            The work directory that contains temporary working
+            directories for the deployed web applications.
+          
+          
+            Recommended: Yes.
+          
+        
+        
+          
+            The temp directory used by the JVM for temporary files.
+          
+          
+            Recommended: Yes.
+          
+        
+      
+    
+    
+      We recommend you not to change the tomcat-juli.jar file.
+      However, in case you require your own logging implementation, you can
+      replace the tomcat-juli.jar file in a CATALINA_BASE location
+      for the specific Tomcat instance.
+    
+    
+      We also recommend you copy all configuration files from the
+      CATALINA_HOME/conf directory into the
+      CATALINA_BASE/conf/ directory. In case a configuration file
+      is missing in CATALINA_BASE, there is no fallback to CATALINA_HOME.
+      Consequently, this may cause failure.
+    
+    
+      At minimum, CATALINA_BASE must contain:
+      

+        conf/server.xml
+        conf/web.xml
+      
+      That includes the conf directory. Otherwise, Tomcat fails
+      to start, or fails to function properly.
+    
+    
+      For advanced configuration information, see the
+      
+        RUNNING.txt
+       file.
+    
+  
+  How to Use CATALINA_BASE

+    
+      The CATALINA_BASE property is an environment variable. You can set it
+      before you execute the Tomcat start script, for example:
+      

+        On Unix: CATALINA_BASE=/tmp/tomcat_base1 bin/catalina.sh start
+        On Windows: CATALINA_BASE=C:\tomcat_base1 bin/catalina.bat start
+      
+    
+  
+
Configuring Tomcat

+
+This section will acquaint you with the basic information used during
+the configuration of the container.
+
+All of the information in the configuration files is read at startup,
+meaning that any change to the files necessitates a restart of the container.
+
+
+
Where to Go for Help

+
+While we've done our best to ensure that these documents are clearly
+written and easy to understand, we may have missed something.  Provided
+below are various web sites and mailing lists in case you get stuck.
+
+Keep in mind that some of the issues and solutions vary between the
+major versions of Tomcat.  As you search around the web, there will be
+some documentation that is not relevant to Tomcat 9, but
+only to earlier versions.
+
+
+Current document - most documents will list potential hangups. Be sure
+    to fully read the relevant documentation as it will save you much time
+    and effort. There's nothing like scouring the web only to find out that
+    the answer was right in front of you all along!
+Tomcat FAQ
+Tomcat WIKI
+Tomcat FAQ at jGuru
+Tomcat mailing list archives - numerous sites archive the Tomcat mailing
+    lists. Since the links change over time, clicking here will search
+    Google.
+    
+The TOMCAT-USER mailing list, which you can subscribe to
+    here. If you don't
+    get a reply, then there's a good chance that your question was probably
+    answered in the list archives or one of the FAQs.  Although questions
+    about web application development in general are sometimes asked and
+    answered, please focus your questions on Tomcat-specific issues.
+The TOMCAT-DEV mailing list, which you can subscribe to
+    here.  This list is
+    reserved for discussions about the development of Tomcat
+    itself.  Questions about Tomcat configuration, and the problems you run
+    into while developing and running applications, will normally be more
+    appropriate on the TOMCAT-USER list instead.
+
+
+And, if you think something should be in the docs, by all means let us know
+on the TOMCAT-DEV list.
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/jasper-howto.html b/apache-tomcat-9.0.109/webapps/docs/jasper-howto.html
new file mode 100644
index 0000000..1781f7e
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/jasper-howto.html
@@ -0,0 +1,407 @@
+
+Apache Tomcat 9 (9.0.109) - Jasper 2 JSP Engine How To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Jasper 2 JSP Engine How To
Table of Contents

+Introduction
Configuration
Known issues
Production Configuration
Web Application Compilation
Optimisation
+
Introduction

+
+Tomcat 9.0 uses the Jasper 2 JSP Engine to implement
+the JavaServer Pages 2.3
+specification.
+
+Jasper 2 has been redesigned to significantly improve performance over
+the original Jasper.  In addition to general code improvements the following
+changes were made:
+
+JSP Custom Tag Pooling - The java objects instantiated
+for JSP Custom Tags can now be pooled and reused.  This significantly boosts
+the performance of JSP pages which use custom tags.
+Background JSP compilation - If you make a change to
+a JSP page which had already been compiled Jasper 2 can recompile that
+page in the background.  The previously compiled JSP page will still be
+available to serve requests.  Once the new page has been compiled
+successfully it will replace the old page.  This helps improve availability
+of your JSP pages on a production server.
+Recompile JSP when included page changes - Jasper 2
+can now detect when a page included at compile time from a JSP has changed
+and then recompile the parent JSP.
+JDT used to compile JSP pages - The
+Eclipse JDT Java compiler is now used to perform JSP java source code
+compilation. This compiler loads source dependencies from the container
+classloader. Ant and javac can still be used.
+
+
+
+Jasper is implemented using the servlet class
+org.apache.jasper.servlet.JspServlet.
+
+
Configuration

+
+By default Jasper is configured for use when doing web application
+development.  See the section 
+Production Configuration for information on configuring Jasper
+for use on a production Tomcat server.
+
+The servlet which implements Jasper is configured using init parameters
+in your global $CATALINA_BASE/conf/web.xml.
+
+
+checkInterval - If development is false and checkInterval
+is greater than zero, background compiles are enabled. checkInterval is the time
+in seconds between checks to see if a JSP page (and its dependent files) needs
+to be recompiled. Default 0 seconds.
+
+classdebuginfo - Should the class file be compiled with
+debugging information?  true or false, default
+true.
+
+
+classpath - Defines the class path to be used to compile
+the generated servlets. This parameter only has an effect if the ServletContext
+attribute org.apache.jasper.Constants.SERVLET_CLASSPATH is not set. This
+attribute is always set when Jasper is used within Tomcat. By default the
+classpath is created dynamically based on the current web application.
+
+compiler - Which compiler Ant should use to compile JSP
+pages. The valid values for this are the same as for the compiler attribute of
+Ant's
+javac
+task. If the value is not set, then the default Eclipse JDT Java compiler will
+be used instead of using Ant. There is no default value. If this attribute is
+set then setenv.[sh|bat] should be used to add
+ant.jar, ant-launcher.jar and tools.jar
+to the CLASSPATH environment variable.
+
+compilerSourceVM - What JDK version are the source files
+compatible with? (Default value: 1.8)
+
+compilerTargetVM - What JDK version are the generated files
+compatible with? (Default value: 1.8)
+
+development - Is Jasper used in development mode? If true,
+the frequency at which JSPs are checked for modification may be specified via
+the modificationTestInterval parameter.true or false,
+default true.
+
+displaySourceFragment - Should a source fragment be
+included in exception messages? true or false,
+default true.
+
+dumpSmap - Should the SMAP info for JSR45 debugging be
+dumped to a file? true or false, default
+false. false if suppressSmap is true.
+
+enablePooling - Determines whether tag handler pooling is
+enabled. This is a compilation option. It will not alter the behaviour of JSPs
+that have already been compiled. true or false,
+default true.
+
+
+engineOptionsClass - Allows specifying the Options class
+used to configure Jasper. If not present, the default EmbeddedServletOptions
+will be used. This option is ignored if running under a SecurityManager.
+
+
+errorOnUseBeanInvalidClassAttribute - Should Jasper issue
+an error when the value of the class attribute in an useBean action is not a
+valid bean class? true or false, default
+true.
+
+fork - Have Ant fork JSP page compiles so they are
+performed in a separate JVM from Tomcat? true or
+false, default true.
+
+genStringAsCharArray - Should text strings be generated as char
+arrays, to improve performance in some cases? Default false.
+
+ieClassId - Deprecated. Will be removed in Tomact 10.1.
+The class-id value to be sent to Internet
+Explorer when using <jsp:plugin> tags.   Default
+clsid:8AD9C840-044E-11D1-B3E9-00805F499D93.
+
+javaEncoding - Java file encoding to use for generating
+java source files. Default UTF8.
+
+keepgenerated - Should we keep the generated Java source
+code for each page instead of deleting it? true or
+false, default true.
+
+mappedfile - Should we generate static content with one
+print statement per input line, to ease debugging?
+true or false, default true.
+
+maxLoadedJsps - The maximum number of JSPs that will be
+loaded for a web application. If more than this number of JSPs are loaded, the
+least recently used JSPs will be unloaded so that the number of JSPs loaded at
+any one time does not exceed this limit. A value of zero or less indicates no
+limit. Default -1
+
+jspIdleTimeout - The amount of time in seconds a JSP can be
+idle before it is unloaded. A value of zero or less indicates never unload.
+Default -1
+
+modificationTestInterval - Causes a JSP (and its dependent
+files) to not be checked for modification during the specified time interval
+(in seconds) from the last time the JSP was checked for modification. A value of
+0 will cause the JSP to be checked on every access. Used in development mode
+only. Default is 4 seconds.
+
+recompileOnFail - If a JSP compilation fails should the
+modificationTestInterval be ignored and the next access trigger a re-compilation
+attempt? Used in development mode only and is disabled by default as compilation
+may be expensive and could lead to excessive resource usage.
+
+scratchdir - What scratch directory should we use when
+compiling JSP pages? Default is the work directory for the current web
+application. This option is ignored if running under a SecurityManager.
+
+suppressSmap - Should the generation of SMAP info for JSR45
+debugging be suppressed? true or false, default
+false.
+
+trimSpaces - Should template text that consists entirely of
+whitespace be removed from the output (true), replaced with a
+single space (single) or left unchanged (false)?
+Alternatively, the extended option will remove leading and trailing
+whitespace from template text and collapse sequences of whitespace and newlines
+within the template text to a single new line. Note that if a JSP page or tag
+file specifies a trimDirectiveWhitespaces value of
+true, that will take precedence over this configuration setting for
+that page/tag. Default false.
+
+xpoweredBy - Determines whether X-Powered-By response
+header is added by generated servlet. true or false,
+default false.
+
+strictQuoteEscaping - When scriptlet expressions are used
+for attribute values, should the rules in JSP.1.6 for the escaping of quote
+characters be strictly applied? true or false, default
+true.
+
+quoteAttributeEL - When EL is used in an attribute value
+on a JSP page, should the rules for quoting of attributes described in JSP.1.6
+be applied to the expression? true or false, default
+true.
+
+
+The Java compiler from Eclipse JDT in included as the default compiler. It is
+an advanced Java compiler which will load all dependencies from the Tomcat class
+loader, which will help tremendously when compiling on large installations with
+tens of JARs. On fast servers, this will allow sub-second recompilation cycles
+for even large JSP  pages.
+
+Apache Ant, which was used in previous Tomcat releases, can be used instead
+of the new compiler by configuring the compiler attribute as explained above.
+
+
+If you need to change the JSP Servlet settings for an application you can
+override the default configuration by re-defining the JSP Servlet in
+/WEB-INF/web.xml. However, this may cause problems if you attempt
+to deploy the application on another container as the JSP Servlet class may
+not be recognised. You can work-around this problem by using the Tomcat specific
+/WEB-INF/tomcat-web.xml deployment descriptor. The format is
+identical to /WEB-INF/web.xml. It will override any default
+settings but not those in /WEB-INF/web.xml. Since it is Tomcat
+specific, it will only be processed when the application is deployed on
+Tomcat.
+
+
Known issues

+
+As described in
+
+bug 39089, a known JVM issue,
+
+bug 6294277, may cause a
+java.lang.InternalError: name is too long to represent exception
+when compiling very large JSPs. If this is observed then it may be worked around
+by using one of the following:
+
+
+reduce the size of the JSP
+disable SMAP generation and JSR-045 support by setting
+suppressSmap to true.
+
+
+
Production Configuration

+
+The main JSP optimization which can be done is precompilation of JSPs.
+However, this might not be possible (for example, when using the
+jsp-property-group feature) or practical, in which case the configuration of the
+Jasper servlet becomes critical.
+
+When using Jasper 2 in a production Tomcat server you should consider making
+the following changes from the default configuration.
+
+development - To disable on access checks for JSP
+pages compilation set this to false.
+genStringAsCharArray - To generate slightly more efficient
+char arrays, set this to true.
+modificationTestInterval - If development has to be set to
+true for any reason (such as dynamic generation of JSPs), setting
+this to a high value will improve performance a lot.
+trimSpaces - To remove unnecessary bytes from the response,
+consider setting this to single or extended.
+
+
+
Web Application Compilation

+
+Using Ant is the preferred way to compile web applications using JSPC. Note
+that when pre-compiling JSPs, SMAP information will only be included in the
+final classes if suppressSmap is false and compile is true.
+Use the script given below (a similar script is included in the "deployer"
+download) to precompile a webapp:
+
+
+<project name="Webapp Precompilation" default="all" basedir=".">
+
+   <import file="${tomcat.home}/bin/catalina-tasks.xml"/>
+
+   <target name="jspc">
+
+    <jasper
+             validateXml="false"
+             uriroot="${webapp.path}"
+             webXmlInclude="${webapp.path}/WEB-INF/generated_web.xml"
+             outputDir="${webapp.path}/WEB-INF/src" />
+
+  </target>
+
+  <target name="compile">
+
+    <mkdir dir="${webapp.path}/WEB-INF/classes"/>
+    <mkdir dir="${webapp.path}/WEB-INF/lib"/>
+
+    <javac destdir="${webapp.path}/WEB-INF/classes"
+           debug="on" failonerror="false"
+           srcdir="${webapp.path}/WEB-INF/src"
+           excludes="**/*.smap">
+      <classpath>
+        <pathelement location="${webapp.path}/WEB-INF/classes"/>
+        <fileset dir="${webapp.path}/WEB-INF/lib">
+          <include name="*.jar"/>
+        </fileset>
+        <pathelement location="${tomcat.home}/lib"/>
+        <fileset dir="${tomcat.home}/lib">
+          <include name="*.jar"/>
+        </fileset>
+        <fileset dir="${tomcat.home}/bin">
+          <include name="*.jar"/>
+        </fileset>
+      </classpath>
+      <include name="**" />
+      <exclude name="tags/**" />
+    </javac>
+
+  </target>
+
+  <target name="all" depends="jspc,compile">
+  </target>
+
+  <target name="cleanup">
+    <delete>
+        <fileset dir="${webapp.path}/WEB-INF/src"/>
+        <fileset dir="${webapp.path}/WEB-INF/classes/org/apache/jsp"/>
+    </delete>
+  </target>
+
+</project>
+
+
+The following command line can be used to run the script
+(replacing the tokens with the Tomcat base path and the path to the webapp
+which should be precompiled):
+
+$ANT_HOME/bin/ant -Dtomcat.home=<$TOMCAT_HOME> -Dwebapp.path=<$WEBAPP_PATH>
+
+
+
+Then, the declarations and mappings for the servlets which were generated
+during the precompilation must be added to the web application deployment
+descriptor. Insert the ${webapp.path}/WEB-INF/generated_web.xml
+at the right place inside the ${webapp.path}/WEB-INF/web.xml file.
+Restart the web application (using the manager) and test it to verify it is
+running fine with precompiled servlets. An appropriate token placed in the
+web application deployment descriptor may also be used to automatically
+insert the generated servlet declarations and mappings using Ant filtering
+capabilities. This is actually how all the webapps distributed with Tomcat
+are automatically compiled as part of the build process.
+
+
+
+At the jasper task you can use the option addWebXmlMappings for
+automatic merge the ${webapp.path}/WEB-INF/generated_web.xml
+with the current web application deployment descriptor at
+${webapp.path}/WEB-INF/web.xml.
+
+
+
+When you want to use a specific version of Java for your JSP's, add the
+javac compiler task attributes source and target with
+appropriate values. For example, 16 to compile JSPs for Java 16.
+
+
+
+For production you may wish to disable debug info with
+debug="off".
+
+
+
+When you don't want to stop the JSP generation at first JSP syntax error, use
+failOnError="false" and with
+showSuccess="true" all successful JSP to Java
+generation are printed out. Sometimes it is very helpful, when you cleanup the
+generate java source files at ${webapp.path}/WEB-INF/src
+and the compile JSP servlet classes at
+${webapp.path}/WEB-INF/classes/org/apache/jsp.
+
+
+Hints:
+
+ When you switch to another Tomcat release, then regenerate and recompile
+your JSP's with the new Tomcat version.
+Use java system property at server runtime to disable PageContext pooling
+org.apache.jasper.runtime.JspFactoryImpl.USE_POOL=false.
+and limit the buffering with
+org.apache.jasper.runtime.BodyContentImpl.LIMIT_BUFFER=true. Note
+that changing from the defaults may affect performance, but it will vary
+depending on the application.
+
+
Optimisation

+
+There are a number of extension points provided within Jasper that enable the
+user to optimise the behaviour for their environment.
+
+
+
+The first of these extension points is the tag plug-in mechanism. This allows
+alternative implementations of tag handlers to be provided for a web application
+to use. Tag plug-ins are registered via a tagPlugins.xml file
+located under WEB-INF. A sample plug-in for the JSTL is included
+with Jasper.
+
+
+
+The second extension point is the Expression Language interpreter. Alternative
+interpreters may be configured through the ServletContext. See the
+ELInterpreterFactory javadoc for details of how to configure an
+alternative EL interpreter. A alternative interpreter primarily targeting tag
+settings is provided at
+org.apache.jasper.optimizations.ELInterpreterTagSetters. See the
+javadoc for details of the optimisations and the impact they have on
+specification compliance.
+
+
+
+An extension point is also provided for coercion of String values to Enums. It
+is provided at
+org.apache.jasper.optimizations.StringInterpreterEnum. See the
+javadoc for details of the optimisations and the impact they have on
+specification compliance.
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/jaspicapi/index.html b/apache-tomcat-9.0.109/webapps/docs/jaspicapi/index.html
new file mode 100644
index 0000000..dbebf69
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/jaspicapi/index.html
@@ -0,0 +1,34 @@
+
+
+
+
+    
+    API docs
+
+
+
+
+The JASPIC Javadoc is not installed by default. Download and install
+the "fulldocs" package to get it.
+
+You can also access the javadoc online in the Tomcat
+
+    documentation bundle.
+
+
+
diff --git a/apache-tomcat-9.0.109/webapps/docs/jdbc-pool.html b/apache-tomcat-9.0.109/webapps/docs/jdbc-pool.html
new file mode 100644
index 0000000..d423121
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/jdbc-pool.html
@@ -0,0 +1,896 @@
+
+Apache Tomcat 9 (9.0.109) - The Tomcat JDBC Connection Pool
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
The Tomcat JDBC Connection Pool
Table of Contents

+Introduction
How to useAdditional features
Inside the Apache Tomcat Container
Standalone
JMX
AttributesJNDI Factory and Type
System Properties
Common Attributes
Tomcat JDBC Enhanced Attributes
Advanced usageJDBC interceptors
Configuring JDBC interceptors
org.apache.tomcat.jdbc.pool.JdbcInterceptor
org.apache.tomcat.jdbc.pool.interceptor.ConnectionState
org.apache.tomcat.jdbc.pool.interceptor.StatementFinalizer
org.apache.tomcat.jdbc.pool.interceptor.StatementCache
org.apache.tomcat.jdbc.pool.interceptor.StatementDecoratorInterceptor
org.apache.tomcat.jdbc.pool.interceptor.QueryTimeoutInterceptor
org.apache.tomcat.jdbc.pool.interceptor.SlowQueryReport
org.apache.tomcat.jdbc.pool.interceptor.SlowQueryReportJmx
org.apache.tomcat.jdbc.pool.interceptor.ResetAbandonedTimer
Code ExamplePlain Ol' Java
As a Resource
Asynchronous Connection Retrieval
Interceptors
Getting the actual JDBC connection
BuildingBuilding from source
+
Introduction

+
+  The JDBC Connection Pool org.apache.tomcat.jdbc.pool
+  is a replacement or an alternative to the Apache Commons DBCP
+  connection pool.
+
+  So why do we need a new connection pool?
+
+  Here are a few of the reasons:
+    
+      Commons DBCP 1.x is single threaded. In order to be thread safe
+          Commons locks the entire pool for short periods during both object
+          allocation and object return. Note that this does not apply to
+          Commons DBCP 2.x.
+      Commons DBCP 1.x can be slow. As the number of logical CPUs grows and
+          the number of concurrent threads attempting to borrow or return
+          objects increases, the performance suffers. For highly concurrent
+          systems the impact can be significant. Note that this does not apply
+          to Commons DBCP 2.x.
+      Commons DBCP is over 60 classes. tomcat-jdbc-pool core is 8 classes,
+          hence modifications for future requirement will require much less
+          changes. This is all you need to run the connection pool itself, the
+          rest is gravy.
+      Commons DBCP uses static interfaces. This means you have to use the
+          right version for a given JRE version or you may see
+          NoSuchMethodException exceptions.
+      It's not worth rewriting over 60 classes, when a connection pool can
+          be accomplished with a much simpler implementation.
+      Tomcat jdbc pool implements the ability retrieve a connection
+          asynchronously, without adding additional threads to the library
+          itself.
+      Tomcat jdbc pool is a Tomcat module, it depends on Tomcat JULI, a
+          simplified logging framework used in Tomcat.
+      Retrieve the underlying connection using the
+          javax.sql.PooledConnection interface.
+      Starvation proof. If a pool is empty, and threads are waiting for a
+          connection, when a connection is returned, the pool will awake the
+          correct thread waiting. Most pools will simply starve.
+    
+
+  Features added over other connection pool implementations
+    
+      Support for highly concurrent environments and multi core/cpu systems.
+      Dynamic implementation of interface, will support java.sql and javax.sql interfaces for
+          your runtime environment (as long as your JDBC driver does the same), even when compiled with a lower version of the JDK.
+      Validation intervals - we don't have to validate every single time we use the connection, we can do this
+          when we borrow or return the connection, just not more frequent than an interval we can configure.
+      Run-Once query, a configurable query that will be run only once, when the connection to the database is established.
+          Very useful to setup session settings, that you want to exist during the entire time the connection is established.
+      Ability to configure custom interceptors.
+          This allows you to write custom interceptors to enhance the functionality. You can use interceptors to gather query stats,
+          cache session states, reconnect the connection upon failures, retry queries, cache query results, and so on.
+          Your options are endless and the interceptors are dynamic, not tied to a JDK version of a
+          java.sql/javax.sql interface.
+      High performance - we will show some differences in performance later on
+      Extremely simple, due to the very simplified implementation, the line count and source file count are very low, compare with c3p0
+          that has over 200 source files(last time we checked), Tomcat jdbc has a core of 8 files, the connection pool itself is about half
+          that. As bugs may occur, they will be faster to track down, and easier to fix. Complexity reduction has been a focus from inception.
+      Asynchronous connection retrieval - you can queue your request for a connection and receive a Future<Connection> back.
+      Better idle connection handling. Instead of closing connections directly, it can still pool connections and sizes the idle pool with a smarter algorithm.
+      You can decide at what moment connections are considered abandoned, is it when the pool is full, or directly at a timeout
+          by specifying a pool usage threshold.
+      
+      The abandon connection timer will reset upon a statement/query activity. Allowing a connections that is in use for a long time to not timeout.
+          This is achieved using the ResetAbandonedTimer
+      
+      Close connections after they have been connected for a certain time. Age based close upon return to the pool.
+      
+      Get JMX notifications and log entries when connections are suspected for being abandoned. This is similar to
+          the removeAbandonedTimeout but it doesn't take any action, only reports the information.
+          This is achieved using the suspectTimeout attribute.
+      Connections can be retrieved from a java.sql.Driver, javax.sql.DataSource or javax.sql.XADataSource
+          This is achieved using the dataSource and dataSourceJNDI attributes.
+      XA connection support
+    
+
+
+
How to use

+  
+    Usage of the Tomcat connection pool has been made to be as simple as possible, for those of you that are familiar with commons-dbcp, the
+    transition will be very simple. Moving from other connection pools is also fairly straight forward.
+  
+  Additional features

+    The Tomcat connection pool offers a few additional features over what most other pools let you do:
+    
+      initSQL - the ability to run an SQL statement exactly once, when the connection is created
+      validationInterval - in addition to running validations on connections, avoid running them too frequently.
+      jdbcInterceptors - flexible and pluggable interceptors to create any customizations around the pool,
+          the query execution and the result set handling. More on this in the advanced section.
+      fairQueue - Set the fair flag to true to achieve thread fairness or to use asynchronous connection retrieval
+    
+  
+  Inside the Apache Tomcat Container

+    
+      The Tomcat Connection pool is configured as a resource described in The Tomcat JDBC documentation
+      With the only difference being that you have to specify the factory attribute and set the value to
+      org.apache.tomcat.jdbc.pool.DataSourceFactory
+    
+  
+  Standalone

+    
+      The connection pool only has another dependency, and that is on tomcat-juli.jar.
+      To configure the pool in a stand alone project using bean instantiation, the bean to instantiate is
+      org.apache.tomcat.jdbc.pool.DataSource. The same attributes (documented below) as you use to configure a connection
+      pool as a JNDI resource, are used to configure a data source as a bean.
+    
+  
+  JMX

+    
+      The connection pool object exposes an MBean that can be registered.
+      In order for the connection pool object to create the MBean, the flag jmxEnabled has to be set to true.
+      This doesn't imply that the pool will be registered with an MBean server, merely that the MBean is created.
+      In a container like Tomcat, Tomcat itself registers the DataSource with the MBean server, the
+      org.apache.tomcat.jdbc.pool.DataSource object will then register the actual
+      connection pool MBean.
+      If you're running outside of a container, you can register the DataSource yourself under any object name you specify,
+      and it propagates the registration to the underlying pool. To do this you would call mBeanServer.registerMBean(dataSource.getPool().getJmxPool(),objectname).
+      Prior to this call, ensure that the pool has been created by calling dataSource.createPool().
+    
+  
+
+
Attributes

+  To provide a very simple switch to and from commons-dbcp and tomcat-jdbc-pool,
+     Most attributes are the same and have the same meaning.
+  JNDI Factory and Type

+    
+          Attribute
+        
+          Description
+        
factory 
+        factory is required, and the value should be org.apache.tomcat.jdbc.pool.DataSourceFactory
+      
type 
+        Type should always be javax.sql.DataSource or javax.sql.XADataSource
+        Depending on the type a org.apache.tomcat.jdbc.pool.DataSource or a org.apache.tomcat.jdbc.pool.XADataSource will be created.
+      
+  
+
+  System Properties

+    System properties are JVM wide, affect all pools created in the JVM
+    
+          Attribute
+        
+          Description
+        
org.apache.tomcat.jdbc.pool.onlyAttemptCurrentClassLoader 
+        (boolean) Controls classloading of dynamic classes, such as
+           JDBC drivers, interceptors and validators. If set to
+           false, default value, the pool will first attempt
+           to load using the current loader (i.e. the class loader that
+           loaded the pool classes) and if class loading fails attempt to
+           load using the thread context loader. Set this value to
+           true, if you wish to remain backwards compatible
+           with Apache Tomcat 8.0.8 and earlier, and only attempt the
+           current loader.
+           If not set then the default value is false.
+        
+      
+  
+
+  Common Attributes

+  These attributes are shared between commons-dbcp and tomcat-jdbc-pool, in some cases default values are different.
+  
+          Attribute
+        
+          Description
+        
defaultAutoCommit 
+      (boolean) The default auto-commit state of connections created by this pool. If not set, default is JDBC driver default (If not set then the setAutoCommit method will not be called.)
+    
defaultReadOnly 
+      (boolean) The default read-only state of connections created by this pool. If not set then the setReadOnly method will not be called. (Some drivers don't support read only mode, ex: Informix)
+    
defaultTransactionIsolation 
+      (String) The default TransactionIsolation state of connections created by this pool. One of the following: (see javadoc )
+         
+           NONE
+           READ_COMMITTED
+           READ_UNCOMMITTED
+           REPEATABLE_READ
+           SERIALIZABLE
+         
+         If not set, the method will not be called and it defaults to the JDBC driver.
+    
defaultCatalog 
+      (String) The default catalog of connections created by this pool.
+    
driverClassName 
+      (String) The fully qualified Java class name of the JDBC driver to be used. The driver has to be accessible
+         from the same classloader as tomcat-jdbc.jar
+      
+    
username 
+      (String) The connection username to be passed to our JDBC driver to establish a connection.
+         Note that method DataSource.getConnection(username,password)
+         by default will not use credentials passed into the method,
+         but will use the ones configured here. See alternateUsernameAllowed
+         property for more details.
+      
+    
password 
+      (String) The connection password to be passed to our JDBC driver to establish a connection.
+         Note that method DataSource.getConnection(username,password)
+         by default will not use credentials passed into the method,
+         but will use the ones configured here. See alternateUsernameAllowed
+         property for more details.
+      
+    
maxActive 
+      (int) The maximum number of active connections that can be allocated from this pool at the same time.
+         The default value is 100
+    
maxIdle 
+      (int) The maximum number of connections that should be kept in the pool at all times.
+         Default value is  maxActive:100
+         Idle connections are checked periodically (if enabled) and
+         connections that been idle for longer than minEvictableIdleTimeMillis
+         will be released. (also see testWhileIdle)
+    
minIdle 
+      
+        (int) The minimum number of established connections that should be kept in the pool at all times.
+        The connection pool can shrink below this number if validation queries fail.
+        Default value is derived from initialSize:10 (also see testWhileIdle)
+      
+    
initialSize 
+      (int)The initial number of connections that are created when the pool is started.
+         Default value is 10
+    
maxWait 
+      (int) The maximum number of milliseconds that the pool will wait (when there are no available connections)
+         for a connection to be returned before throwing an exception.
+         Default value is 30000 (30 seconds)
+    
testOnBorrow 
+      (boolean) The indication of whether objects will be validated before being borrowed from the pool.
+         If the object fails to validate, it will be dropped from the pool, and we will attempt to borrow another.
+         In order to have a more efficient validation, see validationInterval.
+         Default value is false
+      
+    
testOnConnect 
+      (boolean) The indication of whether objects will be validated when a connection is first created.
+         If an object fails to validate, it will be throw SQLException.
+         Default value is false
+      
+    
testOnReturn 
+      (boolean) The indication of whether objects will be validated before being returned to the pool.
+         The default value is false.
+      
+    
testWhileIdle 
+      (boolean) The indication of whether objects will be validated by the idle object evictor (if any).
+         If an object fails to validate, it will be dropped from the pool.
+         The default value is false and this property has to be set in order for the
+         pool cleaner/test thread is to run (also see timeBetweenEvictionRunsMillis)
+      
+    
validationQuery 
+      (String) The SQL query that will be used to validate connections from this pool before returning them to the caller.
+         If specified, this query does not have to return any data, it just can't throw a SQLException.
+         The default value is null.
+         If not specified, connections will be validation by the isValid() method.
+         Example values are SELECT 1(mysql), select 1 from dual(oracle), SELECT 1(MS Sql Server)
+      
+    
validationQueryTimeout 
+      (int) The timeout in seconds before a connection validation queries fail.  This works by calling
+         java.sql.Statement.setQueryTimeout(seconds) on the statement that executes the validationQuery.
+         The pool itself doesn't timeout the query, it is still up to the JDBC driver to enforce query timeouts.
+         A value less than or equal to zero will disable this feature.
+         The default value is -1.
+      
+    
validatorClassName 
+      (String) The name of a class which implements the
+         org.apache.tomcat.jdbc.pool.Validator interface and
+         provides a no-arg constructor (may be implicit). If specified, the
+         class will be used to create a Validator instance which is then used
+         instead of any validation query to validate connections. The default
+         value is null. An example value is
+         com.mycompany.project.SimpleValidator.
+      
+    
timeBetweenEvictionRunsMillis 
+      (int) The number of milliseconds to sleep between runs of the idle connection validation/cleaner thread.
+         This value should not be set under 1 second. It dictates how often we check for idle, abandoned connections, and how often
+         we validate idle connections. This value will be overridden by maxAge if the latter is non-zero and lower.
+         The default value is 5000 (5 seconds). 

+      
+    
numTestsPerEvictionRun 
+      (int) Property not used in tomcat-jdbc-pool.
+    
minEvictableIdleTimeMillis 
+      (int) The minimum amount of time an object may sit idle in the pool before it is eligible for eviction.
+         The default value is 60000 (60 seconds).
+    
accessToUnderlyingConnectionAllowed 
+      (boolean) Property not used. Access can be achieved by calling unwrap on the pooled connection.
+         see javax.sql.DataSource interface, or call getConnection through reflection or
+         cast the object as javax.sql.PooledConnection
+    
removeAbandoned 
+      (boolean) Flag to remove abandoned connections if they exceed the removeAbandonedTimeout.
+         If set to true a connection is considered abandoned and eligible for removal if it has been in use
+         longer than the removeAbandonedTimeout Setting this to true can recover db connections from
+         applications that fail to close a connection. See also logAbandoned
+         The default value is false.
+    
removeAbandonedTimeout 
+      (int) Timeout in seconds before an abandoned(in use) connection can be removed.
+         The default value is 60 (60 seconds). The value should be set to the longest running query your applications
+         might have.
+    
logAbandoned 
+      (boolean) Flag to log stack traces for application code which abandoned a Connection.
+         Logging of abandoned Connections adds overhead for every Connection borrow because a stack trace has to be generated.
+         The default value is false.
+    
connectionProperties 
+      (String) The connection properties that will be sent to our JDBC driver when establishing new connections.
+         Format of the string must be [propertyName=property;]*
+         NOTE - The "user" and "password" properties will be passed explicitly, so they do not need to be included here.
+         The default value is null.
+    
poolPreparedStatements 
+      (boolean) Property not used.
+    
maxOpenPreparedStatements 
+      (int) Property not used.
+    
+
+  
+
+  Tomcat JDBC Enhanced Attributes

+
+  
+          Attribute
+        
+          Description
+        
initSQL 
+      (String) A custom query to be run when a connection is first created.
+         The default value is null.
+    
jdbcInterceptors 
+      (String) A semicolon separated list of classnames extending
+         org.apache.tomcat.jdbc.pool.JdbcInterceptor class.
+         See Configuring JDBC interceptors
+         below for more detailed description of syntax and examples.
+      
+      
+         These interceptors will be inserted as an interceptor into the chain
+         of operations on a java.sql.Connection object.
+         The default value is null.
+      
+      
+         Predefined interceptors:

+         org.apache.tomcat.jdbc.pool.interceptor.
ConnectionState
+          - keeps track of auto commit, read only, catalog and transaction isolation level.

+         org.apache.tomcat.jdbc.pool.interceptor.
StatementFinalizer
+          - keeps track of opened statements, and closes them when the connection is returned to the pool.
+      
+      
+         More predefined interceptors are described in detail in the
+         JDBC Interceptors section.
+      
+    
validationInterval 
+      (long) avoid excess validation, only run validation at most at this frequency - time in milliseconds.
+         If a connection is due for validation, but has been validated previously within this interval, it will not be validated again.
+         The default value is 3000 (3 seconds).
+    
jmxEnabled 
+      (boolean) Register the pool with JMX or not.
+         The default value is true.
+    
fairQueue 
+      (boolean) Set to true if you wish that calls to getConnection should be treated
+         fairly in a true FIFO fashion. This uses the org.apache.tomcat.jdbc.pool.FairBlockingQueue
+         implementation for the list of the idle connections. The default value is true.
+         This flag is required when you want to use asynchronous connection retrieval.

+         Setting this flag ensures that threads receive connections in the order they arrive.

+         During performance tests, there is a very large difference in how locks
+         and lock waiting is implemented. When fairQueue=true
+         there is a decision making process based on what operating system the system is running.
+         If the system is running on Linux (property os.name=Linux.
+         To disable this Linux specific behavior and still use the fair queue, simply add the property
+         org.apache.tomcat.jdbc.pool.FairBlockingQueue.ignoreOS=true to your system properties
+         before the connection pool classes are loaded.
+      
+    
abandonWhenPercentageFull 
+      (int) Connections that have been abandoned (timed out) won't get closed and reported up unless
+         the number of connections in use are above the percentage defined by abandonWhenPercentageFull.
+         The value should be between 0-100.
+         The default value is 0, which implies that connections are eligible for closure as soon
+         as removeAbandonedTimeout has been reached.
+    
maxAge 
+      (long) Time in milliseconds to keep a connection before recreating it.
+         When a connection is borrowed from the pool, the pool will check to see
+         if the now - time-when-connected > maxAge has been reached
+         , and if so, it reconnects before borrow it. When a connection is
+         returned to the pool, the pool will check to see if the
+         now - time-when-connected > maxAge has been reached, and
+         if so, it tries to reconnect.
+         When a connection is idle and timeBetweenEvictionRunsMillis is
+         greater than zero, the pool will periodically check to see if the
+         now - time-when-connected > maxAge has been reached, and
+         if so, it tries to reconnect.
+         Setting maxAge to a value lower than timeBetweenEvictionRunsMillis
+         will override it (so idle connection validation/cleaning will run more frequently).
+         The default value is 0, which implies that connections
+         will be left open and no age check will be done upon borrowing from the
+         pool, returning the connection to the pool or when checking idle connections.
+    
useEquals 
+      (boolean) Set to true if you wish the ProxyConnection class to use String.equals and set to false
+         when you wish to use == when comparing method names. This property does not apply to added interceptors as those are configured individually.
+         The default value is true.
+      
+    
suspectTimeout 
+      (int) Timeout value in seconds. Default value is 0.

+           Similar to to the removeAbandonedTimeout value but instead of treating the connection
+           as abandoned, and potentially closing the connection, this simply logs the warning if
+           logAbandoned is set to true. If this value is equal or less than 0, no suspect
+           checking will be performed. Suspect checking only takes place if the timeout value is larger than 0 and
+           the connection was not abandoned or if abandon check is disabled. If a connection is suspect a WARN message gets
+           logged and a JMX notification gets sent once.
+      
+    
rollbackOnReturn 
+      (boolean) If autoCommit==false then the pool can terminate the transaction by calling rollback on the connection as it is returned to the pool
+          Default value is false.

+      
+    
commitOnReturn 
+      (boolean) If autoCommit==false then the pool can complete the transaction by calling commit on the connection as it is returned to the pool
+          If rollbackOnReturn==true then this attribute is ignored.
+          Default value is false.

+      
+    
alternateUsernameAllowed 
+      (boolean) By default, the jdbc-pool will ignore the
+         DataSource.getConnection(username,password)
+         call, and simply return a previously pooled connection under the globally configured properties username and password, for performance reasons.
+      
+      
+         The pool can however be configured to allow use of different credentials
+         each time a connection is requested.  To enable the functionality described in the
+         DataSource.getConnection(username,password)
+         call, simply set the property alternateUsernameAllowed
+         to true.

+         Should you request a connection with the credentials user1/password1 and the connection
+         was previously connected using different user2/password2, the connection will be closed,
+         and reopened with the requested credentials. This way, the pool size is still managed
+         on a global level, and not on a per schema level. 

+         The default value is false.

+         This property was added as an enhancement to bug 50025.
+      
+    
dataSource 
+      (javax.sql.DataSource) Inject a data source to the connection pool, and the pool will use the data source to retrieve connections instead of establishing them using the java.sql.Driver interface.
+         This is useful when you wish to pool XA connections or connections established using a data source instead of a connection string. Default value is null
+      
+    
dataSourceJNDI 
+      (String) The JNDI name for a data source to be looked up in JNDI and then used to establish connections to the database. See the dataSource attribute. Default value is null
+      
+    
useDisposableConnectionFacade 
+      (boolean) Set this to true if you wish to put a facade on your connection so that it cannot be reused after it has been closed. This prevents a thread holding on to a
+                   reference of a connection it has already called closed on, to execute queries on it. Default value is true.
+      
+    
logValidationErrors 
+      (boolean) Set this to true to log errors during the validation phase to the log file. If set to true, errors will be logged as SEVERE. Default value is false for backwards compatibility.
+      
+    
propagateInterruptState 
+      (boolean) Set this to true to propagate the interrupt state for a thread that has been interrupted (not clearing the interrupt state). Default value is false for backwards compatibility.
+      
+    
ignoreExceptionOnPreLoad 
+      (boolean) Flag whether ignore error of connection creation while initializing the pool.
+         Set to true if you want to ignore error of connection creation while initializing the pool.
+         Set to false if you want to fail the initialization of the pool by throwing exception.
+         The default value is false.
+      
+    
useStatementFacade 
+      (boolean) Set this to true if you wish to wrap statements in order to
+         enable equals() and hashCode() methods to be
+         called on the closed statements if any statement proxy is set.
+         Default value is true.
+      
+    
+  
+
Advanced usage

+  JDBC interceptors

+    To see an example of how to use an interceptor, take a look at
+    org.apache.tomcat.jdbc.pool.interceptor.ConnectionState.
+    This simple interceptor is a cache of three attributes, transaction isolation level, auto commit and read only state,
+    in order for the system to avoid not needed roundtrips to the database.
+    
+    Further interceptors will be added to the core of the pool as the need arises. Contributions are always welcome!
+    Interceptors are of course not limited to just java.sql.Connection but can be used to wrap any
+    of the results from a method invocation as well. You could build query performance analyzer that provides JMX notifications when a
+    query is running longer than the expected time.
+  
+  Configuring JDBC interceptors

+    Configuring JDBC interceptors is done using the jdbcInterceptors property.
+    The property contains a list of semicolon separated class names. If the
+    classname is not fully qualified it will be prefixed with the
+    org.apache.tomcat.jdbc.pool.interceptor. prefix.
+    
+    Example:

+      
+      jdbcInterceptors="org.apache.tomcat.jdbc.pool.interceptor.ConnectionState;
+        org.apache.tomcat.jdbc.pool.interceptor.StatementFinalizer"
+      
+      

+      is the same as
+      

+       jdbcInterceptors="ConnectionState;StatementFinalizer"
+    
+    
+    Interceptors can have properties as well. Properties for an interceptor
+    are specified within parentheses after the class name. Several properties
+    are separated by commas.
+    
+    Example:

+    
+      jdbcInterceptors="ConnectionState;StatementFinalizer(useEquals=true)"
+    
+    
+    
+    Extra whitespace characters around class names, property names and values
+    are ignored.
+    
+  
+  org.apache.tomcat.jdbc.pool.JdbcInterceptor

+    Abstract base class for all interceptors, cannot be instantiated.
+    
+          Attribute
+        
+          Description
+        
useEquals 
+        (boolean) Set to true if you wish the ProxyConnection class to use String.equals and set to false
+         when you wish to use == when comparing method names.
+         The default value is true.
+        
+      
+  
+  org.apache.tomcat.jdbc.pool.interceptor.ConnectionState

+    Caches the connection for the following attributes autoCommit, readOnly,
+       transactionIsolation and catalog.
+       It is a performance enhancement to avoid roundtrip to the database when getters are called or setters are called with an already set value.
+    
+    
+          Attribute
+        
+          Description
+        
+  
+  org.apache.tomcat.jdbc.pool.interceptor.StatementFinalizer

+    Keeps track of all statements created using createStatement, prepareStatement or prepareCall
+       and closes these statements when the connection is returned to the pool.
+    
+    
+          Attribute
+        
+          Description
+        
trace 
+        (boolean as String) Enable tracing of unclosed statements.
+           When enabled and a connection is closed, and statements are not closed,
+           the interceptor will log all stack traces.
+           The default value is false.
+        
+      
+  
+  org.apache.tomcat.jdbc.pool.interceptor.StatementCache

+    Caches PreparedStatement and/or CallableStatement
+       instances on a connection.
+    
+    The statements are cached per connection.
+       The count limit is counted globally for all connections that belong to
+       the same pool. Once the count reaches max, subsequent
+       statements are not returned to the cache and are closed immediately.
+    
+    
+          Attribute
+        
+          Description
+        
prepared 
+        (boolean as String) Enable caching of PreparedStatement
+           instances created using prepareStatement calls.
+           The default value is true.
+        
+      
callable 
+        (boolean as String) Enable caching of CallableStatement
+           instances created using prepareCall calls.
+           The default value is false.
+        
+      
max 
+        (int as String) Limit on the count of cached statements across
+           the connection pool.
+           The default value is 50.
+        
+      
+  
+  org.apache.tomcat.jdbc.pool.interceptor.StatementDecoratorInterceptor

+    See 48392. Interceptor to wrap statements and result sets in order to prevent access to the actual connection
+       using the methods ResultSet.getStatement().getConnection() and Statement.getConnection()
+    
+    
+          Attribute
+        
+          Description
+        
+  
+  org.apache.tomcat.jdbc.pool.interceptor.QueryTimeoutInterceptor

+    Automatically calls java.sql.Statement.setQueryTimeout(seconds) when a new statement is created.
+       The pool itself doesn't timeout the query, it is still up to the JDBC driver to enforce query timeouts.
+    
+    
+          Attribute
+        
+          Description
+        
queryTimeout 
+        (int as String) The number of seconds to set for the query timeout.
+           A value less than or equal to zero will disable this feature.
+           The default value is 1 seconds.
+        
+      
+  
+  org.apache.tomcat.jdbc.pool.interceptor.SlowQueryReport

+    Keeps track of query performance and issues log entries when queries exceed a time threshold of fail.
+       The log level used is WARN
+    
+    
+          Attribute
+        
+          Description
+        
threshold 
+        (int as String) The number of milliseconds a query has to exceed before issuing a log alert.
+           The default value is 1000 milliseconds.
+        
+      
maxQueries 
+        (int as String) The maximum number of queries to keep track of in order to preserve memory space.
+           A value less than or equal to 0 will disable this feature.
+           The default value is 1000.
+        
+      
logSlow 
+        (boolean as String) Set to true if you wish to log slow queries.
+            The default value is true.
+        
+      
logFailed 
+        (boolean as String) Set to true if you wish to log failed queries.
+            The default value is false.
+        
+      
+  
+  org.apache.tomcat.jdbc.pool.interceptor.SlowQueryReportJmx

+    Extends the SlowQueryReport and in addition to log entries it issues JMX notification
+       for monitoring tools to react to. Inherits all the attributes from its parent class.
+       This class uses Tomcat's JMX engine so it won't work outside of the Tomcat container.
+       By default, JMX notifications are sent through the ConnectionPool mbean if it is enabled.
+       The SlowQueryReportJmx can also register an MBean if notifyPool=false
+    
+    
+          Attribute
+        
+          Description
+        
notifyPool 
+        (boolean as String) Set to false if you want JMX notifications to go to the SlowQueryReportJmx MBean
+           The default value is true.
+        
+      
objectName 
+        (String) Define a valid javax.management.ObjectName string that will be used to register this object with the platform mbean server
+           The default value is null and the object will be registered using
+           tomcat.jdbc:type=org.apache.tomcat.jdbc.pool.interceptor.SlowQueryReportJmx,name=the-name-of-the-pool
+        
+      
+  
+  org.apache.tomcat.jdbc.pool.interceptor.ResetAbandonedTimer

+    
+        The abandoned timer starts when a connection is checked out from the pool.
+        This means if you have a 30second timeout and run 10x10second queries using the connection
+        it will be marked abandoned and potentially reclaimed depending on the abandonWhenPercentageFull
+        attribute.
+        Using this interceptor it will reset the checkout timer every time you perform an operation on the connection or execute a
+        query successfully.
+    
+    
+          Attribute
+        
+          Description
+        
+  
+
Code Example

+  Other examples of Tomcat configuration for JDBC usage can be found in the Tomcat documentation. 
+  Plain Ol' Java

+    Here is a simple example of how to create and use a data source.
+  import java.sql.Connection;
+  import java.sql.ResultSet;
+  import java.sql.Statement;
+
+  import org.apache.tomcat.jdbc.pool.DataSource;
+  import org.apache.tomcat.jdbc.pool.PoolProperties;
+
+  public class SimplePOJOExample {
+
+      public static void main(String[] args) throws Exception {
+          PoolProperties p = new PoolProperties();
+          p.setUrl("jdbc:mysql://localhost:3306/mysql");
+          p.setDriverClassName("com.mysql.jdbc.Driver");
+          p.setUsername("root");
+          p.setPassword("password");
+          p.setJmxEnabled(true);
+          p.setTestWhileIdle(false);
+          p.setTestOnBorrow(true);
+          p.setValidationQuery("SELECT 1");
+          p.setTestOnReturn(false);
+          p.setValidationInterval(30000);
+          p.setTimeBetweenEvictionRunsMillis(30000);
+          p.setMaxActive(100);
+          p.setInitialSize(10);
+          p.setMaxWait(10000);
+          p.setRemoveAbandonedTimeout(60);
+          p.setMinEvictableIdleTimeMillis(30000);
+          p.setMinIdle(10);
+          p.setLogAbandoned(true);
+          p.setRemoveAbandoned(true);
+          p.setJdbcInterceptors(
+            "org.apache.tomcat.jdbc.pool.interceptor.ConnectionState;"+
+            "org.apache.tomcat.jdbc.pool.interceptor.StatementFinalizer");
+          DataSource datasource = new DataSource();
+          datasource.setPoolProperties(p);
+
+          Connection con = null;
+          try {
+            con = datasource.getConnection();
+            Statement st = con.createStatement();
+            ResultSet rs = st.executeQuery("select * from user");
+            int cnt = 1;
+            while (rs.next()) {
+                System.out.println((cnt++)+". Host:" +rs.getString("Host")+
+                  " User:"+rs.getString("User")+" Password:"+rs.getString("Password"));
+            }
+            rs.close();
+            st.close();
+          } finally {
+            if (con!=null) try {con.close();}catch (Exception ignore) {}
+          }
+      }
+
+  }
+  
+  As a Resource

+    And here is an example on how to configure a resource for JNDI lookups
+<Resource name="jdbc/TestDB"
+          auth="Container"
+          type="javax.sql.DataSource"
+          factory="org.apache.tomcat.jdbc.pool.DataSourceFactory"
+          testWhileIdle="true"
+          testOnBorrow="true"
+          testOnReturn="false"
+          validationQuery="SELECT 1"
+          validationInterval="30000"
+          timeBetweenEvictionRunsMillis="30000"
+          maxActive="100"
+          minIdle="10"
+          maxWait="10000"
+          initialSize="10"
+          removeAbandonedTimeout="60"
+          removeAbandoned="true"
+          logAbandoned="true"
+          minEvictableIdleTimeMillis="30000"
+          jmxEnabled="true"
+          jdbcInterceptors="org.apache.tomcat.jdbc.pool.interceptor.ConnectionState;
+            org.apache.tomcat.jdbc.pool.interceptor.StatementFinalizer"
+          username="root"
+          password="password"
+          driverClassName="com.mysql.jdbc.Driver"
+          url="jdbc:mysql://localhost:3306/mysql"/>
+
+  
+  Asynchronous Connection Retrieval

+     The Tomcat JDBC connection pool supports asynchronous connection retrieval without adding additional threads to the
+        pool library. It does this by adding a method to the data source called Future<Connection> getConnectionAsync().
+        In order to use the async retrieval, two conditions must be met:
+    
+        
+          You must configure the fairQueue property to be true.
+          You will have to cast the data source to org.apache.tomcat.jdbc.pool.DataSource
+        
+        An example of using the async feature is show below.
+  Connection con = null;
+  try {
+    Future<Connection> future = datasource.getConnectionAsync();
+    while (!future.isDone()) {
+      System.out.println("Connection is not yet available. Do some background work");
+      try {
+        Thread.sleep(100); //simulate work
+      }catch (InterruptedException x) {
+        Thread.currentThread().interrupt();
+      }
+    }
+    con = future.get(); //should return instantly
+    Statement st = con.createStatement();
+    ResultSet rs = st.executeQuery("select * from user");
+
+  
+  Interceptors

+    Interceptors are a powerful way to enable, disable or modify functionality on a specific connection or its sub components.
+       There are many different use cases for when interceptors are useful. By default, and for performance reasons, the connection pool is stateless.
+       The only state the pool itself inserts are defaultAutoCommit, defaultReadOnly, defaultTransactionIsolation, defaultCatalog if
+       these are set. These 4 properties are only set upon connection creation. Should these properties be modified during the usage of the connection,
+       the pool itself will not reset them.
+    An interceptor has to extend the org.apache.tomcat.jdbc.pool.JdbcInterceptor class. This class is fairly simple,
+       You will need to have a no arg constructor
+  public JdbcInterceptor() {
+  }
+    
+       When a connection is borrowed from the pool, the interceptor can initialize or in some other way react to the event by implementing the
+    
+  public abstract void reset(ConnectionPool parent, PooledConnection con);
+    
+       method. This method gets called with two parameters, a reference to the connection pool itself ConnectionPool parent
+       and a reference to the underlying connection PooledConnection con.
+    
+    
+       When a method on the java.sql.Connection object is invoked, it will cause the
+    
+  public Object invoke(Object proxy, Method method, Object[] args) throws Throwable
+    
+       method to get invoked. The Method method is the actual method invoked, and Object[] args are the arguments.
+       To look at a very simple example, where we demonstrate how to make the invocation to java.sql.Connection.close() a noop
+       if the connection has been closed
+    
+  if (CLOSE_VAL==method.getName()) {
+      if (isClosed()) return null; //noop for already closed.
+  }
+  return super.invoke(proxy,method,args);
+    
+        There is an observation being made. It is the comparison of the method name. One way to do this would be to do
+        "close".equals(method.getName()).
+        Above we see a direct reference comparison between the method name and static final String reference.
+        According to the JVM spec, method names and static final String end up in a shared constant pool, so the reference comparison should work.
+        One could of course do this as well:
+    
+  if (compare(CLOSE_VAL,method)) {
+      if (isClosed()) return null; //noop for already closed.
+  }
+  return super.invoke(proxy,method,args);
+    
+        The compare(String,Method) will use the useEquals flag on an interceptor and do either reference comparison or
+        a string value comparison when the useEquals=true flag is set.
+    
+    Pool start/stop

+       When the connection pool is started or closed, you can be notified. You will only be notified once per interceptor class
+       even though it is an instance method. and you will be notified using an interceptor currently not attached to a pool.
+    
+  public void poolStarted(ConnectionPool pool) {
+  }
+
+  public void poolClosed(ConnectionPool pool) {
+  }
+    
+       When overriding these methods, don't forget to call super if you are extending a class other than JdbcInterceptor
+    
+    Configuring interceptors

+       Interceptors are configured using the jdbcInterceptors property or the setJdbcInterceptors method.
+       An interceptor can have properties, and would be configured like this
+    
+  String jdbcInterceptors=
+    "org.apache.tomcat.jdbc.pool.interceptor.ConnectionState(useEquals=true,fast=yes)"
+
+    Interceptor properties

+       Since interceptors can have properties, you need to be able to read the values of these properties within your
+       interceptor. Taking an example like the one above, you can override the setProperties method.
+    
+  public void setProperties(Map<String, InterceptorProperty> properties) {
+     super.setProperties(properties);
+     final String myprop = "myprop";
+     InterceptorProperty p1 = properties.get(myprop);
+     if (p1!=null) {
+         setMyprop(Long.parseLong(p1.getValue()));
+     }
+  }
+
+  
+  Getting the actual JDBC connection

+    Connection pools create wrappers around the actual connection in order to properly pool them.
+       We also create interceptors in these wrappers to be able to perform certain functions.
+       If there is a need to retrieve the actual connection, one can do so using the javax.sql.PooledConnection
+       interface.
+    
+  Connection con = datasource.getConnection();
+  Connection actual = ((javax.sql.PooledConnection)con).getConnection();
+
+  
+
+
Building

+  We build the JDBC pool code with 1.6, but it is backwards compatible down to 1.5 for runtime environment. For unit test, we use 1.6 and higher
+  Other examples of Tomcat configuration for JDBC usage can be found in the Tomcat documentation. 
+  Building from source

+    Building is pretty simple. The pool has a dependency on tomcat-juli.jar and in case you want the SlowQueryReportJmx
+  javac -classpath tomcat-juli.jar \
+        -d . \
+        org/apache/tomcat/jdbc/pool/*.java \
+        org/apache/tomcat/jdbc/pool/interceptor/*.java \
+        org/apache/tomcat/jdbc/pool/jmx/*.java
+    
+       A build file can be found in the Tomcat source repository.
+    
+    
+      As a convenience, a build file is also included where a simple build command will generate all files needed.
+    
+  ant download  (downloads dependencies)
+  ant build     (compiles and generates .jar files)
+  ant dist      (creates a release package)
+  ant test      (runs tests, expects a test database to be setup)
+
+    
+      The system is structured for a Maven build, but does generate release artifacts. Just the library itself.
+    
+  
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/jndi-datasource-examples-howto.html b/apache-tomcat-9.0.109/webapps/docs/jndi-datasource-examples-howto.html
new file mode 100644
index 0000000..6e5ee33
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/jndi-datasource-examples-howto.html
@@ -0,0 +1,641 @@
+
+Apache Tomcat 9 (9.0.109) - JNDI Datasource How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
JNDI Datasource How-To
Table of Contents

+Introduction
DriverManager, the service provider mechanism and memory leaks
Database Connection Pool (DBCP 2) ConfigurationsInstallation
Preventing database connection pool leaks
MySQL DBCP 2 Example
Oracle 8i, 9i & 10g
PostgreSQL
Non-DBCP Solutions
Oracle 8i with OCI clientIntroduction
Putting it all together
Common ProblemsIntermittent Database Connection Failures
Random Connection Closed Exceptions
Context versus GlobalNamingResources
JNDI Resource Naming and Realm Interaction
+
Introduction

+
+JNDI Datasource configuration is covered extensively in the
+JNDI-Resources-HOWTO.  However, feedback from tomcat-user has
+shown that specifics for individual configurations can be rather tricky.
+
+Here then are some example configurations that have been posted to
+tomcat-user for popular databases and some general tips for db usage.
+
+You should be aware that since these notes are derived from configuration
+and/or feedback posted to tomcat-user YMMV :-). Please let us
+know if you have any other tested configurations that you feel may be of use
+to the wider audience, or if you feel we can improve this section in anyway.
+
+
+Please note that JNDI resource configuration changed somewhat between
+Tomcat 7.x and Tomcat 8.x as they are using different versions of
+Apache Commons DBCP library.  You will most likely need to modify older
+JNDI resource configurations to match the syntax in the example below in order
+to make them work in Tomcat 9.
+See Tomcat Migration Guide
+for details.
+
+
+
+Also, please note that JNDI DataSource configuration in general, and this
+tutorial in particular, assumes that you have read and understood the
+Context and
+Host configuration references, including
+the section about Automatic Application Deployment in the latter reference.
+
+
DriverManager, the service provider mechanism and memory leaks

+
+java.sql.DriverManager supports the
+service
+provider mechanism. This feature is that all the available JDBC drivers
+that announce themselves by providing a META-INF/services/java.sql.Driver
+file are automatically discovered, loaded and registered,
+relieving you from the need to load the database driver explicitly before
+you create a JDBC connection.
+However, the implementation is fundamentally broken in all Java versions for
+a servlet container environment. The problem is that
+java.sql.DriverManager will scan for the drivers only once.
+
+The JRE Memory Leak Prevention Listener
+that is included with Apache Tomcat solves this by triggering the driver scan
+during Tomcat startup. This is enabled by default. It means that only
+libraries visible to the common class loader and its parents will be scanned for
+database drivers. This include drivers in $CATALINA_HOME/lib,
+$CATALINA_BASE/lib, the class path and (where the JRE supports it)
+the endorsed directory. Drivers packaged in web applications (in
+WEB-INF/lib) and in the shared class loader (where configured) will
+not be visible and will not be loaded automatically. If you are considering
+disabling this feature, note that the scan would be triggered by the first web
+application that is using JDBC, leading to failures when this web application is
+reloaded and for other web applications that rely on this feature.
+
+
+Thus, the web applications that have database drivers in their
+WEB-INF/lib directory cannot rely on the service provider
+mechanism and should register the drivers explicitly.
+
+The list of drivers in java.sql.DriverManager is also
+a known source of memory leaks. Any Drivers registered
+by a web application must be deregistered when the web application stops.
+Tomcat will attempt to automatically discover and deregister any
+JDBC drivers loaded by the web application class loader when the web
+application stops.
+However, it is expected that applications do this for themselves via
+a ServletContextListener.
+
+
+
Database Connection Pool (DBCP 2) Configurations

+
+The default database connection pool implementation in Apache Tomcat
+relies on the libraries from the
+Apache Commons project.
+The following libraries are used:
+
+
+
+Commons DBCP 2
+Commons Pool 2
+
+
+
+These libraries are located in a single JAR at
+$CATALINA_HOME/lib/tomcat-dbcp.jar. However,
+only the classes needed for connection pooling have been included, and the
+packages have been renamed to avoid interfering with applications.
+
+
+DBCP 2 provides support for JDBC 4.1.
+
+Installation

+
+See the 
+DBCP 2 documentation for a complete list of configuration parameters.
+
+
+
+
+Preventing database connection pool leaks

+
+
+A database connection pool creates and manages a pool of connections
+to a database. Recycling and reusing already existing connections
+to a database is more efficient than opening a new connection.
+
+
+
+There is one problem with connection pooling.  A web application has
+to explicitly close ResultSet's, Statement's, and Connection's.
+Failure of a web application to close these resources can result in
+them never being available again for reuse, a database connection pool "leak".
+This can eventually result in your web application database connections failing
+if there are no more available connections.
+
+
+There is a solution to this problem.  The Apache Commons DBCP 2 can be
+configured to track and recover these abandoned database connections.  Not
+only can it recover them, but also generate a stack trace for the code
+which opened these resources and never closed them.
+
+
+To configure a DBCP 2 DataSource so that abandoned database connections are
+removed and recycled, add one or both of the following attributes to the
+Resource configuration for your DBCP 2 DataSource:
+
+removeAbandonedOnBorrow=true
+removeAbandonedOnMaintenance=true
+ The default for both of these attributes is false.  Note that
+removeAbandonedOnMaintenance has no effect unless pool
+maintenance is enabled by setting timeBetweenEvictionRunsMillis
+to a positive value.  See the
+
+DBCP 2 documentation for full documentation on these attributes.
+
+
+
+Use the removeAbandonedTimeout attribute to set the number
+of seconds a database connection has been idle before it is considered abandoned.
+
+
+removeAbandonedTimeout="60"
+
+
+The default timeout for removing abandoned connections is 300 seconds.
+
+
+
+The logAbandoned attribute can be set to true
+if you want DBCP 2 to log a stack trace of the code which abandoned the
+database connection resources.
+
+logAbandoned="true"
+
+The default is false.
+
+
+
+
+MySQL DBCP 2 Example

+
+0. Introduction
+Versions of MySQL and JDBC
+drivers that have been reported to work:
+
+
+MySQL 3.23.47, MySQL 3.23.47 using InnoDB,, MySQL 3.23.58,  MySQL 4.0.1alpha
+Connector/J 3.0.11-stable (the official JDBC Driver)
+mm.mysql 2.0.14 (an old 3rd party JDBC Driver)
+
+
+Before you proceed, don't forget to copy the JDBC Driver's jar into $CATALINA_HOME/lib.
+
+1. MySQL configuration
+
+Ensure that you follow these instructions as variations can cause problems.
+
+
+Create a new test user, a new database and a single test table.
+Your MySQL user must have a password assigned. The driver
+will fail if you try to connect with an empty password.
+
+mysql> GRANT ALL PRIVILEGES ON *.* TO javauser@localhost
+    ->   IDENTIFIED BY 'javadude' WITH GRANT OPTION;
+mysql> create database javatest;
+mysql> use javatest;
+mysql> create table testdata (
+    ->   id int not null auto_increment primary key,
+    ->   foo varchar(25),
+    ->   bar int);
+
+Note: the above user should be removed once testing is
+complete!
+
+
+Next insert some test data into the testdata table.
+
+mysql> insert into testdata values(null, 'hello', 12345);
+Query OK, 1 row affected (0.00 sec)
+
+mysql> select * from testdata;
++----+-------+-------+
+| ID | FOO   | BAR   |
++----+-------+-------+
+|  1 | hello | 12345 |
++----+-------+-------+
+1 row in set (0.00 sec)
+
+mysql>
+
+2. Context configuration
+Configure the JNDI DataSource in Tomcat by adding a declaration for your
+resource to your Context.
+For example:
+<Context>
+
+    <!-- maxTotal: Maximum number of database connections in pool. Make sure you
+         configure your mysqld max_connections large enough to handle
+         all of your db connections. Set to -1 for no limit.
+         -->
+
+    <!-- maxIdle: Maximum number of idle database connections to retain in pool.
+         Set to -1 for no limit.  See also the DBCP 2 documentation on this
+         and the minEvictableIdleTimeMillis configuration parameter.
+         -->
+
+    <!-- maxWaitMillis: Maximum time to wait for a database connection to become available
+         in ms, in this example 10 seconds. An Exception is thrown if
+         this timeout is exceeded.  Set to -1 to wait indefinitely.
+         -->
+
+    <!-- username and password: MySQL username and password for database connections  -->
+
+    <!-- driverClassName: Class name for the old mm.mysql JDBC driver is
+         org.gjt.mm.mysql.Driver - we recommend using Connector/J though.
+         Class name for the official MySQL Connector/J driver is com.mysql.jdbc.Driver.
+         -->
+
+    <!-- url: The JDBC connection url for connecting to your MySQL database.
+         -->
+
+  <Resource name="jdbc/TestDB" auth="Container" type="javax.sql.DataSource"
+               maxTotal="100" maxIdle="30" maxWaitMillis="10000"
+               username="javauser" password="javadude" driverClassName="com.mysql.jdbc.Driver"
+               url="jdbc:mysql://localhost:3306/javatest"/>
+
+</Context>
+
+3. web.xml configuration
+
+Now create a WEB-INF/web.xml for this test application.
+<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee
+http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
+    version="2.4">
+  <description>MySQL Test App</description>
+  <resource-ref>
+      <description>DB Connection</description>
+      <res-ref-name>jdbc/TestDB</res-ref-name>
+      <res-type>javax.sql.DataSource</res-type>
+      <res-auth>Container</res-auth>
+  </resource-ref>
+</web-app>
+
+4. Test code
+Now create a simple test.jsp page for use later.
+<%@ taglib uri="http://java.sun.com/jsp/jstl/sql" prefix="sql" %>
+<%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %>
+
+<sql:query var="rs" dataSource="jdbc/TestDB">
+select id, foo, bar from testdata
+</sql:query>
+
+<html>
+  <head>
+    <title>DB Test</title>
+  </head>
+  <body>
+
+  <h2>Results</h2>
+
+<c:forEach var="row" items="${rs.rows}">
+    Foo ${row.foo}<br/>
+    Bar ${row.bar}<br/>
+</c:forEach>
+
+  </body>
+</html>
+
+That JSP page makes use of
+JSTL's
+SQL and Core taglibs. You can get it from
+Apache Tomcat Taglibs - Standard Tag Library
+project — just make sure you get a 1.1.x or later release. Once you have
+JSTL, copy jstl.jar and standard.jar to your web app's
+WEB-INF/lib directory.
+
+
+
+Finally deploy your web app into $CATALINA_BASE/webapps either
+as a warfile called DBTest.war or into a sub-directory called
+DBTest
+Once deployed, point a browser at
+http://localhost:8080/DBTest/test.jsp to view the fruits of
+your hard work.
+
+
+
+Oracle 8i, 9i & 10g

+0.    Introduction
+
+Oracle requires minimal changes from the MySQL configuration except for the
+usual gotchas :-)
+Drivers for older Oracle versions may be distributed as *.zip files rather
+than *.jar files. Tomcat will only use *.jar files installed in
+$CATALINA_HOME/lib. Therefore classes111.zip
+or classes12.zip will need to be renamed with a .jar
+extension. Since jarfiles are zipfiles, there is no need to unzip and jar these
+files - a simple rename will suffice.
+
+For Oracle 9i onwards you should use oracle.jdbc.OracleDriver
+rather than oracle.jdbc.driver.OracleDriver as Oracle have stated
+that oracle.jdbc.driver.OracleDriver is deprecated and support
+for this driver class will be discontinued in the next major release.
+
+
+1. Context configuration
+In a similar manner to the mysql config above, you will need to define your
+Datasource in your Context. Here we define a
+Datasource called myoracle using the thin driver to connect as user scott,
+password tiger to the sid called mysid. (Note: with the thin driver this sid is
+not the same as the tnsname). The schema used will be the default schema for the
+user scott.
+
+Use of the OCI driver should simply involve a changing thin to oci in the URL string.
+
+<Resource name="jdbc/myoracle" auth="Container"
+              type="javax.sql.DataSource" driverClassName="oracle.jdbc.OracleDriver"
+              url="jdbc:oracle:thin:@127.0.0.1:1521:mysid"
+              username="scott" password="tiger" maxTotal="20" maxIdle="10"
+              maxWaitMillis="-1"/>
+
+2.    web.xml configuration
+You should ensure that you respect the element ordering defined by the DTD when you
+create you applications web.xml file.
+<resource-ref>
+ <description>Oracle Datasource example</description>
+ <res-ref-name>jdbc/myoracle</res-ref-name>
+ <res-type>javax.sql.DataSource</res-type>
+ <res-auth>Container</res-auth>
+</resource-ref>
+3.   Code example
+You can use the same example application as above (assuming you create the required DB
+instance, tables etc.) replacing the Datasource code with something like
+Context initContext = new InitialContext();
+Context envContext  = (Context)initContext.lookup("java:/comp/env");
+DataSource ds = (DataSource)envContext.lookup("jdbc/myoracle");
+Connection conn = ds.getConnection();
+//etc.
+
+
+
+PostgreSQL

+0.    Introduction
+PostgreSQL is configured in a similar manner to Oracle.
+
+1. Required files 
+
+Copy the Postgres JDBC jar to $CATALINA_HOME/lib. As with Oracle, the
+jars need to be in this directory in order for DBCP 2's Classloader to find
+them. This has to be done regardless of which configuration step you take next.
+
+
+2. Resource configuration
+
+
+You have two choices here: define a datasource that is shared across all Tomcat
+applications, or define a datasource specifically for one application.
+
+
+2a. Shared resource configuration
+
+Use this option if you wish to define a datasource that is shared across
+multiple Tomcat applications, or if you just prefer defining your datasource
+in this file.
+
+This author has not had success here, although others have reported so.
+Clarification would be appreciated here.
+
+<Resource name="jdbc/postgres" auth="Container"
+          type="javax.sql.DataSource" driverClassName="org.postgresql.Driver"
+          url="jdbc:postgresql://127.0.0.1:5432/mydb"
+          username="myuser" password="mypasswd" maxTotal="20" maxIdle="10" maxWaitMillis="-1"/>
+2b. Application-specific resource configuration
+
+
+Use this option if you wish to define a datasource specific to your application,
+not visible to other Tomcat applications. This method is less invasive to your
+Tomcat installation.
+
+
+
+Create a resource definition for your Context.
+The Context element should look something like the following.
+
+
+<Context>
+
+<Resource name="jdbc/postgres" auth="Container"
+          type="javax.sql.DataSource" driverClassName="org.postgresql.Driver"
+          url="jdbc:postgresql://127.0.0.1:5432/mydb"
+          username="myuser" password="mypasswd" maxTotal="20" maxIdle="10"
+maxWaitMillis="-1"/>
+</Context>
+
+3. web.xml configuration
+<resource-ref>
+ <description>postgreSQL Datasource example</description>
+ <res-ref-name>jdbc/postgres</res-ref-name>
+ <res-type>javax.sql.DataSource</res-type>
+ <res-auth>Container</res-auth>
+</resource-ref>
+
+4. Accessing the datasource
+
+When accessing the datasource programmatically, remember to prepend
+java:/comp/env to your JNDI lookup, as in the following snippet of
+code. Note also that "jdbc/postgres" can be replaced with any value you prefer, provided
+you change it in the above resource definition file as well.
+
+
+InitialContext cxt = new InitialContext();
+if ( cxt == null ) {
+   throw new Exception("Uh oh -- no context!");
+}
+
+DataSource ds = (DataSource) cxt.lookup( "java:/comp/env/jdbc/postgres" );
+
+if ( ds == null ) {
+   throw new Exception("Data source not found!");
+}
+
+
+
Non-DBCP Solutions

+
+These solutions either utilise a single connection to the database (not recommended for anything other
+than testing!) or some other pooling technology.
+
+
Oracle 8i with OCI client

+Introduction

+Whilst not strictly addressing the creation of a JNDI DataSource using the OCI client, these notes can be combined with the
+Oracle and DBCP 2 solution above.
+
+In order to use OCI driver, you should have an Oracle client installed. You should have installed
+Oracle8i(8.1.7) client from cd,  and download the suitable JDBC/OCI
+driver(Oracle8i 8.1.7.1 JDBC/OCI Driver) from otn.oracle.com.
+
+
+After renaming classes12.zip file to classes12.jar
+for Tomcat, copy it into $CATALINA_HOME/lib.
+You may also have to remove the javax.sql.* classes
+from this file depending upon the version of Tomcat and JDK you are using.
+
+
+
+Putting it all together

+
+Ensure that you have the ocijdbc8.dll or .so in your $PATH or LD_LIBRARY_PATH
+ (possibly in $ORAHOME\bin) and also confirm that the native library can be loaded by a simple test program
+using System.loadLibrary("ocijdbc8");
+
+
+You should next create a simple test servlet or JSP that has these
+critical lines:
+
+DriverManager.registerDriver(new
+oracle.jdbc.driver.OracleDriver());
+conn =
+DriverManager.getConnection("jdbc:oracle:oci8:@database","username","password");
+
+where database is of the form host:port:SID Now if you try to access the URL of your
+test servlet/JSP and what you get is a
+ServletException with a root cause of java.lang.UnsatisfiedLinkError:get_env_handle.
+
+
+First, the UnsatisfiedLinkError indicates that you have
+
+
+a mismatch between your JDBC classes file and
+your Oracle client version. The giveaway here is the message stating that a needed library file cannot be
+found. For example, you may be using a classes12.zip file from Oracle Version 8.1.6 with a Version 8.1.5
+Oracle client. The classesXXX.zip file and Oracle client software versions must match.
+
+A $PATH, LD_LIBRARY_PATH problem.
+It has been reported that ignoring the driver you have downloaded from otn and using
+the classes12.zip file from the directory $ORAHOME\jdbc\lib will also work.
+
+
+
+Next you may experience the error ORA-06401 NETCMN: invalid driver designator
+
+
+The Oracle documentation says : "Cause: The login (connect) string contains an invalid
+driver designator. Action: Correct the string and re-submit."
+
+Change the database connect string (of the form host:port:SID) with this one:
+(description=(address=(host=myhost)(protocol=tcp)(port=1521))(connect_data=(sid=orcl)))
+
+
+Ed. Hmm, I don't think this is really needed if you sort out your TNSNames - but I'm not an Oracle DBA :-)
+
+
+
Common Problems

+Here are some common problems encountered with a web application which
+uses a database and tips for how to solve them.
+
+Intermittent Database Connection Failures

+
+Tomcat runs within a JVM.  The JVM periodically performs garbage collection
+(GC) to remove java objects which are no longer being used.  When the JVM
+performs GC execution of code within Tomcat freezes. If the maximum time
+configured for establishment of a database connection is less than the amount
+of time garbage collection took you can get a database connection failure.
+
+
+To collect data on how long garbage collection is taking add the
+-verbose:gc argument to your CATALINA_OPTS
+environment variable when starting Tomcat.  When verbose gc is enabled
+your $CATALINA_BASE/logs/catalina.out log file will include
+data for every garbage collection including how long it took.
+
+When your JVM is tuned correctly 99% of the time a GC will take less
+than one second.  The remainder will only take a few seconds.  Rarely,
+if ever should a GC take more than 10 seconds.
+
+Make sure that the db connection timeout is set to 10-15 seconds.
+For DBCP 2 you set this using the parameter maxWaitMillis.
+
+
+
+Random Connection Closed Exceptions

+
+These can occur when one request gets a db connection from the connection
+pool and closes it twice.  When using a connection pool, closing the
+connection just returns it to the pool for reuse by another request,
+it doesn't close the connection.  And Tomcat uses multiple threads to
+handle concurrent requests. Here is an example of the sequence
+of events which could cause this error in Tomcat:
+
++  Request 1 running in Thread 1 gets a db connection.
+
+  Request 1 closes the db connection.
+
+  The JVM switches the running thread to Thread 2
+
+  Request 2 running in Thread 2 gets a db connection
+  (the same db connection just closed by Request 1).
+
+  The JVM switches the running thread back to Thread 1
+
+  Request 1 closes the db connection a second time in a finally block.
+
+  The JVM switches the running thread back to Thread 2
+
+  Request 2 Thread 2 tries to use the db connection but fails
+  because Request 1 closed it.
+
+
+Here is an example of properly written code to use a database connection
+obtained from a connection pool:
+
+  Connection conn = null;
+  Statement stmt = null;  // Or PreparedStatement if needed
+  ResultSet rs = null;
+  try {
+    conn = ... get connection from connection pool ...
+    stmt = conn.createStatement("select ...");
+    rs = stmt.executeQuery();
+    ... iterate through the result set ...
+    rs.close();
+    rs = null;
+    stmt.close();
+    stmt = null;
+    conn.close(); // Return to connection pool
+    conn = null;  // Make sure we don't close it twice
+  } catch (SQLException e) {
+    ... deal with errors ...
+  } finally {
+    // Always make sure result sets and statements are closed,
+    // and the connection is returned to the pool
+    if (rs != null) {
+      try { rs.close(); } catch (SQLException e) { ; }
+      rs = null;
+    }
+    if (stmt != null) {
+      try { stmt.close(); } catch (SQLException e) { ; }
+      stmt = null;
+    }
+    if (conn != null) {
+      try { conn.close(); } catch (SQLException e) { ; }
+      conn = null;
+    }
+  }
+
+
+
+Context versus GlobalNamingResources

+
+  Please note that although the above instructions place the JNDI declarations in a Context
+  element, it is possible and sometimes desirable to place these declarations in the
+  GlobalNamingResources section of the server
+  configuration file.  A resource placed in the GlobalNamingResources section will be shared
+  among the Contexts of the server.
+
+
+
+JNDI Resource Naming and Realm Interaction

+
+  In order to get Realms to work, the realm must refer to the datasource as
+  defined in the <GlobalNamingResources> or <Context> section, not a datasource as renamed
+  using <ResourceLink>.
+
+
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/jndi-resources-howto.html b/apache-tomcat-9.0.109/webapps/docs/jndi-resources-howto.html
new file mode 100644
index 0000000..2284072
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/jndi-resources-howto.html
@@ -0,0 +1,1126 @@
+
+Apache Tomcat 9 (9.0.109) - JNDI Resources How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
JNDI Resources How-To
Table of Contents

+Introduction
web.xml configuration
context.xml configuration
Global configuration
Using resources
Tomcat Standard Resource FactoriesGeneric JavaBean Resources
Memory UserDatabase Resources
DataSource UserDatabase Resources
JavaMail Sessions
JDBC Data Sources
Adding Custom Resource Factories
+
Introduction

+
+Tomcat provides a JNDI InitialContext implementation
+instance for each web application running under it, in a manner that is
+compatible with those provided by a
+
+Java Enterprise Edition application server. The Java EE standard provides
+a standard set of elements in the /WEB-INF/web.xml file to
+reference/define resources.
+
+See the following Specifications for more information about programming APIs
+for JNDI, and for the features supported by Java Enterprise Edition (Java EE)
+servers, which Tomcat emulates for the services that it provides:
+
+
+    Java Naming and Directory Interface (included in JDK 1.4 onwards)
+
+    Java EE Platform Specification (in particular, see Chapter 5 on Naming)
+
+
+
web.xml configuration

+
+The following elements may be used in the web application deployment
+descriptor (/WEB-INF/web.xml) of your web application to define
+resources:
+
+<env-entry> - Environment entry, a
+    single-value parameter that can be used to configure how the application
+    will operate.
+<resource-ref> - Resource reference,
+    which is typically to an object factory for resources such as a JDBC
+    DataSource, a JavaMail Session, or custom
+    object factories configured into Tomcat.
+<resource-env-ref> - Resource
+    environment reference, a new variation of resource-ref
+    added in Servlet 2.4 that is simpler to configure for resources
+    that do not require authentication information.
+
+
+Providing that Tomcat is able to identify an appropriate resource factory to
+use to create the resource and that no further configuration information is
+required, Tomcat will use the information in /WEB-INF/web.xml to
+create the resource.
+
+Tomcat provides a number of Tomcat specific options for JNDI resources that
+cannot be specified in web.xml. These include closeMethod that
+enables faster cleaning-up of JNDI resources when a web application stops and
+singleton that controls whether or not a new instance of the
+resource is created for every JNDI lookup. To use these configuration options
+the resource must be specified in a web application's
+<Context> element or in the
+
+<GlobalNamingResources> element of
+$CATALINA_BASE/conf/server.xml.
+
+
context.xml configuration

+
+If Tomcat is unable to identify the appropriate resource factory and/or
+additional configuration information is required, additional Tomcat specific
+configuration must be specified before Tomcat can create the resource.
+Tomcat specific resource configuration is entered in
+the <Context> elements that
+can be specified in either $CATALINA_BASE/conf/server.xml or,
+preferably, the per-web-application context XML file
+(META-INF/context.xml).
+
+Tomcat specific resource configuration is performed using the following
+elements in the <Context>
+element:
+
+
+<Environment> -
+    Configure names and values for scalar environment entries that will be
+    exposed to the web application through the JNDI
+    InitialContext (equivalent to the inclusion of an
+    <env-entry> element in the web application
+    deployment descriptor).
+<Resource> -
+    Configure the name and data type of a resource made available to the
+    application (equivalent to the inclusion of a
+    <resource-ref> element in the web application
+    deployment descriptor).
+<ResourceLink> -
+    Add a link to a resource defined in the global JNDI context. Use resource
+    links to give a web application access to a resource defined in
+    the <GlobalNamingResources>
+    child element of the <Server>
+    element.
+<Transaction> -
+    Add a resource factory for instantiating the UserTransaction object
+    instance that is available at java:comp/UserTransaction.
+
+
+
+Any number of these elements may be nested inside a
+<Context> element and will
+be associated only with that particular web application.
+
+If a resource has been defined in a
+<Context> element it is not
+necessary for that resource to be defined in /WEB-INF/web.xml.
+However, it is recommended to keep the entry in /WEB-INF/web.xml
+to document the resource requirements for the web application.
+
+Where the same resource name has been defined for a
+<env-entry> element included in the web application
+deployment descriptor (/WEB-INF/web.xml) and in an
+<Environment> element as part of the
+<Context> element for the
+web application, the values in the deployment descriptor will take precedence
+only if allowed by the corresponding
+<Environment> element (by setting the override
+attribute to "true").
+
+
Global configuration

+
+Tomcat maintains a separate namespace of global resources for the
+entire server.  These are configured in the
+
+<GlobalNamingResources> element of
+$CATALINA_BASE/conf/server.xml. You may expose these resources to
+web applications by using a
+<ResourceLink> to
+include it in the per-web-application context.
+
+If a resource has been defined using a
+<ResourceLink>, it is not
+necessary for that resource to be defined in /WEB-INF/web.xml.
+However, it is recommended to keep the entry in /WEB-INF/web.xml
+to document the resource requirements for the web application.
+
+
Using resources

+
+The InitialContext is configured as a web application is
+initially deployed, and is made available to web application components (for
+read-only access).  All configured entries and resources are placed in
+the java:comp/env portion of the JNDI namespace, so a typical
+access to a resource - in this case, to a JDBC DataSource -
+would look something like this:
+
+// Obtain our environment naming context
+Context initCtx = new InitialContext();
+Context envCtx = (Context) initCtx.lookup("java:comp/env");
+
+// Look up our data source
+DataSource ds = (DataSource)
+  envCtx.lookup("jdbc/EmployeeDB");
+
+// Allocate and use a connection from the pool
+Connection conn = ds.getConnection();
+... use this connection to access the database ...
+conn.close();
+
+
Tomcat Standard Resource Factories

+
+  Tomcat includes a series of standard resource factories that can
+  provide services to your web applications, but give you configuration
+  flexibility (via the
+  <Context> element)
+  without modifying the web application or the deployment descriptor. Each
+  subsection below details the configuration and usage of the standard resource
+  factories.
+
+  See Adding Custom
+  Resource Factories for information about how to create, install,
+  configure, and use your own custom resource factory classes with
+  Tomcat.
+
+  NOTE - Of the standard resource factories, only the
+  "JDBC Data Source" and "User Transaction" factories are mandated to
+  be available on other platforms, and then they are required only if
+  the platform implements the Java Enterprise Edition (Java EE) specs.
+  All other standard resource factories, plus custom resource factories
+  that you write yourself, are specific to Tomcat and cannot be assumed
+  to be available on other containers.
+
+  Generic JavaBean Resources

+
+    0.  Introduction
+
+    This resource factory can be used to create objects of any
+    Java class that conforms to standard JavaBeans naming conventions (i.e.
+    it has a zero-arguments constructor, and has property setters that
+    conform to the setFoo() naming pattern.  The resource factory will
+    only create a new instance of the appropriate bean class every time a
+    lookup() for this entry is made if the singleton
+    attribute of the factory is set to false.
+
+    The steps required to use this facility are described below.
+
+    1.  Create Your JavaBean Class
+
+    Create the JavaBean class which will be instantiated each time
+    that the resource factory is looked up.  For this example, assume
+    you create a class com.mycompany.MyBean, which looks
+    like this:
+
+package com.mycompany;
+
+public class MyBean {
+
+  private String foo = "Default Foo";
+
+  public String getFoo() {
+    return (this.foo);
+  }
+
+  public void setFoo(String foo) {
+    this.foo = foo;
+  }
+
+  private int bar = 0;
+
+  public int getBar() {
+    return (this.bar);
+  }
+
+  public void setBar(int bar) {
+    this.bar = bar;
+  }
+
+
+}
+
+  2.  Declare Your Resource Requirements
+
+  Next, modify your web application deployment descriptor
+  (/WEB-INF/web.xml) to declare the JNDI name under which
+  you will request new instances of this bean.  The simplest approach is
+  to use a <resource-env-ref> element, like this:
+
+<resource-env-ref>
+  <description>
+    Object factory for MyBean instances.
+  </description>
+  <resource-env-ref-name>
+    bean/MyBeanFactory
+  </resource-env-ref-name>
+  <resource-env-ref-type>
+    com.mycompany.MyBean
+  </resource-env-ref-type>
+</resource-env-ref>
+
+    WARNING - Be sure you respect the element ordering
+    that is required by the DTD for web application deployment descriptors!
+    See the
+    Servlet
+    Specification for details.
+
+  3.  Code Your Application's Use Of This Resource
+
+  A typical use of this resource environment reference might look
+  like this:
+
+Context initCtx = new InitialContext();
+Context envCtx = (Context) initCtx.lookup("java:comp/env");
+MyBean bean = (MyBean) envCtx.lookup("bean/MyBeanFactory");
+
+writer.println("foo = " + bean.getFoo() + ", bar = " +
+               bean.getBar());
+
+    4.  Configure Tomcat's Resource Factory
+
+    To configure Tomcat's resource factory, add an element like this to the
+    <Context> element for
+    this web application.
+
+<Context ...>
+  ...
+  <Resource name="bean/MyBeanFactory" auth="Container"
+            type="com.mycompany.MyBean"
+            factory="org.apache.naming.factory.BeanFactory"
+            bar="23"/>
+  ...
+</Context>
+
+    Note that the resource name (here, bean/MyBeanFactory
+    must match the value specified in the web application deployment
+    descriptor.  We are also initializing the value of the bar
+    property, which will cause setBar(23) to be called before
+    the new bean is returned.  Because we are not initializing the
+    foo property (although we could have), the bean will
+    contain whatever default value is set up by its constructor.
+
+    If the bean property is of type String, the BeanFactory
+    will call the property setter using the provided property value. If the
+    bean property type is a primitive or a primitive wrapper, the
+    BeanFactory will convert the value to the appropriate primitive or
+    primitive wrapper and then use that value when calling the setter. Some
+    beans have properties with types that cannot automatically be converted
+    from String. If the bean provides an alternative setter with
+    the same name that does take a String, the BeanFactory will
+    attempt to use that setter. If the BeanFactory cannot use the value or
+    perform an appropriate conversion, setting the property will fail with a
+    NamingException.
+
+    The forceString property available in earlier Tomcat
+    releases has been removed as a security hardening measure.
+
+  
+
+
+  Memory UserDatabase Resources

+
+    0.  Introduction
+
+    UserDatabase resources are typically configured as global resources for
+    use by a UserDatabase realm. Tomcat includes a UserDatabaseFactory that
+    creates UserDatabase resources backed by an XML file - usually
+    tomcat-users.xml.
+
+    The steps required to set up a global UserDatabase resource are described
+    below.
+
+    1. Create/edit the XML file
+
+    The XML file is typically located at
+    $CATALINA_BASE/conf/tomcat-users.xml however, you are free to
+    locate the file anywhere on the file system. It is recommended that the XML
+    files are placed in $CATALINA_BASE/conf. A typical XML would
+    look like:
+
+<?xml version="1.0" encoding="UTF-8"?>
+<tomcat-users>
+  <role rolename="tomcat"/>
+  <role rolename="role1"/>
+  <user username="tomcat" password="tomcat" roles="tomcat"/>
+  <user username="both" password="tomcat" roles="tomcat,role1"/>
+  <user username="role1" password="tomcat" roles="role1"/>
+</tomcat-users>
+
+    2.  Declare Your Resource
+
+    Next, modify $CATALINA_BASE/conf/server.xml to create the
+    UserDatabase resource based on your XML file. It should look something like
+    this:
+
+<Resource name="UserDatabase"
+          auth="Container"
+          type="org.apache.catalina.UserDatabase"
+          description="User database that can be updated and saved"
+          factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
+          pathname="conf/tomcat-users.xml"
+          readonly="false" />
+
+    The pathname attribute can be a URL, an absolute path or a
+    relative path. If relative, it is relative to $CATALINA_BASE.
+    
+
+    The readonly attribute is optional and defaults to
+    true if not supplied. If the XML is writable then it will be
+    written to when Tomcat starts. WARNING: When the file is
+    written it will inherit the default file permissions for the user Tomcat
+    is running as. Ensure that these are appropriate to maintain the security
+    of your installation.
+
+    If referenced in a Realm, the UserDatabase will, by default, monitor
+    pathname for changes and reload the file if a change in the
+    last modified time is observed. This can be disabled by setting the
+    watchSource attribute to false.
+    
+
+    3.  Configure the Realm
+
+    Configure a UserDatabase Realm to use this resource as described in the
+    Realm configuration documentation.
+
+  
+
+
+  DataSource UserDatabase Resources

+
+    0.  Introduction
+
+    Tomcat also include a UserDatabase that uses a
+    DataSource resource as the backend. The backend resource
+    must be declared in the same JNDI context as the user database that will use
+    it.
+
+    The steps required to set up a global UserDatabase resource are described
+    below.
+
+    1. Database schema
+
+    The database schema for the user database is flexible. It can be the same
+    as the schema used for the DataSourceRealm, with only a table
+    for users (user name, password), and another one listing the roles
+    associated with each user. To support the full UserDatabase
+    features, it must include additional tables for groups, and is
+    compatible with referential integrity between users, groups and roles.
+
+    The full featured schema with groups and referential integrity
+    could be:
+
+create table users (
+  user_name         varchar(32) not null primary key,
+  user_pass         varchar(64) not null,
+  user_fullname     varchar(128)
+  -- Add more attributes as needed
+);
+
+create table roles (
+  role_name         varchar(32) not null primary key,
+  role_description  varchar(128)
+);
+
+create table groups (
+  group_name        varchar(32) not null primary key,
+  group_description varchar(128)
+);
+
+create table user_roles (
+  user_name         varchar(32) references users(user_name),
+  role_name         varchar(32) references roles(role_name),
+  primary key (user_name, role_name)
+);
+
+create table user_groups (
+  user_name         varchar(32) references users(user_name),
+  group_name        varchar(32) references groups(group_name),
+  primary key (user_name, group_name)
+);
+
+create table group_roles (
+  group_name        varchar(32) references groups(group_name),
+  role_name         varchar(32) references roles(role_name),
+  primary key (group_name, role_name)
+);
+
+
+    The minimal schema without the ability to use groups will be
+    (it is the same as for the DataSourceRealm):
+
+create table users (
+  user_name         varchar(32) not null primary key,
+  user_pass         varchar(64) not null,
+  -- Add more attributes as needed
+);
+
+create table user_roles (
+  user_name         varchar(32),
+  role_name         varchar(32),
+  primary key (user_name, role_name)
+);
+
+
+    2.  Declare Your Resource
+
+    Next, modify $CATALINA_BASE/conf/server.xml to create the
+    UserDatabase resource based on your DataSource and its schema.
+    It should look something like this:
+
+<Resource name="UserDatabase" auth="Container"
+              type="org.apache.catalina.UserDatabase"
+              description="User database that can be updated and saved"
+              factory="org.apache.catalina.users.DataSourceUserDatabaseFactory"
+              dataSourceName="jdbc/authority" readonly="false"
+              userTable="users" userNameCol="user_name" userCredCol="user_pass"
+              userRoleTable="user_roles" roleNameCol="role_name"
+              roleTable="roles" groupTable="groups" userGroupTable="user_groups"
+              groupRoleTable="group_roles" groupNameCol="group_name" />
+
+    The dataSourceName attribute is the JNDI name of the
+    DataSource that will be the backend for the
+    UserDatabase. It must be declared in the same JNDI
+    Context as the UserDatabase. Please refer to the
+    DataSource resources
+    documentation for further instructions.
+
+    The readonly attribute is optional and defaults to
+    true if not supplied. If the database is writable then changes
+    made through the Tomcat management to the UserDatabase can
+    be persisted to the database using the save operation.
+
+    Alternately, changes can also be made directly to the backend database.
+    
+
+    3.  Resource configuration
+
+    
+          Attribute
+        
+          Description
+        
dataSourceName 
+        The name of the JNDI JDBC DataSource for this UserDatabase.
+      
groupNameCol 
+        Name of the column, in the "groups", "group roles" and "user groups"
+        tables, that contains the group's name.
+      
groupRoleTable 
+        Name of the "group roles" table, which must contain columns
+        named by the groupNameCol and roleNameCol
+        attributes.
+      
groupTable 
+        Name of the "groups" table, which must contain columns named
+        by the groupNameCol attribute.
+      
readonly 
+        If this is set to true, then changes to the
+        UserDatabase can be persisted to the
+        DataSource by using the save method.
+        The default value is true.
+      
roleAndGroupDescriptionCol 
+        Name of the column, in the "roles" and "groups" tables, that contains
+        the description for the roles and groups.
+      
roleNameCol 
+        Name of the column, in the "roles", "user roles" and "group roles"
+        tables, which contains a role name assigned to the corresponding
+        user.
+        This attribute is required in majority of
+        configurations. See allRolesMode attribute of the
+        associated realm for a rare case when it can be omitted.
+      
roleTable 
+        Name of the "roles" table, which must contain columns named
+        by the roleNameCol attribute.
+      
userCredCol 
+        Name of the column, in the "users" table, which contains
+        the user's credentials (i.e. password).  If a
+        CredentialHandler is specified, this component
+        will assume that the passwords have been encoded with the
+        specified algorithm.  Otherwise, they will be assumed to be
+        in clear text.
+      
userGroupTable 
+        Name of the "user groups" table, which must contain columns
+        named by the userNameCol and groupNameCol
+        attributes.
+      
userNameCol 
+        Name of the column, in the "users", "user groups" and "user roles"
+        tables, that contains the user's username.
+      
userFullNameCol 
+        Name of the column, in the "users" table, that contains the user's
+        full name.
+      
userRoleTable 
+        Name of the "user roles" table, which must contain columns
+        named by the userNameCol and roleNameCol
+        attributes.
+        This attribute is required in majority of
+        configurations. See allRolesMode attribute of the
+        associated realm for a rare case when it can be omitted.
+      
userTable 
+        Name of the "users" table, which must contain columns named
+        by the userNameCol and userCredCol
+        attributes.
+      
+
+    4.  Configure the Realm
+
+    Configure a UserDatabase Realm to use this resource as described in the
+    Realm configuration documentation.
+
+  
+
+  JavaMail Sessions

+
+    0.  Introduction
+
+    In many web applications, sending electronic mail messages is a
+    required part of the system's functionality.  The
+    Java Mail API
+    makes this process relatively straightforward, but requires many
+    configuration details that the client application must be aware of
+    (including the name of the SMTP host to be used for message sending).
+
+    Tomcat includes a standard resource factory that will create
+    javax.mail.Session session instances for you, already
+    configured to connect to an SMTP server.
+    In this way, the application is totally insulated from changes in the
+    email server configuration environment - it simply asks for, and receives,
+    a preconfigured session whenever needed.
+
+    The steps required for this are outlined below.
+
+    1.  Declare Your Resource Requirements
+
+    The first thing you should do is modify the web application deployment
+    descriptor (/WEB-INF/web.xml) to declare the JNDI name under
+    which you will look up preconfigured sessions.  By convention, all such
+    names should resolve to the mail subcontext (relative to the
+    standard java:comp/env naming context that is the root of
+    all provided resource factories.  A typical web.xml entry
+    might look like this:
+<resource-ref>
+  <description>
+    Resource reference to a factory for javax.mail.Session
+    instances that may be used for sending electronic mail
+    messages, preconfigured to connect to the appropriate
+    SMTP server.
+  </description>
+  <res-ref-name>
+    mail/Session
+  </res-ref-name>
+  <res-type>
+    javax.mail.Session
+  </res-type>
+  <res-auth>
+    Container
+  </res-auth>
+</resource-ref>
+
+    WARNING - Be sure you respect the element ordering
+    that is required by the DTD for web application deployment descriptors!
+    See the
+    Servlet
+    Specification for details.
+
+    2.  Code Your Application's Use Of This Resource
+
+    A typical use of this resource reference might look like this:
+Context initCtx = new InitialContext();
+Context envCtx = (Context) initCtx.lookup("java:comp/env");
+Session session = (Session) envCtx.lookup("mail/Session");
+
+Message message = new MimeMessage(session);
+message.setFrom(new InternetAddress(request.getParameter("from")));
+InternetAddress to[] = new InternetAddress[1];
+to[0] = new InternetAddress(request.getParameter("to"));
+message.setRecipients(Message.RecipientType.TO, to);
+message.setSubject(request.getParameter("subject"));
+message.setContent(request.getParameter("content"), "text/plain");
+Transport.send(message);
+
+    Note that the application uses the same resource reference name
+    that was declared in the web application deployment descriptor.  This
+    is matched up against the resource factory that is configured in the
+    <Context> element
+    for the web application as described below.
+
+    3.  Configure Tomcat's Resource Factory
+
+    To configure Tomcat's resource factory, add an elements like this to the
+    <Context> element for
+    this web application.
+
+<Context ...>
+  ...
+  <Resource name="mail/Session" auth="Container"
+            type="javax.mail.Session"
+            mail.smtp.host="localhost"/>
+  ...
+</Context>
+
+    Note that the resource name (here, mail/Session) must
+    match the value specified in the web application deployment descriptor.
+    Customize the value of the mail.smtp.host parameter to
+    point at the server that provides SMTP service for your network.
+
+    Additional resource attributes and values will be converted to properties
+    and values and passed to
+    javax.mail.Session.getInstance(java.util.Properties) as part of
+    the java.util.Properties collection. In addition to the
+    properties defined in Annex A of the JavaMail specification, individual
+    providers may also support additional properties.
+    
+
+    If the resource is configured with a password attribute and
+    either a mail.smtp.user or mail.user attribute
+    then Tomcat's resource factory will configure and add a
+    javax.mail.Authenticator to the mail session.
+
+    4.  Install the JavaMail libraries
+
+    
+    Download the JavaMail API.
+
+    Unpackage the distribution and place mail.jar  into $CATALINA_HOME/lib so
+    that it is available to Tomcat during the initialization of the mail Session
+    Resource. Note: placing this jar in both $CATALINA_HOME/lib
+    and a  web application's lib folder will cause an error, so ensure you have
+    it in the $CATALINA_HOME/lib location only.
+    
+
+    5.  Restart Tomcat
+
+    For the additional JAR to be visible to Tomcat, it is necessary for the
+    Tomcat instance to be restarted.
+
+
+    Example Application
+
+    The /examples application included with Tomcat contains
+    an example of utilizing this resource factory.  It is accessed via the
+    "JSP Examples" link.  The source code for the servlet that actually
+    sends the mail message is in
+    /WEB-INF/classes/SendMailServlet.java.
+
+    WARNING - The default configuration assumes that there
+    is an SMTP server listing on port 25 on localhost. If this is
+    not the case, edit the
+    <Context> element for
+    this web application and modify the parameter value for the
+    mail.smtp.host parameter to be the host name of an SMTP server
+    on your network.
+
+  
+
+  JDBC Data Sources

+
+    0.  Introduction
+
+    Many web applications need to access a database via a JDBC driver,
+    to support the functionality required by that application.  The Java EE
+    Platform Specification requires Java EE Application Servers to make
+    available a DataSource implementation (that is, a connection
+    pool for JDBC connections) for this purpose.  Tomcat offers exactly
+    the same support, so that database-based applications you develop on
+    Tomcat using this service will run unchanged on any Java EE server.
+
+    For information about JDBC, you should consult the following:
+    
+    
+        http://www.oracle.com/technetwork/java/javase/jdbc/index.html -
+        Home page for information about Java Database Connectivity.
+    http://java.sun.com/j2se/1.3/docs/guide/jdbc/spec2/jdbc2.1.frame.html -
+        The JDBC 2.1 API Specification.
+    http://java.sun.com/products/jdbc/jdbc20.stdext.pdf -
+        The JDBC 2.0 Standard Extension API (including the
+        javax.sql.DataSource API).  This package is now known
+        as the "JDBC Optional Package".
+    
+        http://www.oracle.com/technetwork/java/javaee/overview/index.htm -
+        The Java EE Platform Specification (covers the JDBC facilities that
+        all Java EE platforms must provide to applications).
+    
+
+    NOTE - The default data source support in Tomcat
+    is based on the DBCP 2 connection pool from the
+    Commons
+    project.  However, it is possible to use any other connection pool
+    that implements javax.sql.DataSource, by writing your
+    own custom resource factory, as described
+    below.
+
+    1.  Install Your JDBC Driver
+
+    Use of the JDBC Data Sources JNDI Resource Factory requires
+    that you make an appropriate JDBC driver available to both Tomcat internal
+    classes and to your web application.  This is most easily accomplished by
+    installing the driver's JAR file(s) into the
+    $CATALINA_HOME/lib directory, which makes the driver
+    available both to the resource factory and to your application.
+
+    2.  Declare Your Resource Requirements
+
+    Next, modify the web application deployment descriptor
+    (/WEB-INF/web.xml) to declare the JNDI name under
+    which you will look up preconfigured data source.  By convention, all such
+    names should resolve to the jdbc subcontext (relative to the
+    standard java:comp/env naming context that is the root of
+    all provided resource factories.  A typical web.xml entry
+    might look like this:
+<resource-ref>
+  <description>
+    Resource reference to a factory for java.sql.Connection
+    instances that may be used for talking to a particular
+    database that is configured in the <Context>
+    configuration for the web application.
+  </description>
+  <res-ref-name>
+    jdbc/EmployeeDB
+  </res-ref-name>
+  <res-type>
+    javax.sql.DataSource
+  </res-type>
+  <res-auth>
+    Container
+  </res-auth>
+</resource-ref>
+
+    WARNING - Be sure you respect the element ordering
+    that is required by the DTD for web application deployment descriptors!
+    See the
+    Servlet
+    Specification for details.
+
+    3.  Code Your Application's Use Of This Resource
+
+    A typical use of this resource reference might look like this:
+Context initCtx = new InitialContext();
+Context envCtx = (Context) initCtx.lookup("java:comp/env");
+DataSource ds = (DataSource)
+  envCtx.lookup("jdbc/EmployeeDB");
+
+Connection conn = ds.getConnection();
+... use this connection to access the database ...
+conn.close();
+
+    Note that the application uses the same resource reference name that was
+    declared in the web application deployment descriptor. This is matched up
+    against the resource factory that is configured in the
+    <Context> element for
+    the web application as described below.
+
+    4.  Configure Tomcat's Resource Factory
+
+    To configure Tomcat's resource factory, add an element like this to the
+    <Context> element for
+    the web application.
+
+<Context ...>
+  ...
+  <Resource name="jdbc/EmployeeDB"
+            auth="Container"
+            type="javax.sql.DataSource"
+            username="dbusername"
+            password="dbpassword"
+            driverClassName="org.hsql.jdbcDriver"
+            url="jdbc:HypersonicSQL:database"
+            maxTotal="8"
+            maxIdle="4"/>
+  ...
+</Context>
+
+    Note that the resource name (here, jdbc/EmployeeDB) must
+    match the value specified in the web application deployment descriptor.
+
+    This example assumes that you are using the HypersonicSQL database
+    JDBC driver.  Customize the driverClassName and
+    driverName parameters to match your actual database's
+    JDBC driver and connection URL.
+
+    The configuration properties for Tomcat's standard data source
+    resource factory
+    (org.apache.tomcat.dbcp.dbcp2.BasicDataSourceFactory) are
+    as follows:
+    
+    driverClassName - Fully qualified Java class name
+        of the JDBC driver to be used.
+    username - Database username to be passed to our
+        JDBC driver.
+    password - Database password to be passed to our
+        JDBC driver.
+    url - Connection URL to be passed to our JDBC driver.
+        (For backwards compatibility, the property driverName
+        is also recognized.)
+    initialSize - The initial number of connections
+        that will be created in the pool during pool initialization. Default: 0
+    maxTotal - The maximum number of connections
+        that can be allocated from this pool at the same time. Default: 8
+    minIdle - The minimum number of connections that
+        will sit idle in this pool at the same time. Default: 0
+    maxIdle - The maximum number of connections that
+        can sit idle in this pool at the same time. Default: 8
+    maxWaitMillis - The maximum number of milliseconds that the
+        pool will wait (when there are no available connections) for a
+        connection to be returned before throwing an exception. Default: -1 (infinite)
+    
+    Some additional properties handle connection validation:
+    
+    validationQuery - SQL query that can be used by the
+        pool to validate connections before they are returned to the
+        application.  If specified, this query MUST be an SQL SELECT
+        statement that returns at least one row.
+    validationQueryTimeout - Timeout in seconds
+        for the validation query to return. Default: -1 (infinite)
+    testOnBorrow - true or false: whether a connection
+        should be validated using the validation query each time it is
+        borrowed from the pool. Default: true
+    testOnReturn - true or false: whether a connection
+        should be validated using the validation query each time it is
+        returned to the pool. Default: false
+    
+    The optional evictor thread is responsible for shrinking the pool
+    by removing any connections which are idle for a long time. The evictor
+    does not respect minIdle. Note that you do not need to
+    activate the evictor thread if you only want the pool to shrink according
+    to the configured maxIdle property.
+    The evictor is disabled by default and can be configured using
+    the following properties:
+    
+    timeBetweenEvictionRunsMillis - The number of
+        milliseconds between consecutive runs of the evictor.
+        Default: -1 (disabled)
+    numTestsPerEvictionRun - The number of connections
+        that will be checked for idleness by the evictor during each
+        run of the evictor. Default: 3
+    minEvictableIdleTimeMillis - The idle time in
+        milliseconds after which a connection can be removed from the pool
+        by the evictor. Default: 30*60*1000 (30 minutes)
+    testWhileIdle - true or false: whether a connection
+        should be validated by the evictor thread using the validation query
+        while sitting idle in the pool. Default: false
+    
+    Another optional feature is the removal of abandoned connections.
+    A connection is called abandoned if the application does not return it
+    to the pool for a long time. The pool can close such connections
+    automatically and remove them from the pool. This is a workaround
+    for applications leaking connections.
+    The abandoning feature is disabled by default and can be configured
+    using the following properties:
+    
+    removeAbandonedOnBorrow - true or false: whether to
+        remove abandoned connections from the pool when a connection is
+        borrowed. Default: false
+    removeAbandonedOnMaintenance - true or false: whether
+        to remove abandoned connections from the pool during pool maintenance.
+        Default: false
+    removeAbandonedTimeout - The number of
+        seconds after which a borrowed connection is assumed to be abandoned.
+        Default: 300
+    logAbandoned - true or false: whether to log
+        stack traces for application code which abandoned a statement
+        or connection. This adds serious overhead. Default: false
+    
+    Finally there are various properties that allow further fine tuning
+    of the pool behaviour:
+    
+    defaultAutoCommit - true or false: default
+        auto-commit state of the connections created by this pool.
+        Default: true
+    defaultReadOnly - true or false: default
+        read-only state of the connections created by this pool.
+        Default: false
+    defaultTransactionIsolation - This sets the
+        default transaction isolation level. Can be one of
+        NONE, READ_COMMITTED,
+        READ_UNCOMMITTED, REPEATABLE_READ,
+        SERIALIZABLE. Default: no default set
+    poolPreparedStatements - true or false: whether to
+        pool PreparedStatements and CallableStatements. Default: false
+    maxOpenPreparedStatements - The maximum number of open
+        statements that can be allocated from the statement pool at the same time.
+        Default: -1 (unlimited)
+    defaultCatalog - The name of the default catalog.
+        Default: not set
+    connectionInitSqls - A list of SQL statements
+        run once after a Connection is created. Separate multiple statements
+        by semicolons (;). Default: no statement
+    connectionProperties - A list of driver specific
+        properties passed to the driver for creating connections. Each
+        property is given as name=value, multiple properties
+        are separated by semicolons (;). Default: no properties
+    accessToUnderlyingConnectionAllowed - true or false: whether
+        accessing the underlying connections is allowed. Default: false
+    
+    For more details, please refer to the Commons DBCP 2 documentation.
+
+  
+
+
Adding Custom Resource Factories

+
+  If none of the standard resource factories meet your needs, you can write
+  your own factory and integrate it into Tomcat, and then configure the use
+  of this factory in the
+  <Context> element for
+  the web application. In the example below, we will create a factory that only
+  knows how to create com.mycompany.MyBean beans from the
+  Generic JavaBean Resources example
+  above.
+
+  1.  Write A Resource Factory Class
+
+  You must write a class that implements the JNDI service provider
+  javax.naming.spi.ObjectFactory interface.  Every time your
+  web application calls lookup() on a context entry that is
+  bound to this factory (assuming that the factory is configured with
+  singleton="false"), the
+  getObjectInstance() method is called, with the following
+  arguments:
+  
+  Object obj - The (possibly null) object containing
+      location or reference information that can be used in creating an object.
+      For Tomcat, this will always be an object of type
+      javax.naming.Reference, which contains the class name of
+      this factory class, as well as the configuration properties (from the
+      <Context> for the
+      web application) to use in creating objects to be returned.
+  Name name - The name to which this factory is bound
+      relative to nameCtx, or null if no name
+      is specified.
+  Context nameCtx - The context relative to which the
+      name parameter is specified, or null if
+      name is relative to the default initial context.
+  Hashtable environment - The (possibly null)
+      environment that is used in creating this object.  This is generally
+      ignored in Tomcat object factories.
+  
+
+  To create a resource factory that knows how to produce MyBean
+  instances, you might create a class like this:
+
+package com.mycompany;
+
+import java.util.Enumeration;
+import java.util.Hashtable;
+import javax.naming.Context;
+import javax.naming.Name;
+import javax.naming.NamingException;
+import javax.naming.RefAddr;
+import javax.naming.Reference;
+import javax.naming.spi.ObjectFactory;
+
+public class MyBeanFactory implements ObjectFactory {
+
+  public Object getObjectInstance(Object obj,
+      Name name2, Context nameCtx, Hashtable environment)
+      throws NamingException {
+
+      // Acquire an instance of our specified bean class
+      MyBean bean = new MyBean();
+
+      // Customize the bean properties from our attributes
+      Reference ref = (Reference) obj;
+      Enumeration addrs = ref.getAll();
+      while (addrs.hasMoreElements()) {
+          RefAddr addr = (RefAddr) addrs.nextElement();
+          String name = addr.getType();
+          String value = (String) addr.getContent();
+          if (name.equals("foo")) {
+              bean.setFoo(value);
+          } else if (name.equals("bar")) {
+              try {
+                  bean.setBar(Integer.parseInt(value));
+              } catch (NumberFormatException e) {
+                  throw new NamingException("Invalid 'bar' value " + value);
+              }
+          }
+      }
+
+      // Return the customized instance
+      return (bean);
+
+  }
+
+}
+
+  In this example, we are unconditionally creating a new instance of
+  the com.mycompany.MyBean class, and populating its properties
+  based on the parameters included in the <Resource>
+  element that configures this resource (see below).  You should note that any
+  parameter named factory should be skipped - that parameter is
+  used to specify the name of the factory class itself (in this case,
+  com.mycompany.MyBeanFactory) rather than a property of the
+  bean being configured.
+
+  For more information about ObjectFactory, see the
+  
+  JNDI Service Provider Interface (SPI) Specification.
+
+  You will need to compile this class against a class path that includes
+  all of the JAR files in the $CATALINA_HOME/lib directory.  When you are through,
+  place the factory class (and the corresponding bean class) unpacked under
+  $CATALINA_HOME/lib, or in a JAR file inside
+  $CATALINA_HOME/lib.  In this way, the required class
+  files are visible to both Catalina internal resources and your web
+  application.
+
+  2.  Declare Your Resource Requirements
+
+  Next, modify your web application deployment descriptor
+  (/WEB-INF/web.xml) to declare the JNDI name under which
+  you will request new instances of this bean.  The simplest approach is
+  to use a <resource-env-ref> element, like this:
+
+<resource-env-ref>
+  <description>
+    Object factory for MyBean instances.
+  </description>
+  <resource-env-ref-name>
+    bean/MyBeanFactory
+  </resource-env-ref-name>
+  <resource-env-ref-type>
+    com.mycompany.MyBean
+  </resource-env-ref-type>
+</resource-env-ref>
+
+    WARNING - Be sure you respect the element ordering
+    that is required by the DTD for web application deployment descriptors!
+    See the
+    Servlet
+    Specification for details.
+
+  3.  Code Your Application's Use Of This Resource
+
+  A typical use of this resource environment reference might look
+  like this:
+
+Context initCtx = new InitialContext();
+Context envCtx = (Context) initCtx.lookup("java:comp/env");
+MyBean bean = (MyBean) envCtx.lookup("bean/MyBeanFactory");
+
+writer.println("foo = " + bean.getFoo() + ", bar = " +
+               bean.getBar());
+
+    4.  Configure Tomcat's Resource Factory
+
+    To configure Tomcat's resource factory, add an elements like this to the
+    <Context> element for
+    this web application.
+
+<Context ...>
+  ...
+  <Resource name="bean/MyBeanFactory" auth="Container"
+            type="com.mycompany.MyBean"
+            factory="com.mycompany.MyBeanFactory"
+            singleton="false"
+            bar="23"/>
+  ...
+</Context>
+
+    Note that the resource name (here, bean/MyBeanFactory
+    must match the value specified in the web application deployment
+    descriptor.  We are also initializing the value of the bar
+    property, which will cause setBar(23) to be called before
+    the new bean is returned.  Because we are not initializing the
+    foo property (although we could have), the bean will
+    contain whatever default value is set up by its constructor.
+
+    You will also note that, from the application developer's perspective,
+    the declaration of the resource environment reference, and the programming
+    used to request new instances, is identical to the approach used for the
+    Generic JavaBean Resources example.  This illustrates one of the
+    advantages of using JNDI resources to encapsulate functionality - you can
+    change the underlying implementation without necessarily having to
+    modify applications using the resources, as long as you maintain
+    compatible APIs.
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/jspapi/index.html b/apache-tomcat-9.0.109/webapps/docs/jspapi/index.html
new file mode 100644
index 0000000..b4b65c6
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/jspapi/index.html
@@ -0,0 +1,34 @@
+
+
+
+    
+    
+    API docs
+
+
+
+
+The JSP Javadoc is not installed by default. Download and install
+the "fulldocs" package to get it.
+
+You can also access the javadoc online in the Tomcat
+
+documentation bundle.
+
+
+
diff --git a/apache-tomcat-9.0.109/webapps/docs/logging.html b/apache-tomcat-9.0.109/webapps/docs/logging.html
new file mode 100644
index 0000000..60ddf37
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/logging.html
@@ -0,0 +1,404 @@
+
+Apache Tomcat 9 (9.0.109) - Logging in Tomcat
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Logging in Tomcat
Table of Contents

+IntroductionJava logging API — java.util.logging
Servlets logging API
Console
Access logging
Using java.util.logging (default)Documentation references
Considerations for production usage
Using Log4j
+
Introduction

+    
+      The internal logging for Apache Tomcat uses JULI, a packaged renamed fork
+      of Apache Commons Logging
+      that is hard-coded to use the java.util.logging framework.
+      This ensures that Tomcat's internal logging and any web application
+      logging will remain independent, even if a web application uses Apache
+      Commons Logging.
+    
+
+    
+      To configure Tomcat to use an alternative logging framework for its
+      internal logging, follow the instructions provided by the alternative
+      logging framework for redirecting logging for applications that use
+      java.util.logging. Links to some of these instructions are
+      provided towards the end of this page. Keep in mind that the alternative
+      logging framework will need to be capable of working in an environment
+      where different loggers with the same name may exist in different class
+      loaders.
+    
+
+    
+      A web application running on Apache Tomcat can:
+    
+    
+      
+        Use any logging framework of its choice.
+      
+      
+        Use system logging API, java.util.logging.
+      
+      
+        Use the logging API provided by the Java Servlets specification,
+        javax.servlet.ServletContext.log(...)
+      
+    
+
+    
+      The logging frameworks used by different web applications are independent.
+      See class loading for more details.
+      The exception to this rule is java.util.logging. If it is
+      used directly or indirectly by your logging library then elements of it
+      will be shared across web applications because it is loaded by the system
+      class loader.
+    
+
+    Java logging API — java.util.logging

+
+    
+      Apache Tomcat has its own implementation of several key elements of
+      java.util.logging API. This implementation is called JULI.
+      The key component there is a custom LogManager implementation,
+      that is aware of different web applications running on Tomcat (and
+      their different class loaders). It supports private per-application
+      logging configurations. It is also notified by Tomcat when a web application
+      is unloaded from memory, so that the references to its classes can be
+      cleared, preventing memory leaks.
+    
+
+    
+      This java.util.logging implementation is enabled by providing
+      certain system properties when starting Java. The Apache Tomcat startup
+      scripts do this for you, but if you are using different tools to run
+      Tomcat (such as jsvc, or running Tomcat from within an IDE), you should
+      take care of them by yourself.
+    
+
+    
+      More details about java.util.logging may be found in the documentation
+      for your JDK and on its Javadoc pages for the java.util.logging
+      package.
+    
+
+    
+      More details about Tomcat JULI may be found below.
+    
+
+    
+
+    Servlets logging API

+
+    
+      The calls to javax.servlet.ServletContext.log(...) to write
+      log messages are handled by internal Tomcat logging. Such messages are
+      logged to the category named
+    
+      org.apache.catalina.core.ContainerBase.[${engine}].[${host}].[${context}]
+    
+      This logging is performed according to the Tomcat logging configuration. You
+      cannot overwrite it in a web application.
+    
+
+    
+      The Servlets logging API predates the java.util.logging API
+      that is now provided by Java. As such, it does not offer you much options.
+      E.g., you cannot control the log levels. It can be noted, though, that
+      in Apache Tomcat implementation the calls to ServletContext.log(String)
+      or GenericServlet.log(String) are logged at the INFO level.
+      The calls to ServletContext.log(String, Throwable) or
+      GenericServlet.log(String, Throwable)
+      are logged at the SEVERE level.
+    
+
+    
+
+    Console

+
+    
+      When running Tomcat on unixes, the console output is usually redirected
+      to the file named catalina.out. The name is configurable
+      using an environment variable. (See the startup scripts).
+      Whatever is written to System.err/out will be caught into
+      that file. That may include:
+    
+
+    
+      Uncaught exceptions printed by java.lang.ThreadGroup.uncaughtException(..)
+      Thread dumps, if you requested them via a system signal
+    
+
+    
+      When running as a service on Windows, the console output is also caught
+      and redirected, but the file names are different.
+    
+
+    
+      The default logging configuration in Apache Tomcat writes the same
+      messages to the console and to a log file. This is great when using
+      Tomcat for development, but usually is not needed in production.
+    
+
+    
+      Old applications that still use System.out or System.err
+      can be tricked by setting swallowOutput attribute on a
+      Context. If the attribute is set to
+      true, the calls to System.out/err during request
+      processing will be intercepted, and their output will be fed to the
+      logging subsystem using the
+      javax.servlet.ServletContext.log(...) calls.

+      Note, that the swallowOutput  feature is
+      actually a trick, and it has its limitations.
+      It works only with direct calls to System.out/err,
+      and only during request processing cycle. It may not work in other
+      threads that might be created by the application. It cannot be used to
+      intercept logging frameworks that themselves write to the system streams,
+      as those start early and may obtain a direct reference to the streams
+      before the redirection takes place.
+    
+
+    
+
+    Access logging

+
+    
+      Access logging is a related but different feature, which is
+      implemented as a Valve. It uses self-contained
+      logic to write its log files. The essential requirement for
+      access logging is to handle a large continuous stream of data
+      with low overhead, so it only uses Apache Commons Logging for
+      its own debug messages. This implementation approach avoids
+      additional overhead and potentially complex configuration.
+      Please refer to the Valves
+      documentation for more details on its configuration, including
+      the various report formats.
+    
+
+    
+
+  
Using java.util.logging (default)

+
+  
+    The default implementation of java.util.logging provided in the JDK is too
+    limited to be useful. The key limitation is the inability to have per-web
+    application logging, as the configuration is per-VM. As a result, Tomcat
+    will, in the default configuration, replace the default LogManager
+    implementation with a container friendly implementation called JULI, which
+    addresses these shortcomings.
+  
+  
+    JULI supports the same configuration mechanisms as the standard JDK
+    java.util.logging, using either a programmatic approach, or
+    properties files. The main difference is that per-classloader properties
+    files can be set (which enables easy redeployment friendly webapp
+    configuration), and the properties files support extended constructs which
+    allows more freedom for defining handlers and assigning them to loggers.
+  
+  
+    JULI is enabled by default, and supports per classloader configuration, in
+    addition to the regular global java.util.logging configuration. This means
+    that logging can be configured at the following layers:
+  
+    
+      Globally. That is usually done in the
+        ${catalina.base}/conf/logging.properties file.
+        The file is specified by the java.util.logging.config.file
+        System property which is set by the startup scripts.
+        If it is not readable or is not configured, the default is to use the
+        ${java.home}/lib/logging.properties file in the JRE.
+      
+      In the web application. The file will be
+        WEB-INF/classes/logging.properties
+      
+    
+  
+    The default logging.properties in the JRE specifies a
+    ConsoleHandler that routes logging to System.err.
+    The default conf/logging.properties in Apache Tomcat also
+    adds several AsyncFileHandlers that write to files.
+  
+  
+    A handler's log level threshold is INFO by default and can be set using
+    SEVERE, WARNING, INFO, CONFIG,
+    FINE, FINER, FINEST or ALL.
+    You can also target specific packages to collect logging from and specify
+    a level.
+  
+  
+    To enable debug logging for part of Tomcat's internals, you should
+    configure both the appropriate logger(s) and the appropriate handler(s) to
+    use the FINEST or ALL level. e.g.:
+  
+  org.apache.catalina.session.level=ALL
+java.util.logging.ConsoleHandler.level=ALL
+  
+    When enabling debug logging it is recommended that it is enabled for the
+    narrowest possible scope as debug logging can generate large amounts of
+    information.
+  
+  
+    The configuration used by JULI is the same as the one supported by plain
+    java.util.logging, but uses a few extensions to allow better
+    flexibility in configuring loggers and handlers. The main differences are:
+  
+  
+      A prefix may be added to handler names, so that multiple handlers of a
+      single class may be instantiated. A prefix is a String which starts with a
+      digit, and ends with '.'. For example, 22foobar. is a valid
+      prefix.
+      System property replacement is performed for property values which
+      contain ${systemPropertyName}.
+      If using a class loader that implements the
+      org.apache.juli.WebappProperties interface (Tomcat's
+      web application class loader does) then property replacement is also
+      performed for ${classloader.webappName},
+      ${classloader.hostName} and
+      ${classloader.serviceName} which are replaced with the
+      web application name, the host name and the service name respectively.
+      
+      By default, loggers will not delegate to their parent if they have
+      associated handlers. This may be changed per logger using the
+      loggerName.useParentHandlers property, which accepts a
+      boolean value.
+      The root logger can define its set of handlers using the
+      .handlers property.
+       By default the log files will be kept on the file system for
+      90 days. This may be changed per handler using the
+      handlerName.maxDays property. If the specified value for the
+      property is ≤0 then the log files will be kept on the
+      file system forever, otherwise they will be kept the specified maximum
+      days.
+  
+  
+    There are several additional implementation classes, that can be used
+    together with the ones provided by Java. The notable ones are
+    org.apache.juli.FileHandler and org.apache.juli.AsyncFileHandler.
+  
+  
+    org.apache.juli.FileHandler supports buffering of the
+      logs. The buffering is not enabled by default. To configure it, use the
+      bufferSize property of a handler. The value of 0
+      uses system default buffering (typically an 8K buffer will be used). A
+      value of <0 forces a writer flush upon each log write. A
+      value >0 uses a BufferedOutputStream with the defined
+      value but note that the system default buffering will also be
+      applied.
+  
+  
+    org.apache.juli.AsyncFileHandler is a subclass of FileHandler
+      that queues the log messages and writes them asynchronously to the log files.
+      Its additional behaviour can be configured by setting some
+      system properties.
+  
+  
+    Example logging.properties file to be placed in $CATALINA_BASE/conf:
+  
+  handlers = 1catalina.org.apache.juli.AsyncFileHandler, \
+           2localhost.org.apache.juli.AsyncFileHandler, \
+           3manager.org.apache.juli.AsyncFileHandler, \
+           java.util.logging.ConsoleHandler
+
+.handlers = 1catalina.org.apache.juli.AsyncFileHandler, java.util.logging.ConsoleHandler
+
+############################################################
+# Handler specific properties.
+# Describes specific configuration info for Handlers.
+############################################################
+
+1catalina.org.apache.juli.AsyncFileHandler.level = ALL
+1catalina.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
+1catalina.org.apache.juli.AsyncFileHandler.prefix = catalina.
+1catalina.org.apache.juli.AsyncFileHandler.maxDays = 90
+1catalina.org.apache.juli.AsyncFileHandler.encoding = UTF-8
+
+2localhost.org.apache.juli.AsyncFileHandler.level = ALL
+2localhost.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
+2localhost.org.apache.juli.AsyncFileHandler.prefix = localhost.
+2localhost.org.apache.juli.AsyncFileHandler.maxDays = 90
+2localhost.org.apache.juli.AsyncFileHandler.encoding = UTF-8
+
+3manager.org.apache.juli.AsyncFileHandler.level = ALL
+3manager.org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
+3manager.org.apache.juli.AsyncFileHandler.prefix = manager.
+3manager.org.apache.juli.AsyncFileHandler.bufferSize = 16384
+3manager.org.apache.juli.AsyncFileHandler.maxDays = 90
+3manager.org.apache.juli.AsyncFileHandler.encoding = UTF-8
+
+java.util.logging.ConsoleHandler.level = ALL
+java.util.logging.ConsoleHandler.formatter = org.apache.juli.OneLineFormatter
+java.util.logging.ConsoleHandler.encoding = UTF-8
+
+############################################################
+# Facility specific properties.
+# Provides extra control for each logger.
+############################################################
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].handlers = \
+   2localhost.org.apache.juli.AsyncFileHandler
+
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].level = INFO
+org.apache.catalina.core.ContainerBase.[Catalina].[localhost].[/manager].handlers = \
+   3manager.org.apache.juli.AsyncFileHandler
+
+# For example, set the org.apache.catalina.util.LifecycleBase logger to log
+# each component that extends LifecycleBase changing state:
+#org.apache.catalina.util.LifecycleBase.level = FINE
+
+    
+      Example logging.properties for the servlet-examples web application to be
+      placed in WEB-INF/classes inside the web application:
+    
+    handlers = org.apache.juli.AsyncFileHandler, java.util.logging.ConsoleHandler
+
+############################################################
+# Handler specific properties.
+# Describes specific configuration info for Handlers.
+############################################################
+
+org.apache.juli.AsyncFileHandler.level = ALL
+org.apache.juli.AsyncFileHandler.directory = ${catalina.base}/logs
+org.apache.juli.AsyncFileHandler.prefix = ${classloader.webappName}.
+org.apache.juli.AsyncFileHandler.encoding = UTF-8
+
+java.util.logging.ConsoleHandler.level = ALL
+java.util.logging.ConsoleHandler.formatter = org.apache.juli.OneLineFormatter
+java.util.logging.ConsoleHandler.encoding = UTF-8
+
+
+    Documentation references

+      See the following resources for additional information:
+      
+        Apache Tomcat Javadoc for the
+          org.apache.juli
+          package.
+        
+        Oracle Java 8 Javadoc for the
+          java.util.logging
+          package.
+        
+      
+    
+
+    Considerations for production usage

+      You may want to take note of the following:
+      
+        Consider removing ConsoleHandler from configuration. By
+        default (thanks to the .handlers setting) logging goes both
+        to a AsyncFileHandler and to a ConsoleHandler. The
+        output of the latter one is usually captured into a file, such as
+        catalina.out. Thus you end up with two copies of the same
+        messages.
+        Consider removing AsyncFileHandlers for the applications
+        that you do not use. E.g., the one for host-manager.
+        Consider configuring an
+        Access log.
+      
+    
+
+  
Using Log4j

+
+    The Log4j project provides instructions for using Log4J for Tomcat's internal logging.
+
+  

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/manager-howto.html b/apache-tomcat-9.0.109/webapps/docs/manager-howto.html
new file mode 100644
index 0000000..f946044
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/manager-howto.html
@@ -0,0 +1,1468 @@
+
+Apache Tomcat 9 (9.0.109) - Manager App How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Manager App How-To
Table of Contents

+Introduction
Configuring Manager Application Access
HTML User-friendly Interface
Supported Manager CommandsCommon Parameters
Deploy A New Application Archive (WAR) Remotely
Deploy A New Application from a Local PathDeploy a previously deployed webapp
Deploy a Directory or WAR by URL
Deploy a Directory or War from the Host appBase
Deploy using a Context configuration ".xml" file
Deployment Notes
Deploy Response
List Currently Deployed Applications
Reload An Existing Application
List OS and JVM Properties
List Available Global JNDI Resources
Session Statistics
Expire Sessions
Start an Existing Application
Stop an Existing Application
Undeploy an Existing Application
Finding memory leaks
Connector SSL/TLS cipher information
Connector SSL/TLS certificate chain information
Connector SSL/TLS trusted certificate information
Reload TLS configuration
Thread Dump
VM Info
Save Configuration
Server Status
Using the JMX Proxy ServletWhat is JMX Proxy Servlet
JMX Query command
JMX Get command
JMX Set command
JMX Invoke command
Executing Manager Commands With AntTasks output capture
+
Introduction

+
+In many production environments, it is very useful to have the capability
+to deploy a new web application, or undeploy an existing one, without having
+to shut down and restart the entire container.  In addition, you can request
+an existing application to reload itself, even if you have not declared it
+to be reloadable in the Tomcat server
+configuration file.
+
+To support these capabilities, Tomcat includes a web application
+(installed by default on context path /manager) that supports
+the following functions:
+
+Deploy a new web application from the uploaded contents of a WAR file.
+Deploy a new web application, on a specified context path, from the
+    server file system.
+List the currently deployed web applications, as well as the
+    sessions that are currently active for those web apps.
+Reload an existing web application, to reflect changes in the
+    contents of /WEB-INF/classes or /WEB-INF/lib.
+    
+List the OS and JVM property values.
+List the available global JNDI resources, for use in deployment
+    tools that are preparing <ResourceLink> elements
+    nested in a <Context> deployment description.
+Start a stopped application (thus making it available again).
+Stop an existing application (so that it becomes unavailable), but
+    do not undeploy it.
+Undeploy a deployed web application and delete its document base
+    directory (unless it was deployed from file system).
+
+
+A default Tomcat installation includes an instance of the Manager application
+configured for the default virtual host. If you create additional virtual hosts,
+you may wish to add an instance of the Manager application to one or more of
+those Hosts. To add an instance of the Manager web application
+Context to a new host install the manager.xml context
+configuration file in the
+$CATALINA_BASE/conf/[enginename]/[hostname] folder. Here is an
+example:
+<Context privileged="true" antiResourceLocking="false"
+         docBase="${catalina.home}/webapps/manager">
+  <CookieProcessor className="org.apache.tomcat.util.http.Rfc6265CookieProcessor"
+                   sameSiteCookies="strict" />
+  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
+         allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" />
+  <Manager sessionAttributeValueClassNameFilter="java\.lang\.(?:Boolean|Integer|Long|Number|String)|org\.apache\.catalina\.filters\.CsrfPreventionFilter\$LruCache(?:\$1)?|java\.util\.(?:Linked)?HashMap"/>
+</Context>
+
+There are three ways to use the Manager web application.
+
+As an application with a user interface you use in your browser.
+Here is an example URL where you can replace localhost with
+your website host name:  http://localhost:8080/manager/html .
+A minimal version using HTTP requests only which is suitable for use
+by scripts setup by system administrators.  Commands are given as part of the
+request URI, and responses are in the form of simple text that can be easily
+parsed and processed.  See 
+Supported Manager Commands for more information.
+A convenient set of task definitions for the Ant
+(version 1.4 or later) build tool.  See
+Executing Manager Commands
+With Ant for more information.
+
+
+
Configuring Manager Application Access

+
+
+    The description below uses the variable name $CATALINA_BASE to refer the
+    base directory against which most relative paths are resolved. If you have
+    not configured Tomcat for multiple instances by setting a CATALINA_BASE
+    directory, then $CATALINA_BASE will be set to the value of $CATALINA_HOME,
+    the directory into which you have installed Tomcat.
+
+
+It would be quite unsafe to ship Tomcat with default settings that allowed
+anyone on the Internet to execute the Manager application on your server.
+Therefore, the Manager application is shipped with the requirement that anyone
+who attempts to use it must authenticate themselves, using a username and
+password that have one of manager-xxx roles associated with
+them (the role name depends on what functionality is required).
+Further, there is no username in the default users file
+($CATALINA_BASE/conf/tomcat-users.xml) that is assigned to those
+roles.  Therefore, access to the Manager application is completely disabled
+by default.
+
+You can find the role names in the web.xml file of the Manager
+web application. The available roles are:
+
+
+  manager-gui — Access to the HTML interface.
+  manager-status — Access to the "Server Status"
+    page only.
+  manager-script — Access to the tools-friendly
+    plain text interface that is described in this document,
+    and to the "Server Status" page.
+  manager-jmx — Access to JMX proxy interface
+    and to the "Server Status" page.
+
+
+The HTML interface is protected against CSRF (Cross-Site Request Forgery)
+attacks, but the text and JMX interfaces cannot be protected. It means that
+users who are allowed access to the text and JMX interfaces have to be cautious
+when accessing the Manager application with a web browser.
+To maintain the CSRF protection:
+
+
+  If you use web browser to access the Manager application using
+      a user that has either manager-script or
+      manager-jmx roles (for example for testing
+      the plain text or JMX interfaces), you MUST close all windows
+      of the browser afterwards to terminate the session.
+      If you do not close the browser and visit other sites, you may become
+      victim of a CSRF attack.
+  It is recommended to never grant
+      the manager-script or manager-jmx
+      roles to users that have the manager-gui role.
+
+
+Note that JMX proxy interface is effectively low-level root-like
+administrative interface of Tomcat. One can do a lot, if one knows
+what commands to call. You should be cautious when enabling the
+manager-jmx role.
+
+To enable access to the Manager web application, you must either create
+a new username/password combination and associate one of the
+manager-xxx roles with it, or add a
+manager-xxx role
+to some existing username/password combination.
+As the majority of this document describes the using the text interface, this
+example will use the role name manager-script.
+Exactly how the usernames/passwords are configured depends on which
+Realm implementation you are using:
+
+UserDatabaseRealm plus MemoryUserDatabase, or MemoryRealm
+    — The UserDatabaseRealm and MemoryUserDatabase are
+    configured in the default $CATALINA_BASE/conf/server.xml.
+    Both MemoryUserDatabase and MemoryRealm read an
+    XML-format file by default stored at
+    $CATALINA_BASE/conf/tomcat-users.xml, which can be
+    edited with any text editor.  This file contains an XML
+    <user> for each individual user, which might
+    look something like this:
+<user username="craigmcc" password="secret" roles="standard,manager-script" />
+    which defines the username and password used by this individual to
+    log on, and the role names they are associated with.  You can
+    add the manager-script role to the comma-delimited
+    roles attribute for one or more existing users, and/or
+    create new users with that assigned role.
+DataSourceRealm or JDBCRealm
+    — Your user and role information is stored in
+    a database accessed via JDBC.  Add the manager-script role
+    to one or more existing users, and/or create one or more new users
+    with this role assigned, following the standard procedures for your
+    environment.
+JNDIRealm — Your user and role information is stored in
+    a directory server accessed via LDAP.  Add the
+    manager-script role to one or more existing users,
+    and/or create one or more new users with this role assigned, following
+    the standard procedures for your environment.
+
+
+The first time you attempt to issue one of the Manager commands
+described in the next section, you will be challenged to log on using
+BASIC authentication.  The username and password you enter do not matter,
+as long as they identify a valid user in the users database who possesses
+the role manager-script.
+
+In addition to the password restrictions, access to the Manager web
+application can be restricted by the remote IP address or host
+by adding a RemoteAddrValve or RemoteHostValve.
+See valves documentation
+for details. Here is
+an example of restricting access to the localhost by IP address:
+<Context privileged="true">
+         <Valve className="org.apache.catalina.valves.RemoteAddrValve"
+                allow="127\.0\.0\.1"/>
+</Context>
+
+
HTML User-friendly Interface

+
+The user-friendly HTML interface of Manager web application is located at
+
+http://{host}:{port}/manager/html
+
+As has already been mentioned above, you need manager-gui
+role to be allowed to access it. There is a separate document that provides
+help on this interface. See:
+
+
+  HTML Manager documentation
+
+
+The HTML interface is protected against CSRF (Cross-Site Request Forgery)
+attacks. Each access to the HTML pages generates a random token, which is
+stored in your session and is included in all links on the page. If your next
+action does not have correct value of the token, the action will be denied.
+If the token has expired you can start again from the main page or
+List Applications page of Manager.
+
+To customize the subtitle of the HTML interface of the Manager web application,
+you can add any valid xml escaped html code to the htmlSubTitle
+initialisation parameter of the HTMLManagerServlet
+
+
+<servlet>
+  <servlet-name>HTMLManager</servlet-name>
+  <servlet-class>org.apache.catalina.manager.HTMLManagerServlet</servlet-class>
+  <init-param>
+    <param-name>htmlSubTitle</param-name>
+    <param-value>Company Inc.&lt;br&gt;&lt;i style=&apos;color:red&apos;&gt;Staging&lt;/i&gt;</param-value>
+  </init-param>
+  ...
+</servlet>
+
+The above string value would unescape and be appended to the title
+
+Company Inc.<br><i style='color:red'>Staging</i>
+
+
Supported Manager Commands

+
+All commands that the Manager application knows how to process are
+specified in a single request URI like this:
+http://{host}:{port}/manager/text/{command}?{parameters}
+where {host} and {port} represent the hostname
+and port number on which Tomcat is running, {command}
+represents the Manager command you wish to execute, and
+{parameters} represents the query parameters
+that are specific to that command.  In the illustrations below, customize
+the host and port appropriately for your installation.
+
+The commands are usually executed by HTTP GET requests. The
+/deploy command has a form that is executed by an HTTP PUT request.
+
+Common Parameters

+
+Most commands accept one or more of the following query parameters:
+
+path - The context path (including the leading slash)
+    of the web application you are dealing with.  To select the ROOT web
+    application, specify "/".
+    

+    NOTE: It is not possible to perform administrative commands
+    on the Manager application itself.
+    

+    NOTE: If the path parameter is not explicitly specified
+    then the path and the version will be derived using the standard
+    Context naming rules from the
+    config parameter or, if the config parameter is not present, the war
+    parameter.
+version - The version of this web application as used by
+    the parallel deployment feature. If you
+    use parallel deployment wherever a path is required you must specify a
+    version in addition to the path and it is the combination of path and
+    version that must be unique rather than just the path.
+    

+    NOTE: If the path is not explicitly specified, the version
+    parameter is ignored.
+war - URL of a web application archive (WAR) file, or
+    pathname of a directory which contains the web application, or a
+    Context configuration ".xml" file.  You can use URLs in any of the
+    following formats:
+    
+    file:/absolute/path/to/a/directory - The absolute
+        path of a directory that contains the unpacked version of a web
+        application.  This directory will be attached to the context path
+        you specify without any changes.
+    file:/absolute/path/to/a/webapp.war - The absolute
+        path of a web application archive (WAR) file.  This is valid
+        only for the /deploy command, and is
+        the only acceptable format to that command.
+    file:/absolute/path/to/a/context.xml - The
+        absolute path of a web application Context configuration ".xml"
+        file which contains the Context configuration element.
+    directory - The directory name for the web
+        application context in the Host's application base directory.
+    webapp.war - The name of a web application war file
+        located in the Host's application base directory.
+    
+
+
+Each command will return a response in text/plain format
+(i.e. plain ASCII with no HTML markup), making it easy for both humans and
+programs to read).  The first line of the response will begin with either
+OK or FAIL, indicating whether the requested
+command was successful or not.  In the case of failure, the rest of the first
+line will contain a description of the problem that was encountered.  Some
+commands include additional lines of information as described below.
+
+Internationalization Note - The Manager application looks up
+its message strings in resource bundles, so it is possible that the strings
+have been translated for your platform.  The examples below show the English
+version of the messages.
+
+
+
+Deploy A New Application Archive (WAR) Remotely

+
+http://localhost:8080/manager/text/deploy?path=/foo
+
+Upload the web application archive (WAR) file that is specified as the
+request data in this HTTP PUT request, install it into the appBase
+directory of our corresponding virtual host, and start, deriving the name for
+the WAR file added to the appBase from the specified path. The
+application can later be undeployed (and the corresponding WAR file removed) by
+use of the /undeploy command.
+
+This command is executed by an HTTP PUT request.
+
+The .WAR file may include Tomcat specific deployment configuration, by
+including a Context configuration XML file in
+/META-INF/context.xml.
+
+URL parameters include:
+
+update: When set to true, any existing update will be
+    undeployed first. The default value is set to false.
+tag: Specifying a tag name, this allows associating the
+    deployed webapp with a tag or label. If the web application is undeployed,
+    it can be later redeployed when needed using only the tag.
+config : URL of a Context configuration ".xml" file in the
+    format file:/absolute/path/to/a/context.xml. This must be
+    the absolute path of a web application Context configuration ".xml" file
+    which contains the Context configuration element.
+
+
+NOTE - This command is the logical
+opposite of the /undeploy command.
+
+If installation and startup is successful, you will receive a response
+like this:
+OK - Deployed application at context path /foo
+
+Otherwise, the response will start with FAIL and include an
+error message.  Possible causes for problems include:
+
+Application already exists at path /foo
+    The context paths for all currently running web applications must be
+    unique.  Therefore, you must undeploy the existing web
+    application using this context path, or choose a different context path
+    for the new one. The update parameter may be specified as
+    a parameter on the URL, with a value of true to avoid this
+    error. In that case, an undeploy will be performed on an existing
+    application before performing the deployment.
+    
+Encountered exception
+    An exception was encountered trying to start the new web application.
+    Check the Tomcat logs for the details, but likely explanations include
+    problems parsing your /WEB-INF/web.xml file, or missing
+    classes encountered when initializing application event listeners and
+    filters.
+    
+
+
+
+
+Deploy A New Application from a Local Path

+
+Deploy and start a new web application, attached to the specified context
+path (which must not be in use by any other web application).
+This command is the logical opposite of the /undeploy command.
+
+This command is executed by an HTTP GET request.
+There are a number of different ways the deploy command can be used.
+
+Deploy a previously deployed webapp

+
+http://localhost:8080/manager/text/deploy?path=/footoo&tag=footag
+
+This can be used to deploy a previously deployed web application, which
+has been deployed using the tag attribute. Note that the work
+directory of the Manager webapp will contain the previously deployed WARs;
+removing it would make the deployment fail.
+
+
+
+Deploy a Directory or WAR by URL

+
+Deploy a web application directory or ".war" file located on the Tomcat
+server. If no path is specified, the path and version are derived
+from the directory name or the war file name. The war parameter
+specifies a URL (including the file: scheme) for either
+a directory or a web application archive (WAR) file. The supported syntax for
+a URL referring to a WAR file is described on the Javadocs page for the
+java.net.JarURLConnection class.  Use only URLs that refer to
+the entire WAR file.
+
+In this example the web application located in the directory
+/path/to/foo on the Tomcat server is deployed as the
+web application context named /footoo.
+http://localhost:8080/manager/text/deploy?path=/footoo&war=file:/path/to/foo
+
+
+In this example the ".war" file /path/to/bar.war on the
+Tomcat server is deployed as the web application context named
+/bar. Notice that there is no path parameter
+so the context path defaults to the name of the web application archive
+file without the ".war" extension.
+http://localhost:8080/manager/text/deploy?war=file:/path/to/bar.war
+
+
+
+Deploy a Directory or War from the Host appBase

+
+Deploy a web application directory or ".war" file located in your Host
+appBase directory. The path and optional version are derived from the directory
+or war file name.
+
+In this example the web application located in a sub directory named
+foo in the Host appBase directory of the Tomcat server is
+deployed as the web application context named /foo. Notice
+that the context path used is the name of the web application directory.
+http://localhost:8080/manager/text/deploy?war=foo
+
+
+In this example the ".war" file bar.war located in your
+Host appBase directory on the Tomcat server is deployed as the web
+application context named /bar.
+http://localhost:8080/manager/text/deploy?war=bar.war
+
+
+
+Deploy using a Context configuration ".xml" file

+
+If the Host deployXML flag is set to true you can deploy a web
+application using a Context configuration ".xml" file and an optional
+".war" file or web application directory. The context path
+is not used when deploying a web application using a context ".xml"
+configuration file.
+
+A Context configuration ".xml" file can contain valid XML for a
+web application Context just as if it were configured in your
+Tomcat server.xml configuration file. Here is an
+example:
+<Context path="/foobar" docBase="/path/to/application/foobar">
+</Context>
+
+
+When the optional war parameter is set to the URL
+for a web application ".war" file or directory it overrides any
+docBase configured in the context configuration ".xml" file.
+
+Here is an example of deploying an application using a Context
+configuration ".xml" file.
+http://localhost:8080/manager/text/deploy?config=file:/path/context.xml
+
+
+Here is an example of deploying an application using a Context
+configuration ".xml" file and a web application ".war" file located
+on the server.
+http://localhost:8080/manager/text/deploy
+ ?config=file:/path/context.xml&war=file:/path/bar.war
+
+
+
+Deployment Notes

+
+If the Host is configured with unpackWARs=true and you deploy a war
+file, the war will be unpacked into a directory in your Host appBase
+directory.
+
+If the application war or directory is installed in your Host appBase
+directory and either the Host is configured with autoDeploy=true or the
+Context path must match the directory name or war file name without the
+".war" extension.
+
+For security when untrusted users can manage web applications, the
+Host deployXML flag can be set to false.  This prevents untrusted users
+from deploying web applications using a configuration XML file and
+also prevents them from deploying application directories or ".war"
+files located outside of their Host appBase.
+
+
+
+Deploy Response

+
+If installation and startup is successful, you will receive a response
+like this:
+OK - Deployed application at context path /foo
+
+Otherwise, the response will start with FAIL and include an
+error message.  Possible causes for problems include:
+
+Application already exists at path /foo
+    The context paths for all currently running web applications must be
+    unique.  Therefore, you must undeploy the existing web
+    application using this context path, or choose a different context path
+    for the new one. The update parameter may be specified as
+    a parameter on the URL, with a value of true to avoid this
+    error. In that case, an undeploy will be performed on an existing
+    application before performing the deployment.
+    
+Document base does not exist or is not a readable directory
+    The URL specified by the war parameter must identify a
+    directory on this server that contains the "unpacked" version of a
+    web application, or the absolute URL of a web application archive (WAR)
+    file that contains this application.  Correct the value specified by
+    the war parameter.
+    
+Encountered exception
+    An exception was encountered trying to start the new web application.
+    Check the Tomcat logs for the details, but likely explanations include
+    problems parsing your /WEB-INF/web.xml file, or missing
+    classes encountered when initializing application event listeners and
+    filters.
+    
+Invalid application URL was specified
+    The URL for the directory or web application that you specified
+    was not valid.  Such URLs must start with file:, and URLs
+    for a WAR file must end in ".war".
+    
+Invalid context path was specified
+    The context path must start with a slash character. To reference the
+    ROOT web application use "/".
+    
+Context path must match the directory or WAR file name:
+    If the application war or directory is installed in your Host appBase
+    directory and either the Host is configured with autoDeploy=true the
+    Context path must match the directory name or war file name without
+    the ".war" extension.
+    
+Only web applications in the Host web application directory can
+     be installed
+     
+     If the Host deployXML flag is set to false this error will happen
+     if an attempt is made to deploy a web application directory or
+      ".war" file outside of the Host appBase directory.
+     
+
+
+
+
+
+List Currently Deployed Applications

+
+http://localhost:8080/manager/text/list
+
+List the context paths, current status (running or
+stopped), and number of active sessions for all currently
+deployed web applications.  A typical response immediately
+after starting Tomcat might look like this:
+OK - Listed applications for virtual host localhost
+/webdav:running:0:webdav
+/examples:running:0:examples
+/manager:running:0:manager
+/:running:0:ROOT
+/test:running:0:test##2
+/test:running:0:test##1
+
+
+
+Reload An Existing Application

+
+http://localhost:8080/manager/text/reload?path=/examples
+
+Signal an existing application to shut itself down and reload.  This can
+be useful when the web application context is not reloadable and you have
+updated classes or property files in the /WEB-INF/classes
+directory or when you have added or updated jar files in the
+/WEB-INF/lib directory.
+
+
+If this command succeeds, you will see a response like this:
+OK - Reloaded application at context path /examples
+
+Otherwise, the response will start with FAIL and include an
+error message.  Possible causes for problems include:
+
+Encountered exception
+    An exception was encountered trying to restart the web application.
+    Check the Tomcat logs for the details.
+    
+Invalid context path was specified
+    The context path must start with a slash character. To reference the
+    ROOT web application use "/".
+    
+No context exists for path /foo
+    There is no deployed application on the context path
+    that you specified.
+    
+No context path was specified
+    
+    The path parameter is required.
+    
+Reload not supported on WAR deployed at path /foo
+    
+    Currently, application reloading (to pick up changes to the classes or
+    web.xml file) is not supported when a web application is
+    deployed directly from a WAR file.  It only works when the web application
+    is deployed from an unpacked directory.  If you are using a WAR file,
+    you should undeploy and then deploy or
+    deploy with the update parameter the
+    application again to pick up your changes.
+    
+
+
+
+
+List OS and JVM Properties

+
+http://localhost:8080/manager/text/serverinfo
+
+Lists information about the Tomcat version, OS, and JVM properties.
+
+If an error occurs, the response will start with FAIL and
+include an error message.  Possible causes for problems include:
+
+Encountered exception
+    An exception was encountered trying to enumerate the system properties.
+    Check the Tomcat logs for the details.
+    
+
+
+
+
+List Available Global JNDI Resources

+
+http://localhost:8080/manager/text/resources[?type=xxxxx]
+
+List the global JNDI resources that are available for use in resource
+links for context configuration files.  If you specify the type
+request parameter, the value must be the fully qualified Java class name of
+the resource type you are interested in (for example, you would specify
+javax.sql.DataSource to acquire the names of all available
+JDBC data sources).  If you do not specify the type request
+parameter, resources of all types will be returned.
+
+Depending on whether the type request parameter is specified
+or not, the first line of a normal response will be:
+OK - Listed global resources of all types
+or
+OK - Listed global resources of type xxxxx
+followed by one line for each resource.  Each line is composed of fields
+delimited by colon characters (":"), as follows:
+
+Global Resource Name - The name of this global JNDI resource,
+    which would be used in the global attribute of a
+    <ResourceLink> element.
+Global Resource Type - The fully qualified Java class name of
+    this global JNDI resource.
+
+
+If an error occurs, the response will start with FAIL and
+include an error message.  Possible causes for problems include:
+
+Encountered exception
+    An exception was encountered trying to enumerate the global JNDI
+    resources.  Check the Tomcat logs for the details.
+    
+No global JNDI resources are available
+    The Tomcat server you are running has been configured without
+    global JNDI resources.
+    
+
+
+
+
+
+Session Statistics

+
+http://localhost:8080/manager/text/sessions?path=/examples
+
+Display the default session timeout for a web application, and the
+number of currently active sessions that fall within one-minute ranges of
+their actual timeout times.  For example, after restarting Tomcat and then
+executing one of the JSP samples in the /examples web app,
+you might get something like this:
+
+OK - Session information for application at context path /examples
+Default maximum session inactive interval 30 minutes
+<1 minutes: 1 sessions
+1 - <2 minutes: 1 sessions
+
+
+
+Expire Sessions

+
+http://localhost:8080/manager/text/expire?path=/examples&idle=num
+
+Display the session statistics (like the above /sessions
+command) and expire sessions that are idle for longer than num
+minutes. To expire all sessions, use &idle=0 .
+
+OK - Session information for application at context path /examples
+Default maximum session inactive interval 30 minutes
+1 - <2 minutes: 1 sessions
+3 - <4 minutes: 1 sessions
+>0 minutes: 2 sessions were expired
+
+Actually /sessions and /expire are synonyms for
+the same command. The difference is in the presence of idle
+parameter.
+
+
+
+Start an Existing Application

+
+http://localhost:8080/manager/text/start?path=/examples
+
+Signal a stopped application to restart, and make itself available again.
+Stopping and starting is useful, for example, if the database required by
+your application becomes temporarily unavailable.  It is usually better to
+stop the web application that relies on this database rather than letting
+users continuously encounter database exceptions.
+
+If this command succeeds, you will see a response like this:
+OK - Started application at context path /examples
+
+Otherwise, the response will start with FAIL and include an
+error message.  Possible causes for problems include:
+
+Encountered exception
+    An exception was encountered trying to start the web application.
+    Check the Tomcat logs for the details.
+    
+Invalid context path was specified
+    The context path must start with a slash character. To reference the
+    ROOT web application use "/".
+    
+No context exists for path /foo
+    There is no deployed application on the context path
+    that you specified.
+    
+No context path was specified
+    
+    The path parameter is required.
+    
+
+
+
+
+Stop an Existing Application

+
+http://localhost:8080/manager/text/stop?path=/examples
+
+Signal an existing application to make itself unavailable, but leave it
+deployed.  Any request that comes in while an application is
+stopped will see an HTTP error 404, and this application will show as
+"stopped" on a list applications command.
+
+If this command succeeds, you will see a response like this:
+OK - Stopped application at context path /examples
+
+Otherwise, the response will start with FAIL and include an
+error message.  Possible causes for problems include:
+
+Encountered exception
+    An exception was encountered trying to stop the web application.
+    Check the Tomcat logs for the details.
+    
+Invalid context path was specified
+    The context path must start with a slash character. To reference the
+    ROOT web application use "/".
+    
+No context exists for path /foo
+    There is no deployed application on the context path
+    that you specified.
+    
+No context path was specified
+    The path parameter is required.
+    
+
+
+
+
+
+Undeploy an Existing Application

+
+http://localhost:8080/manager/text/undeploy?path=/examples
+
+WARNING - This command will delete any web
+application artifacts that exist within appBase directory
+(typically "webapps") for this virtual host.
+This will delete the application .WAR, if present,
+the application directory resulting either from a deploy in unpacked form
+or from .WAR expansion as well as the XML Context definition from
+$CATALINA_BASE/conf/[enginename]/[hostname]/ directory.
+If you simply want to take an application
+out of service, you should use the /stop command instead.
+
+Signal an existing application to gracefully shut itself down, and
+remove it from Tomcat (which also makes this context path available for
+reuse later).  In addition, the document root directory is removed, if it
+exists in the appBase directory (typically "webapps") for
+this virtual host.  This command is the logical opposite of the
+/deploy command.
+
+If this command succeeds, you will see a response like this:
+OK - Undeployed application at context path /examples
+
+Otherwise, the response will start with FAIL and include an
+error message.  Possible causes for problems include:
+
+Encountered exception
+    An exception was encountered trying to undeploy the web application.
+    Check the Tomcat logs for the details.
+    
+Invalid context path was specified
+    The context path must start with a slash character. To reference the
+    ROOT web application use "/".
+    
+No context exists named /foo
+    There is no deployed application with the name that you specified.
+    
+No context path was specified
+    The path parameter is required.
+    
+
+
+
+
+Finding memory leaks

+
+http://localhost:8080/manager/text/findleaks[?statusLine=[true|false]]
+
+The find leaks diagnostic triggers a full garbage collection. It
+should be used with extreme caution on production systems.
+
+The find leaks diagnostic attempts to identify web applications that have
+caused memory leaks when they were stopped, reloaded or undeployed. Results
+should always be confirmed
+with a profiler. The diagnostic uses additional functionality provided by the
+StandardHost implementation. It will not work if a custom host is used that
+does not extend StandardHost.
+
+Explicitly triggering a full garbage collection from Java code is documented
+to be unreliable. Furthermore, depending on the JVM used, there are options to
+disable explicit GC triggering, like -XX:+DisableExplicitGC.
+If you want to make sure, that the diagnostics were successfully running a full
+GC, you will need to check using tools like GC logging, JConsole or similar.
+
+If this command succeeds, you will see a response like this:
+/leaking-webapp
+
+If you wish to see a status line included in the response then include the
+statusLine query parameter in the request with a value of
+true.
+
+Each context path for a web application that was stopped, reloaded or
+undeployed, but which classes from the previous runs are still loaded in memory,
+thus causing a memory leak, will be listed on a new line. If an application
+has been reloaded several times, it may be listed several times.
+
+If the command does not succeed, the response will start with
+FAIL and include an error message.
+
+
+
+Connector SSL/TLS cipher information

+
+http://localhost:8080/manager/text/sslConnectorCiphers
+
+The SSL Connector/Ciphers diagnostic lists the SSL/TLS ciphers that are currently
+configured for each connector. For NIO and NIO2, the names of the individual
+cipher suites are listed. For APR, the value of SSLCipherSuite is returned.
+
+The response will look something like this:
+OK - Connector / SSL Cipher information
+Connector[HTTP/1.1-8080]
+  SSL is not enabled for this connector
+Connector[HTTP/1.1-8443]
+  TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
+  TLS_DHE_RSA_WITH_AES_128_CBC_SHA
+  TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
+  TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
+  ...
+
+
+
+Connector SSL/TLS certificate chain information

+
+http://localhost:8080/manager/text/sslConnectorCerts
+
+The SSL Connector/Certs diagnostic lists the certificate chain that is
+currently configured for each virtual host.
+
+The response will look something like this:
+OK - Connector / Certificate Chain information
+Connector[HTTP/1.1-8080]
+SSL is not enabled for this connector
+Connector[HTTP/1.1-8443]-_default_-RSA
+[
+[
+  Version: V3
+  Subject: CN=localhost, OU=Apache Tomcat PMC, O=The Apache Software Foundation, L=Wakefield, ST=MA, C=US
+  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
+  ...
+
+
+
+Connector SSL/TLS trusted certificate information

+
+http://localhost:8080/manager/text/sslConnectorTrustedCerts
+
+The SSL Connector/Certs diagnostic lists the trusted certificates that are
+currently configured for each virtual host.
+
+The response will look something like this:
+OK - Connector / Trusted Certificate information
+Connector[HTTP/1.1-8080]
+SSL is not enabled for this connector
+Connector[HTTP/1.1-8443]-_default_
+[
+[
+  Version: V3
+  Subject: CN=Apache Tomcat Test CA, OU=Apache Tomcat PMC, O=The Apache Software Foundation, L=Wakefield, ST=MA, C=US
+  ...
+
+
+
+Reload TLS configuration

+
+http://localhost:8080/manager/text/sslReload?tlsHostName=name
+
+Reload the TLS configuration files (the certificate and key files, this does
+not trigger a re-parsing of server.xml). To reload the files for all hosts don't
+specify the tlsHostName parameter.
+
+OK - Reloaded TLS configuration for [_default_]
+
+
+
+Thread Dump

+
+http://localhost:8080/manager/text/threaddump
+
+Write a JVM thread dump.
+
+The response will look something like this:
+OK - JVM thread dump
+2014-12-08 07:24:40.080
+Full thread dump Java HotSpot(TM) Client VM (25.25-b02 mixed mode):
+
+"http-nio-8080-exec-2" Id=26 cpu=46800300 ns usr=46800300 ns blocked 0 for -1 ms waited 0 for -1 ms
+   java.lang.Thread.State: RUNNABLE
+        locks java.util.concurrent.ThreadPoolExecutor$Worker@1738ad4
+        at sun.management.ThreadImpl.dumpThreads0(Native Method)
+        at sun.management.ThreadImpl.dumpAllThreads(ThreadImpl.java:446)
+        at org.apache.tomcat.util.Diagnostics.getThreadDump(Diagnostics.java:440)
+        at org.apache.tomcat.util.Diagnostics.getThreadDump(Diagnostics.java:409)
+        at org.apache.catalina.manager.ManagerServlet.threadDump(ManagerServlet.java:557)
+        at org.apache.catalina.manager.ManagerServlet.doGet(ManagerServlet.java:371)
+        at javax.servlet.http.HttpServlet.service(HttpServlet.java:618)
+        at javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
+...
+
+
+
+
+VM Info

+
+http://localhost:8080/manager/text/vminfo
+
+Write some diagnostic information about Java Virtual Machine.
+
+The response will look something like this:
+OK - VM info
+2014-12-08 07:27:32.578
+Runtime information:
+  vmName: Java HotSpot(TM) Client VM
+  vmVersion: 25.25-b02
+  vmVendor: Oracle Corporation
+  specName: Java Virtual Machine Specification
+  specVersion: 1.8
+  specVendor: Oracle Corporation
+  managementSpecVersion: 1.2
+  name: ...
+  startTime: 1418012458849
+  uptime: 393855
+  isBootClassPathSupported: true
+
+OS information:
+...
+
+
+
+
+Save Configuration

+
+http://localhost:8080/manager/text/save
+
+If specified without any parameters, this command saves the current
+configuration of the server to server.xml. The existing file will be renamed as
+a backup if required.
+
+If specified with a path parameter that matches the path of
+a deployed web application then the configuration for that web application will
+be saved to an appropriately named context.xml file in the xmlBase
+for the current Host.
+
+To use the command a StoreConfig MBean must be present. Typically this is
+configured using the StoreConfigLifecycleListener.
+
+
+If the command does not succeed, the response will start with
+FAIL and include an error message.
+
+
+
+
Server Status

+
+From the following links you can view Status information about the server.
+The manager-status role or any one of the other
+manager-xxx roles allow access to this page.
+
+http://localhost:8080/manager/status
+http://localhost:8080/manager/status/all
+
+Displays server status information in HTML format.
+
+http://localhost:8080/manager/status?XML=true
+
+Displays server status information in XML format. The XML format does
+not include the detailed per web application statistics.
+
+http://localhost:8080/manager/status?JSON=true
+http://localhost:8080/manager/status/all?JSON=true
+
+Displays server status information in JSON format. The JSON format does
+not include the per thread state information. If using a client visualization
+tool for active monitoring and server status alerts (such as Grafana), the JSON
+output provided by the Manager will likely provide the easiest and most secure
+solution.
+
+First, you have the server and JVM version number, JVM provider, OS name
+and number followed by the architecture type.
+
+Second, there is information about the memory usage of the JVM.
+
+Then, there is information about the Tomcat AJP and HTTP connectors.
+The same information is available for both of them :
+
+
+    Threads information : Max threads, min and max spare threads,
+    current thread count and current thread busy.
+    Request information : Max processing time and processing time,
+    request and error count, bytes received and sent.
+    If not using the JSON format, the state of threads with Stage,
+    Time, Bytes Sent, Bytes Receive, Client, VHost and Request.
+    All existing threads are listed in the table.
+    Here is the list of the possible thread stages :
+    
+        "Parse and Prepare Request" : The request headers are
+        being parsed or the necessary preparation to read the request body (if
+        a transfer encoding has been specified) is taking place.
+        "Service" : The thread is processing a request and
+        generating the response. This stage follows the "Parse and Prepare
+        Request" stage and precedes the "Finishing" stage. There is always at
+        least one thread in this stage (the server-status page).
+        "Finishing" : The end of the request processing. Any
+        remainder of the response still in the output buffers is sent to the
+        client. This stage is followed by "Keep-Alive" if it is appropriate to
+        keep the connection alive or "Ready" if "Keep-Alive" is not
+        appropriate.
+        "Keep-Alive" : The thread keeps the connection open to
+        the client in case the client sends another request. If another request
+        is received, the next stage will be "Parse and Prepare Request". If no
+        request is received before the keep alive times out, the connection will
+        be closed and the next stage will be "Ready".
+        "Ready" : The thread is at rest and ready to be
+        used.
+    
+    
+
+
+If you are using /status/all command, additional information
+on each of deployed web applications will be available, except for the XML
+format.
+
+
Using the JMX Proxy Servlet

+
+  What is JMX Proxy Servlet

+    The JMX Proxy Servlet is a lightweight proxy to get and set the
+    tomcat internals. (Or any class that has been exposed via an MBean)
+    Its usage is not very user friendly but the UI is
+    extremely helpful for integrating command line scripts for monitoring
+    and changing the internals of tomcat. You can do two things with the proxy:
+    get information and set information. For you to really understand the
+    JMX Proxy Servlet, you should have a general understanding of JMX.
+    If you don't know what JMX is, then prepare to be confused.
+  
+
+  JMX Query command

+    This takes the form:
+http://webserver/manager/jmxproxy/?qry=STUFF
+    Where STUFF is the JMX query you wish to perform. For example,
+    here are some queries you might wish to run:
+    
+      
+        qry=*%3Atype%3DRequestProcessor%2C* -->
+         type=RequestProcessor which will locate all
+         workers which can process requests and report
+         their state.
+      
+      
+        qry=*%3Aj2eeType=Servlet%2c* -->
+            j2eeType=Servlet which return all loaded servlets.
+      
+      
+        qry=Catalina%3Atype%3DEnvironment%2Cresourcetype%3DGlobal%2Cname%3DsimpleValue -->
+            Catalina:type=Environment,resourcetype=Global,name=simpleValue
+            which look for a specific MBean by the given name.
+      
+    
+    
+    You'll need to experiment with this to really understand its capabilities
+    If you provide no qry parameter, then all of the MBeans will
+    be displayed. We really recommend looking at the tomcat source code and
+    understand the JMX spec to get a better understanding of all the queries
+    you may run.
+    
+  
+
+  JMX Get command

+  
+    The JXMProxyServlet also supports a "get" command that you can use to
+    fetch the value of a specific MBean's attribute. The general form of
+    the get command is:
+  
+
+http://webserver/manager/jmxproxy/?get=BEANNAME&att=MYATTRIBUTE&key=MYKEY
+
+    You must provide the following parameters:
+    
+      get: The full bean name
+      att: The attribute you wish to fetch
+      key: (optional) The key into a CompositeData MBean attribute
+    
+    
+    If all goes well, then it will say OK, otherwise an error message will
+    be shown. For example, let's say we wish to fetch the current heap memory
+    data:
+    
+
+http://webserver/manager/jmxproxy/?get=java.lang:type=Memory&att=HeapMemoryUsage
+
+    Or, if you only want the "used" key:
+
+http://webserver/manager/jmxproxy/
+ ?get=java.lang:type=Memory&att=HeapMemoryUsage&key=used
+  
+
+  JMX Set command

+    
+    Now that you can query an MBean, its time to muck with Tomcat's internals!
+    The general form of the set command is :
+    
+http://webserver/manager/jmxproxy/?set=BEANNAME&att=MYATTRIBUTE&val=NEWVALUE
+    So you need to provide 3 request parameters:
+    
+      set: The full bean name
+      att: The attribute you wish to alter
+      val: The new value 
+    
+    
+    If all goes ok, then it will say OK, otherwise an error message will be
+    shown. For example, lets say we wish to turn up debugging on the fly for the
+    ErrorReportValve. The following will set debugging to 10.
+    
+http://localhost:8080/manager/jmxproxy/
+ ?set=Catalina%3Atype%3DValve%2Cname%3DErrorReportValve%2Chost%3Dlocalhost
+ &att=debug&val=10
+    and my result is (YMMV):
+Result: ok
+
+    Here is what I see if I pass in a bad value. Here is the URL I used,
+    I try set debugging equal to 'cow':
+http://localhost:8080/manager/jmxproxy/
+ ?set=Catalina%3Atype%3DValve%2Cname%3DErrorReportValve%2Chost%3Dlocalhost
+ &att=debug&val=cow
+    When I try that, my result is
+Error: java.lang.NumberFormatException: For input string: "cow"
+  
+
+  JMX Invoke command

+    The invoke command enables methods to be called on MBeans. The
+    general form of the command is:
+http://webserver/manager/jmxproxy/
+ ?invoke=BEANNAME&op=METHODNAME&ps=COMMASEPARATEDPARAMETERS
+    For example, to call the findConnectors() method of the
+    Service use:
+http://localhost:8080/manager/jmxproxy/
+ ?invoke=Catalina%3Atype%3DService&op=findConnectors&ps=
+  
+
Executing Manager Commands With Ant

+
+In addition to the ability to execute Manager commands via HTTP requests,
+as documented above, Tomcat includes a convenient set of Task definitions
+for the Ant (version 1.4 or later) build tool.  In order to use these
+commands, you must perform the following setup operations:
+
+Download the binary distribution of Ant from
+    https://ant.apache.org.
+    You must use version 1.4 or later.
+Install the Ant distribution in a convenient directory (called
+    ANT_HOME in the remainder of these instructions).
+Add the $ANT_HOME/bin directory to your PATH
+    environment variable.
+Configure at least one username/password combination in your Tomcat
+    user database that includes the manager-script role.
+
+
+To use custom tasks within Ant, you must declare them first with an
+<import> element.  Therefore, your build.xml
+file might look something like this:
+
+<project name="My Application" default="compile" basedir=".">
+
+  <!-- Configure the directory into which the web application is built -->
+  <property name="build"    value="${basedir}/build"/>
+
+  <!-- Configure the context path for this application -->
+  <property name="path"     value="/myapp"/>
+
+  <!-- Configure properties to access the Manager application -->
+  <property name="url"      value="http://localhost:8080/manager/text"/>
+  <property name="username" value="myusername"/>
+  <property name="password" value="mypassword"/>
+
+  <!-- Configure the path to the Tomcat installation -->
+  <property name="catalina.home" value="/usr/local/apache-tomcat"/>
+
+  <!-- Configure the custom Ant tasks for the Manager application -->
+  <import file="${catalina.home}/bin/catalina-tasks.xml"/>
+
+  <!-- Executable Targets -->
+  <target name="compile" description="Compile web application">
+    <!-- ... construct web application in ${build} subdirectory, and
+            generated a ${path}.war ... -->
+  </target>
+
+  <target name="deploy" description="Install web application"
+          depends="compile">
+    <deploy url="${url}" username="${username}" password="${password}"
+            path="${path}" war="file:${build}${path}.war"/>
+  </target>
+
+  <target name="reload" description="Reload web application"
+          depends="compile">
+    <reload  url="${url}" username="${username}" password="${password}"
+            path="${path}"/>
+  </target>
+
+  <target name="undeploy" description="Remove web application">
+    <undeploy url="${url}" username="${username}" password="${password}"
+            path="${path}"/>
+  </target>
+
+</project>
+
+Note: The definition of the resources task via the import above will override
+the resources datatype added in Ant 1.7. If you wish to use the resources
+datatype you will need to use Ant's namespace support to modify
+catalina-tasks.xml to assign the Tomcat tasks to their own
+namespace.
+
+Now, you can execute commands like ant deploy to deploy the
+application to a running instance of Tomcat, or ant reload to
+tell Tomcat to reload it.  Note also that most of the interesting values in
+this build.xml file are defined as replaceable properties, so
+you can override their values from the command line.  For example, you might
+consider it a security risk to include the real manager password in your
+build.xml file's source code.  To avoid this, omit the password
+property, and specify it from the command line:
+ant -Dpassword=secret deploy
+
+Tasks output capture

+
+Using Ant version 1.6.2 or later,
+the Catalina tasks offer the option to capture their output in
+properties or external files. They support directly the following subset of the
+<redirector> type attributes:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Attribute Description Required
output Name of a file to which to write the output. If
+the error stream is not also redirected to a file or property, it will
+appear in this output. No
error The file to which the standard error of the
+command should be redirected. No
logError This attribute is used when you wish to see
+error output in Ant's log and you are redirecting output to a
+file/property. The error output will not be included in the output
+file/property. If you redirect error with the error or errorProperty
+attributes, this will have no effect. No
append Whether output and error files should be
+appended to or overwritten. Defaults to false. No
createemptyfiles Whether output and error files should be created
+even when empty. Defaults to true. No
outputproperty The name of a property in which the output of
+the command should be stored. Unless the error stream is redirected to
+a separate file or stream, this property will include the error output. No
errorproperty The name of a property in which the standard
+error of the command should be stored. No
+
+A couple of additional attributes can also be specified:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Attribute Description Required
alwaysLog This attribute is used when you wish to see the
+output you are capturing, appearing also in the Ant's log. It must not be
+used unless you are capturing task output.
+Defaults to false.
+This attribute will be supported directly by <redirector>
+in Ant 1.6.3 No
failonerror This attribute is used when you wish to avoid that
+any manager command processing error terminates the ant execution. Defaults to true.
+It must be set to false, if you want to capture error output,
+otherwise execution will terminate before anything can be captured.
+

+This attribute acts only on manager command execution,
+any wrong or missing command attribute will still cause Ant execution termination.
+ No
+
+They also support the embedded <redirector> element
+in which you can specify
+its full set of attributes, but input, inputstring and
+inputencoding that, even if accepted, are not used because they have
+no meaning in this context.
+Refer to ant manual for details on
+<redirector> element attributes.
+
+
+
+Here is a sample build file extract that shows how this output redirection support
+can be used:
+
+
+    <target name="manager.deploy"
+        depends="context.status"
+        if="context.notInstalled">
+        <deploy url="${mgr.url}"
+            username="${mgr.username}"
+            password="${mgr.password}"
+            path="${mgr.context.path}"
+            config="${mgr.context.descriptor}"/>
+    </target>
+
+    <target name="manager.deploy.war"
+        depends="context.status"
+        if="context.deployable">
+        <deploy url="${mgr.url}"
+            username="${mgr.username}"
+            password="${mgr.password}"
+            update="${mgr.update}"
+            path="${mgr.context.path}"
+            war="${mgr.war.file}"/>
+    </target>
+
+    <target name="context.status">
+        <property name="running" value="${mgr.context.path}:running"/>
+        <property name="stopped" value="${mgr.context.path}:stopped"/>
+
+        <list url="${mgr.url}"
+            outputproperty="ctx.status"
+            username="${mgr.username}"
+            password="${mgr.password}">
+        </list>
+
+        <condition property="context.running">
+            <contains string="${ctx.status}" substring="${running}"/>
+        </condition>
+        <condition property="context.stopped">
+            <contains string="${ctx.status}" substring="${stopped}"/>
+        </condition>
+        <condition property="context.notInstalled">
+            <and>
+                <isfalse value="${context.running}"/>
+                <isfalse value="${context.stopped}"/>
+            </and>
+        </condition>
+        <condition property="context.deployable">
+            <or>
+                <istrue value="${context.notInstalled}"/>
+                <and>
+                    <istrue value="${context.running}"/>
+                    <istrue value="${mgr.update}"/>
+                </and>
+                <and>
+                    <istrue value="${context.stopped}"/>
+                    <istrue value="${mgr.update}"/>
+                </and>
+            </or>
+        </condition>
+        <condition property="context.undeployable">
+            <or>
+                <istrue value="${context.running}"/>
+                <istrue value="${context.stopped}"/>
+            </or>
+        </condition>
+    </target>
+
+WARNING: even if it doesn't make many sense, and is always a bad idea,
+calling a Catalina task more than once,
+badly set Ant tasks depends chains may cause that a task be called
+more than once in the same Ant run, even if not intended to. A bit of caution should be exercised when you are
+capturing output from that task, because this could lead to something unexpected:
+
+when capturing in a property you will find in it only the output from the first call, because
+Ant properties are immutable and once set they cannot be changed,
+
+when capturing in a file, each run will overwrite it and you will find in it only the last call
+output, unless you are using the append="true" attribute, in which case you will
+see the output of each task call appended to the file.
+
+
+
+
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/maven-jars.html b/apache-tomcat-9.0.109/webapps/docs/maven-jars.html
new file mode 100644
index 0000000..367c6fe
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/maven-jars.html
@@ -0,0 +1,31 @@
+
+Apache Tomcat 9 (9.0.109) - Apache Tomcat - Using Tomcat libraries with Maven
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Apache Tomcat - Using Tomcat libraries with Maven
Table of Contents

+Using Tomcat libraries With MavenTomcat Snapshots
Tomcat Releases
+
Using Tomcat libraries With Maven

+    Tomcat Snapshots

+      Tomcat snapshots are located in the
+      Apache Snapshot Repository.
+      The official URL is https://repository.apache.org/content/repositories/snapshots/org/apache/tomcat/
+      
+        Snapshots are done periodically, not on a regular basis, but when changes happen and the Tomcat team deems a new snapshot might
+        useful.
+      
+    
+    Tomcat Releases

+      
+        Stable releases are published to the
+        Maven
+        Central Repository. The URL for this is
+      
+      https://repo.maven.apache.org/maven2/org/apache/tomcat/
+    
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/mbeans-descriptors-howto.html b/apache-tomcat-9.0.109/webapps/docs/mbeans-descriptors-howto.html
new file mode 100644
index 0000000..b0aaa73
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/mbeans-descriptors-howto.html
@@ -0,0 +1,56 @@
+
+Apache Tomcat 9 (9.0.109) - MBeans Descriptors How To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
MBeans Descriptors How To
Table of Contents

+Introduction
Adding MBean descriptions
+
Introduction

+
+Tomcat uses JMX MBeans as the technology for implementing
+manageability of Tomcat.
+
+The descriptions of JMX MBeans for Catalina are in the mbeans-descriptors.xml
+file in each package.
+
+You will need to add MBean descriptions for your custom components
+in order to avoid a "ManagedBean is not found" exception.
+
+
Adding MBean descriptions

+
+You may also add MBean descriptions for custom components in
+an mbeans-descriptors.xml file, located in the same package as the class files
+it describes.
+
+The permitted syntax for the mbeans-descriptors.xml is defined by
+the DTD file.
+
+The entries for a custom LDAP authentication Realm may look like this:
+
+  <mbean         name="LDAPRealm"
+            className="org.apache.catalina.mbeans.ClassNameMBean"
+          description="Custom LDAPRealm"
+               domain="Catalina"
+                group="Realm"
+                 type="com.myfirm.mypackage.LDAPRealm">
+
+    <attribute   name="className"
+          description="Fully qualified class name of the managed object"
+                 type="java.lang.String"
+            writeable="false"/>
+
+    <attribute   name="debug"
+          description="The debugging detail level for this component"
+                 type="int"/>
+    .
+    .
+    .
+
+  </mbean>
+
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/mbeans-descriptors.dtd b/apache-tomcat-9.0.109/webapps/docs/mbeans-descriptors.dtd
new file mode 100644
index 0000000..4c1f523
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/mbeans-descriptors.dtd
@@ -0,0 +1,246 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+ 
+ 
+ 
+ 
+ 
+ 
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+
+
+
+ 
+ 
+
+
+
+
+
+
+ 
+
+
+
+
+
+
+
+
+
+
+
+
+ 
+ 
+
+
+
+
+
+
+ 
+ 
diff --git a/apache-tomcat-9.0.109/webapps/docs/monitoring.html b/apache-tomcat-9.0.109/webapps/docs/monitoring.html
new file mode 100644
index 0000000..78f5429
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/monitoring.html
@@ -0,0 +1,1122 @@
+
+Apache Tomcat 9 (9.0.109) - Monitoring and Managing Tomcat
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Monitoring and Managing Tomcat
Table of Contents

+Introduction
Enabling JMX Remote
Manage Tomcat with JMX remote Ant Tasks
JMXAccessorOpenTask - JMX open connection task
JMXAccessorGetTask:  get attribute value Ant task
JMXAccessorSetTask:  set attribute value Ant task
JMXAccessorInvokeTask:  invoke MBean operation Ant task
JMXAccessorQueryTask:  query MBean Ant task
JMXAccessorCreateTask:  remote create MBean Ant task
JMXAccessorUnregisterTask:  remote unregister MBean Ant task
JMXAccessorCondition:  express condition
JMXAccessorEqualsCondition:  equals MBean Ant condition
Using the JMXProxyServlet
+
Introduction

+
+  Monitoring is a key aspect of system administration. Looking inside a
+     running server, obtaining some statistics or reconfiguring some aspects of
+     an application are all daily administration tasks.
+
+  
Enabling JMX Remote

+
+    Note: This configuration is needed only if you are
+    going to monitor Tomcat remotely. It is not needed if you are going
+    to monitor it locally, using the same user that Tomcat runs with.
+
+    The Oracle website includes the list of options and how to configure
+    JMX Remote on Java 8:
+        
+        http://docs.oracle.com/javase/6/docs/technotes/guides/management/agent.html.
+    
+    The following is a quick configuration guide for Java 8:
+    Add the following parameters to setenv.bat script of your
+    Tomcat (see RUNNING.txt for details).

+    Note: This syntax is for Microsoft Windows. The command has
+    to be on the same line. It is wrapped to be more readable. If Tomcat is
+    running as a Windows service, use its configuration dialog to set
+    java options for the service.
+    For Linux, MacOS, etc, remove "set " from beginning of the
+    line.
+    
+set CATALINA_OPTS=-Dcom.sun.management.jmxremote.port=%my.jmx.port%
+  -Dcom.sun.management.jmxremote.rmi.port=%my.rmi.port%
+  -Dcom.sun.management.jmxremote.ssl=false
+  -Dcom.sun.management.jmxremote.authenticate=false
+If you don't set com.sun.management.jmxremote.rmi.port then the
+JSR 160 JMX-Adaptor will select a port at random which will may it difficult to
+configure a firewall to allow access.
+
+If you require TLS:
+    
+    change and add this:
+  -Dcom.sun.management.jmxremote.ssl=true
+  -Dcom.sun.management.jmxremote.registry.ssl=true
+
+    to configure the protocols and/or cipher suites use:
+  -Dcom.sun.management.jmxremote.ssl.enabled.protocols=%my.jmx.ssl.protocols%
+  -Dcom.sun.management.jmxremote.ssl.enabled.cipher.suites=%my.jmx.cipher.suites%
+
+    to client certificate authentication use:
+  -Dcom.sun.management.jmxremote.ssl.need.client.auth=%my.jmx.ssl.clientauth%
+    
+If you require authorization (it is strongly recommended that TLS is always
+used with authentication):
+    
+    change and add this:
+  -Dcom.sun.management.jmxremote.authenticate=true
+  -Dcom.sun.management.jmxremote.password.file=../conf/jmxremote.password
+  -Dcom.sun.management.jmxremote.access.file=../conf/jmxremote.access
+    
+    edit the access authorization file $CATALINA_BASE/conf/jmxremote.access:
+monitorRole readonly
+controlRole readwrite
+    
+    edit the password file $CATALINA_BASE/conf/jmxremote.password:
+monitorRole tomcat
+controlRole tomcat
+    Tip: The password file should be read-only and only accessible by the
+    operating system user Tomcat is running as.
+    
+    Alternatively, you can configure a JAAS login module with:
+  -Dcom.sun.management.jmxremote.login.config=%login.module.name%
+    
+
+If you need to specify a host name to be used in the RMI stubs sent to the
+client (e.g. because the public host name that must be used to connect is not
+the same as the local host name) then you can set:
+set CATALINA_OPTS=-Djava.rmi.server.hostname
+
+If you need to specify a specific interface for the JMX service to bind to
+then you can set:
+set CATALINA_OPTS=-Dcom.sun.management.jmxremote.host
+
+  
Manage Tomcat with JMX remote Ant Tasks

+   To simplify JMX usage with Ant, a set of tasks is provided that may
+   be used with antlib.
+   antlib: Copy your catalina-ant.jar from $CATALINA_HOME/lib to $ANT_HOME/lib.
+   The following example shows the JMX Accessor usage:

+   Note: The name attribute value was wrapped here to be
+   more readable. It has to be all on the same line, without spaces.
+   <project name="Catalina Ant JMX"
+      xmlns:jmx="antlib:org.apache.catalina.ant.jmx"
+      default="state"
+      basedir=".">
+  <property name="jmx.server.name" value="localhost" />
+  <property name="jmx.server.port" value="9012" />
+  <property name="cluster.server.address" value="192.168.1.75" />
+  <property name="cluster.server.port" value="9025" />
+
+  <target name="state" description="Show JMX Cluster state">
+    <jmx:open
+      host="${jmx.server.name}"
+      port="${jmx.server.port}"
+      username="controlRole"
+      password="tomcat"/>
+    <jmx:get
+      name=
+"Catalina:type=IDataSender,host=localhost,
+senderAddress=${cluster.server.address},senderPort=${cluster.server.port}"
+      attribute="connected"
+      resultproperty="IDataSender.backup.connected"
+      echo="false"
+    />
+    <jmx:get
+      name="Catalina:type=ClusterSender,host=localhost"
+      attribute="senderObjectNames"
+      resultproperty="senderObjectNames"
+      echo="false"
+    />
+    <!-- get current maxActiveSession from ClusterTest application
+       echo it to Ant output and store at
+       property <em>clustertest.maxActiveSessions.original</em>
+    -->
+    <jmx:get
+      name="Catalina:type=Manager,context=/ClusterTest,host=localhost"
+      attribute="maxActiveSessions"
+      resultproperty="clustertest.maxActiveSessions.original"
+      echo="true"
+    />
+    <!-- set maxActiveSession to 100
+    -->
+    <jmx:set
+      name="Catalina:type=Manager,context=/ClusterTest,host=localhost"
+      attribute="maxActiveSessions"
+      value="100"
+      type="int"
+    />
+    <!-- get all sessions and split result as delimiter <em>SPACE</em> for easy
+       access all session ids directly with Ant property sessions.[0..n].
+    -->
+    <jmx:invoke
+      name="Catalina:type=Manager,context=/ClusterTest,host=localhost"
+      operation="listSessionIds"
+      resultproperty="sessions"
+      echo="false"
+      delimiter=" "
+    />
+    <!-- Access session attribute <em>Hello</em> from first session.
+    -->
+    <jmx:invoke
+      name="Catalina:type=Manager,context=/ClusterTest,host=localhost"
+      operation="getSessionAttribute"
+      resultproperty="Hello"
+      echo="false"
+    >
+      <arg value="${sessions.0}"/>
+      <arg value="Hello"/>
+    </jmx:invoke>
+    <!-- Query for all application manager.of the server from all hosts
+       and bind all attributes from all found manager MBeans.
+    -->
+    <jmx:query
+      name="Catalina:type=Manager,*"
+      resultproperty="manager"
+      echo="true"
+      attributebinding="true"
+    />
+    <!-- echo the create properties -->
+<echo>
+senderObjectNames: ${senderObjectNames.0}
+IDataSender.backup.connected: ${IDataSender.backup.connected}
+session: ${sessions.0}
+manager.length: ${manager.length}
+manager.0.name: ${manager.0.name}
+manager.1.name: ${manager.1.name}
+hello: ${Hello}
+manager.ClusterTest.0.name: ${manager.ClusterTest.0.name}
+manager.ClusterTest.0.activeSessions: ${manager.ClusterTest.0.activeSessions}
+manager.ClusterTest.0.counterSend_EVT_SESSION_EXPIRED:
+ ${manager.ClusterTest.0.counterSend_EVT_SESSION_EXPIRED}
+manager.ClusterTest.0.counterSend_EVT_GET_ALL_SESSIONS:
+ ${manager.ClusterTest.0.counterSend_EVT_GET_ALL_SESSIONS}
+</echo>
+
+  </target>
+
+</project>
+   import: Import the JMX Accessor Project with
+   <import file="${CATALINA.HOME}/bin/catalina-tasks.xml" /> and
+   reference the tasks with jmxOpen, jmxSet, jmxGet,
+   jmxQuery, jmxInvoke, jmxEquals and jmxCondition.
+
+  
JMXAccessorOpenTask - JMX open connection task

+
+List of Attributes
+
+
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+Attribute Description Default value
url Set JMX connection URL - service:jmx:rmi:///jndi/rmi://localhost:8050/jmxrmi
+    
host Set the host, shortcut the very long URL syntax.
+    localhost
port Set the remote connection port
+    8050
username remote JMX connection user name.
+    
password remote JMX connection password.
+    
ref Name of the internal connection reference. With this attribute you can
+        configure more the one connection inside the same Ant project.
+    jmx.server
echo Echo the command usage (for access analysis or debugging)
+    false
if Only execute if a property of the given name exists in the current project.
+    
unless Only execute if a property of the given name not exists in the current project.
+    
+
+
+Example to open a new JMX connection
+
+  <jmx:open
+    host="${jmx.server.name}"
+    port="${jmx.server.port}"
+  />
+
+
+Example to open a JMX connection from URL, with authorization and
+store at other reference
+
+  <jmx:open
+    url="service:jmx:rmi:///jndi/rmi://localhost:9024/jmxrmi"
+    ref="jmx.server.9024"
+    username="controlRole"
+    password="tomcat"
+  />
+
+
+Example to open a JMX connection from URL, with authorization and
+store at other reference, but only when property jmx.if exists and
+jmx.unless not exists
+
+  <jmx:open
+    url="service:jmx:rmi:///jndi/rmi://localhost:9024/jmxrmi"
+    ref="jmx.server.9024"
+    username="controlRole"
+    password="tomcat"
+    if="jmx.if"
+    unless="jmx.unless"
+  />
+
+Note: All properties from jmxOpen task also exists at all
+other tasks and conditions.
+
+
+
JMXAccessorGetTask:  get attribute value Ant task

+
+List of Attributes
+
+
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+Attribute Description Default value
name Full qualified JMX ObjectName -- Catalina:type=Server
+    
attribute Existing MBean attribute (see Tomcat MBean description above)
+    
ref JMX Connection reference
+    jmx.server
echo Echo command usage (access and result)
+    false
resultproperty Save result at this project property
+    
delimiter Split result with delimiter (java.util.StringTokenizer)
+        and use resultproperty as prefix to store tokens.
+    
separatearrayresults When return value is an array, save result as property list
+    ($resultproperty.[0..N] and $resultproperty.length)
+    true
+
+
+Example to get remote MBean attribute from default JMX connection
+
+  <jmx:get
+    name="Catalina:type=Manager,context=/servlets-examples,host=localhost"
+    attribute="maxActiveSessions"
+    resultproperty="servlets-examples.maxActiveSessions"
+  />
+
+
+Example to get and result array and split it at separate properties
+
+  <jmx:get
+      name="Catalina:type=ClusterSender,host=localhost"
+      attribute="senderObjectNames"
+      resultproperty="senderObjectNames"
+  />
+
+Access the senderObjectNames properties with:
+
+  ${senderObjectNames.length} give the number of returned sender list.
+  ${senderObjectNames.[0..N]} found all sender object names
+
+
+
+Example to get IDataSender attribute connected only when cluster is configured.

+Note: The name attribute value was wrapped here to be
+more readable. It has to be all on the same line, without spaces.
+
+
+  <jmx:query
+    failonerror="false"
+    name="Catalina:type=Cluster,host=${tomcat.application.host}"
+    resultproperty="cluster"
+  />
+  <jmx:get
+    name=
+"Catalina:type=IDataSender,host=${tomcat.application.host},
+senderAddress=${cluster.backup.address},senderPort=${cluster.backup.port}"
+    attribute="connected"
+    resultproperty="datasender.connected"
+    if="cluster.0.name" />
+
+
JMXAccessorSetTask:  set attribute value Ant task

+
+List of Attributes
+
+
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+Attribute Description Default value
name Full qualified JMX ObjectName -- Catalina:type=Server
+    
attribute Existing MBean attribute (see Tomcat MBean description above)
+    
value value that set to attribute
+    
type type of the attribute.
+    java.lang.String
ref JMX Connection reference
+    jmx.server
echo Echo command usage (access and result)
+    false
+
+
+Example to set remote MBean attribute value
+
+  <jmx:set
+    name="Catalina:type=Manager,context=/servlets-examples,host=localhost"
+    attribute="maxActiveSessions"
+    value="500"
+    type="int"
+  />
+
+
+
JMXAccessorInvokeTask:  invoke MBean operation Ant task

+
+List of Attributes
+
+
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+Attribute Description Default value
name Full qualified JMX ObjectName -- Catalina:type=Server
+    
operation Existing MBean operation
+    
ref JMX Connection reference
+    jmx.server
echo Echo command usage (access and result)
+    false
resultproperty Save result at this project property
+    
delimiter Split result with delimiter (java.util.StringTokenizer)
+        and use resultproperty as prefix to store tokens.
+    
separatearrayresults When return value is an array, save result as property list
+    ($resultproperty.[0..N] and $resultproperty.length)
+    true
+
+
+stop an application
+
+  <jmx:invoke
+    name="Catalina:type=Manager,context=/servlets-examples,host=localhost"
+    operation="stop"/>
+
+Now you can find the sessionid at ${sessions.[0..N} properties and access the count
+with ${sessions.length} property.
+
+
+Example to get all sessionids
+
+  <jmx:invoke
+    name="Catalina:type=Manager,context=/servlets-examples,host=localhost"
+    operation="listSessionIds"
+    resultproperty="sessions"
+    delimiter=" "
+  />
+
+Now you can find the sessionid at ${sessions.[0..N} properties and access the count
+with ${sessions.length} property.
+
+
+Example to get remote MBean session attribute from session ${sessionid.0}
+
+  <jmx:invoke
+    name="Catalina:type=Manager,context=/ClusterTest,host=localhost"
+    operation="getSessionAttribute"
+    resultproperty="hello">
+     <arg value="${sessionid.0}"/>
+     <arg value="Hello" />
+  </jmx:invoke>
+
+
+Example to create a new access logger valve at vhost localhost
+
+ <jmx:invoke
+         name="Catalina:type=MBeanFactory"
+         operation="createAccessLoggerValve"
+         resultproperty="accessLoggerObjectName"
+ >
+     <arg value="Catalina:type=Host,host=localhost"/>
+ </jmx:invoke>
+
+Now you can find new MBean with name stored at ${accessLoggerObjectName}
+property.
+
+
+
JMXAccessorQueryTask:  query MBean Ant task

+
+List of Attributes
+
+
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+Attribute Description Default value
name JMX  ObjectName query string -- Catalina:type=Manager,*
+    
ref JMX Connection reference
+    jmx.server
echo Echo command usage (access and result)
+    false
resultproperty Prefix project property name to all founded MBeans (mbeans.[0..N].objectname)
+    
attributebinding bind ALL MBean attributes in addition to name
+    false
delimiter Split result with delimiter (java.util.StringTokenizer)
+        and use resultproperty as prefix to store tokens.
+    
separatearrayresults When return value is an array, save result as property list
+    ($resultproperty.[0..N] and $resultproperty.length)
+    true
+
+
+Get all Manager ObjectNames from all services and Hosts
+
+  <jmx:query
+    name="Catalina:type=Manager,*
+    resultproperty="manager" />
+
+Now you can find the Session Manager at ${manager.[0..N].name}
+properties and access the result object counter with ${manager.length} property.
+
+
+Example to get the Manager from servlet-examples application an bind all MBean properties
+
+  <jmx:query
+    name="Catalina:type=Manager,context=/servlet-examples,host=localhost*"
+    attributebinding="true"
+    resultproperty="manager.servletExamples" />
+
+Now you can find the manager at ${manager.servletExamples.0.name} property
+and can access all properties from this manager with ${manager.servletExamples.0.[manager attribute names]}.
+The result object counter from MBeans is stored ad ${manager.length} property.
+
+
+
+Example to get all MBeans from a server and store inside an external XML property file
+
+<project name="jmx.query"
+            xmlns:jmx="antlib:org.apache.catalina.ant.jmx"
+            default="query-all" basedir=".">
+<property name="jmx.host" value="localhost"/>
+<property name="jmx.port" value="8050"/>
+<property name="jmx.username" value="controlRole"/>
+<property name="jmx.password" value="tomcat"/>
+
+<target name="query-all" description="Query all MBeans of a server">
+  <!-- Configure connection -->
+  <jmx:open
+    host="${jmx.host}"
+    port="${jmx.port}"
+    ref="jmx.server"
+    username="${jmx.username}"
+    password="${jmx.password}"/>
+
+  <!-- Query MBean list -->
+  <jmx:query
+    name="*:*"
+    resultproperty="mbeans"
+    attributebinding="false"/>
+
+  <echoproperties
+    destfile="mbeans.properties"
+    prefix="mbeans."
+    format="xml"/>
+
+  <!-- Print results -->
+  <echo message=
+    "Number of MBeans in server ${jmx.host}:${jmx.port} is ${mbeans.length}"/>
+</target>
+</project>
+
+Now you can find all MBeans inside the file mbeans.properties.
+
+
+
JMXAccessorCreateTask:  remote create MBean Ant task

+
+List of Attributes
+
+
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+Attribute Description Default value
name Full qualified JMX ObjectName -- Catalina:type=MBeanFactory
+    
className Existing MBean full qualified class name (see Tomcat MBean description above)
+    
classLoader ObjectName of server or web application classloader 

+    ( Catalina:type=ServerClassLoader,name=[server,common,shared] or

+     Catalina:type=WebappClassLoader,context=/myapps,host=localhost)
+    
ref JMX Connection reference
+    jmx.server
echo Echo command usage (access and result)
+    false
+
+
+Example to create remote MBean
+
+  <jmx:create
+    ref="${jmx.reference}"
+    name="Catalina:type=MBeanFactory"
+    className="org.apache.commons.modeler.BaseModelMBean"
+    classLoader="Catalina:type=ServerClassLoader,name=server">
+    <arg value="org.apache.catalina.mbeans.MBeanFactory" />
+  </jmx:create>
+
+
+    Warning: Many Tomcat MBeans can't be linked to their parent once

+    created. The Valve, Cluster and Realm MBeans are not automatically

+    connected with their parent. Use the MBeanFactory create

+    operation instead.
+
+
+
JMXAccessorUnregisterTask:  remote unregister MBean Ant task

+
+List of Attributes
+
+
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+Attribute Description Default value
name Full qualified JMX ObjectName -- Catalina:type=MBeanFactory
+    
ref JMX Connection reference
+    jmx.server
echo Echo command usage (access and result)
+    false
+
+
+Example to unregister remote MBean
+
+  <jmx:unregister
+    name="Catalina:type=MBeanFactory"
+  />
+
+
+    Warning: A lot of Tomcat MBeans can't be unregister.

+    The MBeans are not unlinked from their parent. Use MBeanFactory

+    remove operation instead.
+
+
+
JMXAccessorCondition:  express condition

+
+List of Attributes
+
+
+
+  
+    
+    
+    
+  
+
+ 
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+Attribute Description Default value
url Set JMX connection URL - service:jmx:rmi:///jndi/rmi://localhost:8050/jmxrmi
+    
host Set the host, shortcut the very long URL syntax.
+    localhost
port Set the remote connection port
+    8050
username remote JMX connection user name.
+    
password remote JMX connection password.
+    
ref Name of the internal connection reference. With this attribute you can
+        configure more the one connection inside the same Ant project.
+    jmx.server
name Full qualified JMX ObjectName -- Catalina:type=Server
+    
echo Echo condition usage (access and result)
+    false
if Only execute if a property of the given name exists in the current project.
+    
unless Only execute if a property of the given name not exists in the current project.
+    
value (required) Second arg for operation
+    
type Value type to express operation (support long and double)
+    long
operation  express one
+    
+    ==  equals
+    !=  not equals
+    > greater than (&gt;)
+    >= greater than or equals (&gt;=)
+    < lesser than (&lt;)
+    <= lesser than or equals (&lt;=)
+    
+    ==
+
+
+Wait for server connection and that cluster backup node is accessible
+
+<target name="wait">
+  <waitfor maxwait="${maxwait}" maxwaitunit="second" timeoutproperty="server.timeout" >
+    <and>
+      <socket server="${server.name}" port="${server.port}"/>
+      <http url="${url}"/>
+      <jmx:condition
+        operation="=="
+        host="localhost"
+        port="9014"
+        username="controlRole"
+        password="tomcat"
+        name=
+"Catalina:type=IDataSender,host=localhost,senderAddress=192.168.111.1,senderPort=9025"
+        attribute="connected"
+        value="true"
+      />
+    </and>
+  </waitfor>
+  <fail if="server.timeout" message="Server ${url} don't answer inside ${maxwait} sec" />
+  <echo message="Server ${url} alive" />
+</target>
+
+
JMXAccessorEqualsCondition:  equals MBean Ant condition

+
+List of Attributes
+
+
+
+  
+    
+    
+    
+  
+
+ 
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+  
+    
+    
+    
+  
+
+
+  
+    
+    
+    
+  
+
+Attribute Description Default value
url Set JMX connection URL - service:jmx:rmi:///jndi/rmi://localhost:8050/jmxrmi
+    
host Set the host, shortcut the very long URL syntax.
+    localhost
port Set the remote connection port
+    8050
username remote JMX connection user name.
+    
password remote JMX connection password.
+    
ref Name of the internal connection reference. With this attribute you can
+        configure more the one connection inside the same Ant project.
+    jmx.server
name Full qualified JMX ObjectName -- Catalina:type=Server
+    
echo Echo condition usage (access and result)
+    false
+
+
+Wait for server connection and that cluster backup node is accessible
+
+<target name="wait">
+  <waitfor maxwait="${maxwait}" maxwaitunit="second" timeoutproperty="server.timeout" >
+    <and>
+      <socket server="${server.name}" port="${server.port}"/>
+      <http url="${url}"/>
+      <jmx:equals
+        host="localhost"
+        port="9014"
+        username="controlRole"
+        password="tomcat"
+        name=
+"Catalina:type=IDataSender,host=localhost,senderAddress=192.168.111.1,senderPort=9025"
+        attribute="connected"
+        value="true"
+      />
+    </and>
+  </waitfor>
+  <fail if="server.timeout" message="Server ${url} don't answer inside ${maxwait} sec" />
+  <echo message="Server ${url} alive" />
+</target>
+
+
Using the JMXProxyServlet

+
+    
+      Tomcat offers an alternative to using remote (or even local) JMX
+      connections while still giving you access to everything JMX has to offer:
+      Tomcat's
+      JMXProxyServlet.
+    
+
+    
+      The JMXProxyServlet allows a client to issue JMX queries via an HTTP
+      interface. This technique offers the following advantages over using
+      JMX directly from a client program:
+    
+
+    
+      You don't have to launch a full JVM and make a remote JMX connection
+      just to ask for one small piece of data from a running server
+      You don't have to know how to work with JMX connections
+      You don't need any of the complex configuration covered in the rest
+      of this page
+      Your client program does not have to be written in Java
+    
+
+    
+      A perfect example of JMX overkill can be seen in the case of popular
+      server-monitoring software such as Nagios or Icinga: if you want to
+      monitor 10 items via JMX, you will have to launch 10 JVMs, make 10 JMX
+      connections, and then shut them all down every few minutes. With the
+      JMXProxyServlet, you can make 10 HTTP connections and be done with it.
+    
+
+    
+      You can find out more information about the JMXProxyServlet in the
+      documentation for the
+      Tomcat
+      manager.
+    
+  

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/proxy-howto.html b/apache-tomcat-9.0.109/webapps/docs/proxy-howto.html
new file mode 100644
index 0000000..ce12b61
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/proxy-howto.html
@@ -0,0 +1,115 @@
+
+Apache Tomcat 9 (9.0.109) - Proxy Support How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Proxy Support How-To
Table of Contents

+Introduction
Apache httpd Proxy Support
+
Introduction

+
+Using standard configurations of Tomcat, web applications can ask for
+the server name and port number to which the request was directed for
+processing.  When Tomcat is running standalone with the
+HTTP/1.1 Connector, it will generally
+report the server name specified in the request, and the port number on
+which the Connector is listening.  The servlet API
+calls of interest, for this purpose, are:
+
+ServletRequest.getServerName(): Returns the host name of the server to which the request was sent.
+ServletRequest.getServerPort(): Returns the port number of the server to which the request was sent.
+ServletRequest.getLocalName(): Returns the host name of the Internet Protocol (IP) interface on which the request was received.
+ServletRequest.getLocalPort():  Returns the Internet Protocol (IP) port number of the interface on which the request was received.
+
+
+When you are running behind a proxy server (or a web server that is
+configured to behave like a proxy server), you will sometimes prefer to
+manage the values returned by these calls.  In particular, you will
+generally want the port number to reflect that specified in the original
+request, not the one on which the Connector itself is
+listening.  You can use the proxyName and proxyPort
+attributes on the <Connector> element to configure
+these values.
+
+Proxy support can take many forms.  The following sections describe
+proxy configurations for several common cases.
+
+
Apache httpd Proxy Support

+
+Apache httpd 1.3 and later versions support an optional module
+(mod_proxy) that configures the web server to act as a proxy
+server.  This can be used to forward requests for a particular web application
+to a Tomcat instance, without having to configure a web connector such as
+mod_jk.  To accomplish this, you need to perform the following
+tasks:
+
+Configure your copy of Apache so that it includes the
+    mod_proxy module.  If you are building from source,
+    the easiest way to do this is to include the
+    --enable-module=proxy directive on the
+    ./configure command line.
+If not already added for you, make sure that you are loading the
+    mod_proxy module at Apache startup time, by using the
+    following directives in your httpd.conf file:
+LoadModule proxy_module  {path-to-modules}/mod_proxy.so
+
+Include two directives in your httpd.conf file for
+    each web application that you wish to forward to Tomcat.  For
+    example, to forward an application at context path /myapp:
+ProxyPass         /myapp  http://localhost:8081/myapp
+ProxyPassReverse  /myapp  http://localhost:8081/myapp
+    which tells Apache to forward URLs of the form
+    http://localhost/myapp/* to the Tomcat connector
+    listening on port 8081.
+Configure your copy of Tomcat to include a special
+    <Connector> element, with appropriate
+    proxy settings, for example:
+<Connector port="8081" ...
+              proxyName="www.mycompany.com"
+              proxyPort="80"/>
+    which will cause servlets inside this web application to think that
+    all proxied requests were directed to www.mycompany.com
+    on port 80.
+It is legal to omit the proxyName attribute from the
+    <Connector> element.  If you do so, the value
+    returned by request.getServerName() will by the host
+    name on which Tomcat is running.  In the example above, it would be
+    localhost.
+If you also have a <Connector> listening on port
+    8080 (nested within the same Service
+    element), the requests to either port will share the same set of
+    virtual hosts and web applications.
+You might wish to use the IP filtering features of your operating
+    system to restrict connections to port 8081 (in this example) to
+    be allowed only from the server that is running
+    Apache.
+Alternatively, you can set up a series of web applications that are
+    only available via proxying, as follows:
+    
+    Configure another <Service> that contains
+        only a <Connector> for the proxy port.
+    Configure appropriate Engine,
+        Host, and
+        Context elements for the virtual hosts
+        and web applications accessible via proxying.
+    Optionally, protect port 8081 with IP filters as described
+        earlier.
+    
+When requests are proxied by Apache, the web server will be recording
+    these requests in its access log.  Therefore, you will generally want to
+    disable any access logging performed by Tomcat itself.
+
+
+When requests are proxied in this manner, all requests
+for the configured web applications will be processed by Tomcat (including
+requests for static content).  You can improve performance by using the
+mod_jk web connector instead of mod_proxy.
+mod_jk can be configured so that the web server serves static
+content that is not processed by filters or security constraints defined
+within the web application's deployment descriptor
+(/WEB-INF/web.xml).
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/realm-howto.html b/apache-tomcat-9.0.109/webapps/docs/realm-howto.html
new file mode 100644
index 0000000..c61ce32
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/realm-howto.html
@@ -0,0 +1,1198 @@
+
+Apache Tomcat 9 (9.0.109) - Realm Configuration How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Realm Configuration How-To
Table of Contents

+Quick Start
OverviewWhat is a Realm?
Configuring a Realm
Common FeaturesDigested Passwords
Example Application
Manager Application
Realm Logging
Standard Realm ImplementationsDataSourceRealm
JNDIRealm
UserDatabaseRealm
MemoryRealm
JAASRealm
CombinedRealm
LockOutRealm
JDBCRealm
+
Quick Start

+
+This document describes how to configure Tomcat to support container
+managed security, by connecting to an existing "database" of usernames,
+passwords, and user roles.  You only need to care about this if you are using
+a web application that includes one or more
+<security-constraint> elements, and a
+<login-config> element defining how users are required
+to authenticate themselves.  If you are not utilizing these features, you can
+safely skip this document.
+
+For fundamental background information about container managed security,
+see the Servlet
+Specification (Version 2.4), Section 12.
+
+For information about utilizing the Single Sign On feature of
+Tomcat (allowing a user to authenticate themselves once across the entire
+set of web applications associated with a virtual host), see
+here.
+
+
Overview

+
+
+What is a Realm?

+
+A Realm is a "database" of usernames and passwords that
+identify valid users of a web application (or set of web applications), plus
+an enumeration of the list of roles associated with each valid user.
+You can think of roles as similar to groups in Unix-like operating
+systems, because access to specific web application resources is granted to
+all users possessing a particular role (rather than enumerating the list of
+associated usernames).  A particular user can have any number of roles
+associated with their username.
+
+Although the Servlet Specification describes a portable mechanism for
+applications to declare their security requirements (in the
+web.xml deployment descriptor), there is no portable API
+defining the interface between a servlet container and the associated user
+and role information.  In many cases, however, it is desirable to "connect"
+a servlet container to some existing authentication database or mechanism
+that already exists in the production environment.  Therefore, Tomcat
+defines a Java interface (org.apache.catalina.Realm) that
+can be implemented by "plug in" components to establish this connection.
+Six standard plug-ins are provided, supporting connections to various
+sources of authentication information:
+
+JDBCRealm - Accesses authentication information
+    stored in a relational database, accessed via a JDBC driver.
+DataSourceRealm - Accesses authentication
+    information stored in a relational database, accessed via a named JNDI
+    JDBC DataSource.
+JNDIRealm - Accesses authentication information
+    stored in an LDAP based directory server, accessed via a JNDI provider.
+    
+UserDatabaseRealm - Accesses authentication
+    information stored in an UserDatabase JNDI resource, which is typically
+    backed by an XML document (conf/tomcat-users.xml).
+MemoryRealm - Accesses authentication
+    information stored in an in-memory object collection, which is initialized
+    from an XML document (conf/tomcat-users.xml).
+JAASRealm - Accesses authentication information
+    through the Java Authentication & Authorization Service (JAAS)
+    framework.
+
+
+It is also possible to write your own Realm implementation,
+and integrate it with Tomcat.  To do so, you need to:
+
+  Implement org.apache.catalina.Realm,
+  Place your compiled realm in $CATALINA_HOME/lib,
+  Declare your realm as described in the "Configuring a Realm" section below,
+  Declare your realm to the MBeans Descriptors.
+
+
+
+
+
+Configuring a Realm

+
+Before getting into the details of the standard Realm implementations, it is
+important to understand, in general terms, how a Realm is configured.  In
+general, you will be adding an XML element to your conf/server.xml
+configuration file, that looks something like this:
+
+<Realm className="... class name for this implementation"
+       ... other attributes for this implementation .../>
+
+The <Realm> element can be nested inside any one of
+of the following Container elements.  The location of the
+Realm element has a direct impact on the "scope" of that Realm
+(i.e. which web applications will share the same authentication information):
+
+
+Inside an <Engine> element - This Realm will be shared
+    across ALL web applications on ALL virtual hosts, UNLESS it is overridden
+    by a Realm element nested inside a subordinate <Host>
+    or <Context> element.
+Inside a <Host> element - This Realm will be shared across
+    ALL web applications for THIS virtual host, UNLESS it is overridden
+    by a Realm element nested inside a subordinate <Context>
+    element.
+Inside a <Context> element - This Realm will be used ONLY
+    for THIS web application.
+
+
+
+
+
+
+
Common Features

+
+
+Digested Passwords

+
+For each of the standard Realm implementations, the
+user's password (by default) is stored in clear text.  In many
+environments, this is undesirable because casual observers of the
+authentication data can collect enough information to log on
+successfully, and impersonate other users.  To avoid this problem, the
+standard implementations support the concept of digesting
+user passwords.  This allows the stored version of the passwords to be
+encoded (in a form that is not easily reversible), but that the
+Realm implementation can still utilize for
+authentication.
+
+When a standard realm authenticates by retrieving the stored
+password and comparing it with the value presented by the user, you
+can select digested passwords by placing a 
+CredentialHandler element inside your <Realm>
+element. An easy choice to support one of the algorithms SSHA, SHA or MD5
+would be the usage of the MessageDigestCredentialHandler.
+This element must be configured to one of the digest algorithms supported
+by the java.security.MessageDigest class (SSHA, SHA or MD5).
+When you select this option, the contents of the password that is stored
+in the Realm must be the cleartext version of the password,
+as digested by the specified algorithm.
+
+When the authenticate() method of the Realm is called, the
+(cleartext) password specified by the user is itself digested by the same
+algorithm, and the result is compared with the value returned by the
+Realm.  An equal match implies that the cleartext version of the
+original password is the same as the one presented by the user, so that this
+user should be authorized.
+
+To calculate the digested value of a cleartext password, two convenience
+techniques are supported:
+
+If you are writing an application that needs to calculate digested
+    passwords dynamically, call the static Digest() method of the
+    org.apache.catalina.realm.RealmBase class, passing the
+    cleartext password, the digest algorithm name and the encoding as arguments.
+    This method will return the digested password.
+If you want to execute a command line utility to calculate the digested
+    password, simply execute
+CATALINA_HOME/bin/digest.[bat|sh] -a {algorithm} {cleartext-password}
+    and the digested version of this cleartext password will be returned to
+    standard output.
+
+
+If using digested passwords with DIGEST authentication, the cleartext used
+   to generate the digest is different and the digest must use one iteration of
+   the MD5 algorithm with no salt. In the examples above
+   {cleartext-password} must be replaced with
+   {username}:{realm}:{cleartext-password}. For example, in a
+   development environment this might take the form
+   testUser:Authentication required:testPassword. The value for
+   {realm} is taken from the <realm-name>
+   element of the web application's <login-config>. If
+   not specified in web.xml, the default value of Authentication
+   required is used.
+
+Usernames and/or passwords using encodings other than the platform default
+are supported using
+CATALINA_HOME/bin/digest.[bat|sh] -a {algorithm} -e {encoding} {input}
+but care is required to ensure that the input is correctly passed to the
+digester. The digester returns {input}:{digest}. If the input
+appears corrupted in the return, the digest will be invalid.
+
+The output format of the digest is {salt}${iterations}${digest}.
+If the salt length is zero and the iteration count is one, the output is
+simplified to {digest}.
+
+The full syntax of CATALINA_HOME/bin/digest.[bat|sh] is:
+CATALINA_HOME/bin/digest.[bat|sh] [-a <algorithm>] [-e <encoding>]
+        [-i <iterations>] [-s <salt-length>] [-k <key-length>]
+        [-h <handler-class-name>] [-f <password-file> | <credentials>]
+
+
+-a - The algorithm to use to generate the stored
+                credential. If not specified, the default for the handler will
+                be used. If neither handler nor algorithm is specified then a
+                default of SHA-512 will be used
+-e - The encoding to use for any byte to/from character
+                conversion that may be necessary. If not specified, the
+                system encoding (Charset#defaultCharset()) will
+                be used.
+-i - The number of iterations to use when generating the
+                stored credential. If not specified, the default for the
+                CredentialHandler will be used.
+-s - The length (in bytes) of salt to generate and store as
+                part of the credential. If not specified, the default for
+                the CredentialHandler will be used.
+-k - The length (in bits) of the key(s), if any, created while
+                generating the credential. If not specified, the default
+                for the CredentialHandler will be used.
+-h - The fully qualified class name of the CredentialHandler
+                to use. If not specified, the built-in handlers will be
+                tested in turn (MessageDigestCredentialHandler then
+                SecretKeyCredentialHandler) and the first one to accept the
+                specified algorithm will be used.
+-f - The name of the file that contains passwords to encode. Each
+                line in the file should contain only one password. Using this
+                option ignores other password input.
+
+
+
+
+
+Example Application

+
+The example application shipped with Tomcat includes an area that is
+protected by a security constraint, utilizing form-based login.  To access it,
+point your browser at
+http://localhost:8080/examples/jsp/security/protected/
+and log on with one of the usernames and passwords described for the default
+UserDatabaseRealm.
+
+
+
+
+Manager Application

+
+If you wish to use the Manager Application
+to deploy and undeploy applications in a running Tomcat installation, you
+MUST add the "manager-gui" role to at least one username in your selected
+Realm implementation.  This is because the manager web application itself uses a
+security constraint that requires role "manager-gui" to access ANY request URI
+within the HTML interface of that application.
+
+For security reasons, no username in the default Realm (i.e. using
+conf/tomcat-users.xml is assigned the "manager-gui" role.
+Therefore, no one will be able to utilize the features of this application
+until the Tomcat administrator specifically assigns this role to one or more
+users.
+
+
+
+Realm Logging

+
+Debugging and exception messages logged by a Realm will
+   be recorded by the logging configuration associated with the container
+   for the realm: its surrounding Context,
+   Host, or
+   Engine.
+
+
+
+
Standard Realm Implementations

+
+DataSourceRealm

+
+Introduction
+
+DataSourceRealm is an implementation of the Tomcat
+Realm interface that looks up users in a relational database
+accessed via a JNDI named JDBC DataSource.  There is substantial configuration
+flexibility that lets you adapt to existing table and column names, as long
+as your database structure conforms to the following requirements:
+
+There must be a table, referenced below as the users table,
+    that contains one row for every valid user that this Realm
+    should recognize.
+The users table must contain at least two columns (it may
+    contain more if your existing applications required it):
+    
+    Username to be recognized by Tomcat when the user logs in.
+    Password to be recognized by Tomcat when the user logs in.
+        This value may in cleartext or digested - see below for more
+        information.
+    
+There must be a table, referenced below as the user roles table,
+    that contains one row for every valid role that is assigned to a
+    particular user.  It is legal for a user to have zero, one, or more than
+    one valid role.
+The user roles table must contain at least two columns (it may
+    contain more if your existing applications required it):
+    
+    Username to be recognized by Tomcat (same value as is specified
+        in the users table).
+    Role name of a valid role associated with this user.
+    
+
+
+Quick Start
+
+To set up Tomcat to use DataSourceRealm, you will need to follow these steps:
+
+If you have not yet done so, create tables and columns in your database
+    that conform to the requirements described above.
+Configure a database username and password for use by Tomcat, that has
+    at least read only access to the tables described above.  (Tomcat will
+    never attempt to write to these tables.)
+Configure a JNDI named JDBC DataSource for your database.  Refer to the
+    JNDI DataSource Example
+    How-To for information on how to configure a JNDI named JDBC DataSource.
+    Be sure to set the Realm's localDataSource
+    attribute appropriately, depending on where the JNDI DataSource is
+    defined.
+Set up a <Realm> element, as described below, in your
+    $CATALINA_BASE/conf/server.xml file.
+Restart Tomcat if it is already running.
+
+
+Realm Element Attributes
+
+To configure DataSourceRealm, you will create a <Realm>
+element and nest it in your $CATALINA_BASE/conf/server.xml file,
+as described above. The attributes for the
+DataSourceRealm are defined in the Realm
+configuration documentation.
+
+Example
+
+An example SQL script to create the needed tables might look something
+like this (adapt the syntax as required for your particular database):
+create table users (
+  user_name         varchar(15) not null primary key,
+  user_pass         varchar(15) not null
+);
+
+create table user_roles (
+  user_name         varchar(15) not null,
+  role_name         varchar(15) not null,
+  primary key (user_name, role_name)
+);
+
+Here is an example for using a MySQL database called "authority", configured
+with the tables described above, and accessed with the JNDI JDBC DataSource with
+name "java:/comp/env/jdbc/authority".
+<Realm className="org.apache.catalina.realm.DataSourceRealm"
+   dataSourceName="jdbc/authority"
+   userTable="users" userNameCol="user_name" userCredCol="user_pass"
+   userRoleTable="user_roles" roleNameCol="role_name"/>
+
+Additional Notes
+
+DataSourceRealm operates according to the following rules:
+
+When a user attempts to access a protected resource for the first time,
+    Tomcat will call the authenticate() method of this
+    Realm.  Thus, any changes you have made to the database
+    directly (new users, changed passwords or roles, etc.) will be immediately
+    reflected.
+Once a user has been authenticated, the user (and their associated
+    roles) are cached within Tomcat for the duration of the user's login.
+    (For FORM-based authentication, that means until the session times out or
+    is invalidated; for BASIC authentication, that means until the user
+    closes their browser).  The cached user is not saved and
+    restored across sessions serialisations. Any changes to the database
+    information for an already authenticated user will not be
+    reflected until the next time that user logs on again.
+Administering the information in the users and user roles
+    table is the responsibility of your own applications.  Tomcat does not
+    provide any built-in capabilities to maintain users and roles.
+
+
+
+
+
+JNDIRealm

+
+Introduction
+
+JNDIRealm is an implementation of the Tomcat
+Realm interface that looks up users in an LDAP directory
+server accessed by a JNDI provider (typically, the standard LDAP
+provider that is available with the JNDI API classes). The realm
+supports a variety of approaches to using a directory for
+authentication.
+
+Connecting to the directory
+
+The realm's connection to the directory is defined by the
+connectionURL configuration attribute. This is a URL
+whose format is defined by the JNDI provider. It is usually an LDAP
+URL that specifies the domain name of the directory server to connect
+to, and optionally the port number and distinguished name (DN) of the
+required root naming context.
+
+If you have more than one provider you can configure an
+alternateURL.  If a socket connection cannot be
+made to the provider at the connectionURL an
+attempt will be made to use the alternateURL.
+
+When making a connection in order to search the directory and
+retrieve user and role information, the realm authenticates itself to
+the directory with the username and password specified by the
+connectionName and
+connectionPassword properties. If these properties
+are not specified the connection is anonymous. This is sufficient in
+many cases.
+
+
+
+Selecting the user's directory entry
+
+Each user that can be authenticated must be represented in the
+directory by an individual entry that corresponds to an element in the
+initial DirContext defined by the
+connectionURL attribute. This user entry must have an
+attribute containing the username that is presented for
+authentication.
+
+Often the distinguished name of the user's entry contains the
+username presented for authentication but is otherwise the same for
+all users. In this case the userPattern attribute may
+be used to specify the DN, with "{0}" marking where
+the username should be substituted.
+
+Otherwise the realm must search the directory to find a unique entry
+containing the username. The following attributes configure this
+search:
+
+     
+     userBase - the entry that is the base of
+         the subtree containing users.  If not specified, the search
+         base is the top-level context.
+
+     userSubtree - the search scope. Set to
+         true if you wish to search the entire subtree
+         rooted at the userBase entry. The default value
+         of false requests a single-level search
+         including only the top level.
+
+     userSearch - pattern specifying the LDAP
+         search filter to use after substitution of the username.
+
+    
+
+
+Authenticating the user
+
+
+
+Bind mode
+
+By default the realm authenticates a user by binding to
+the directory with the DN of the entry for that user and the password
+presented by the user. If this simple bind succeeds the user is considered to
+be authenticated.
+
+For security reasons a directory may store a digest of the user's
+password rather than the clear text version (see
+Digested Passwords for more information). In that case,
+as part of the simple bind operation the directory automatically
+computes the correct digest of the plaintext password presented by the
+user before validating it against the stored value. In bind mode,
+therefore, the realm is not involved in digest processing. The
+digest attribute is not used, and will be ignored if
+set.
+
+
+
+Comparison mode
+Alternatively, the realm may retrieve the stored
+password from the directory and compare it explicitly with the value
+presented by the user. This mode is configured by setting the
+userPassword attribute to the name of a directory
+attribute in the user's entry that contains the password.
+
+Comparison mode has some disadvantages. First, the
+connectionName and
+connectionPassword attributes must be configured to
+allow the realm to read users' passwords in the directory. For
+security reasons this is generally undesirable; indeed many directory
+implementations will not allow even the directory manager to read
+these passwords. In addition, the realm must handle password digests
+itself, including variations in the algorithms used and ways of
+representing password hashes in the directory. However, the realm may
+sometimes need access to the stored password, for example to support
+HTTP Digest Access Authentication (RFC 2069). (Note that HTTP digest
+authentication is different from the storage of password digests in
+the repository for user information as discussed above).
+
+
+
+
+Assigning roles to the user
+
+The directory realm supports two approaches to the representation
+of roles in the directory:
+
+
+
+Roles as explicit directory entries
+
+Roles may be represented by explicit directory entries. A role
+entry is usually an LDAP group entry with one attribute
+containing the name of the role and another whose values are the
+distinguished names or usernames of the users in that role.  The
+following attributes configure a directory search to
+find the names of roles associated with the authenticated user:
+
+
+roleBase - the base entry for the role search.
+    If not specified, the search base is the top-level directory
+    context.
+
+roleSubtree - the search
+    scope. Set to true if you wish to search the entire
+    subtree rooted at the roleBase entry. The default
+    value of false requests a single-level search
+    including the top level only.
+
+roleSearch - the LDAP search filter for
+    selecting role entries. It optionally includes pattern
+    replacements "{0}" for the distinguished name and/or "{1}" for the
+    username and/or "{2}" for an attribute from user's directory entry,
+    of the authenticated user. Use userRoleAttribute to
+    specify the name of the attribute that provides the value for "{2}".
+
+roleName - the attribute in a role entry
+     containing the name of that role.
+
+roleNested - enable nested roles. Set to
+     true if you want to nest roles in roles. If configured, then
+     every newly found roleName and distinguished
+     Name will be recursively tried for a new role search.
+     The default value is false.
+
+
+
+
+
+
+
+
+Roles as an attribute of the user entry
+
+Role names may also be held as the values of an attribute in the
+user's directory entry. Use userRoleName to specify
+the name of this attribute.
+
+
+
+A combination of both approaches to role representation may be used.
+
+Quick Start
+
+To set up Tomcat to use JNDIRealm, you will need to follow these steps:
+
+Make sure your directory server is configured with a schema that matches
+    the requirements listed above.
+If required, configure a username and password for use by Tomcat, that has
+    read only access to the information described above.  (Tomcat will
+    never attempt to modify this information.)
+Set up a <Realm> element, as described below, in your
+    $CATALINA_BASE/conf/server.xml file.
+Restart Tomcat if it is already running.
+
+
+Realm Element Attributes
+
+To configure JNDIRealm, you will create a <Realm>
+element and nest it in your $CATALINA_BASE/conf/server.xml file,
+as described above. The attributes for the
+JNDIRealm are defined in the Realm configuration
+documentation.
+
+Example
+
+Creation of the appropriate schema in your directory server is beyond the
+scope of this document, because it is unique to each directory server
+implementation.  In the examples below, we will assume that you are using a
+distribution of the OpenLDAP directory server (version 2.0.11 or later), which
+can be downloaded from
+https://www.openldap.org.  Assume that
+your slapd.conf file contains the following settings
+(among others):
+database ldbm
+suffix dc="mycompany",dc="com"
+rootdn "cn=Manager,dc=mycompany,dc=com"
+rootpw secret
+
+We will assume for connectionURL that the directory
+server runs on the same machine as Tomcat.  See 
+http://docs.oracle.com/javase/7/docs/technotes/guides/jndi/index.html
+for more information about configuring and using the JNDI LDAP
+provider.
+
+Next, assume that this directory server has been populated with elements
+as shown below (in LDIF format):
+
+# Define top-level entry
+dn: dc=mycompany,dc=com
+objectClass: dcObject
+dc:mycompany
+
+# Define an entry to contain people
+# searches for users are based on this entry
+dn: ou=people,dc=mycompany,dc=com
+objectClass: organizationalUnit
+ou: people
+
+# Define a user entry for Janet Jones
+dn: uid=jjones,ou=people,dc=mycompany,dc=com
+objectClass: inetOrgPerson
+uid: jjones
+sn: jones
+cn: janet jones
+mail: j.jones@mycompany.com
+userPassword: janet
+
+# Define a user entry for Fred Bloggs
+dn: uid=fbloggs,ou=people,dc=mycompany,dc=com
+objectClass: inetOrgPerson
+uid: fbloggs
+sn: bloggs
+cn: fred bloggs
+mail: f.bloggs@mycompany.com
+userPassword: fred
+
+# Define an entry to contain LDAP groups
+# searches for roles are based on this entry
+dn: ou=groups,dc=mycompany,dc=com
+objectClass: organizationalUnit
+ou: groups
+
+# Define an entry for the "tomcat" role
+dn: cn=tomcat,ou=groups,dc=mycompany,dc=com
+objectClass: groupOfUniqueNames
+cn: tomcat
+uniqueMember: uid=jjones,ou=people,dc=mycompany,dc=com
+uniqueMember: uid=fbloggs,ou=people,dc=mycompany,dc=com
+
+# Define an entry for the "role1" role
+dn: cn=role1,ou=groups,dc=mycompany,dc=com
+objectClass: groupOfUniqueNames
+cn: role1
+uniqueMember: uid=fbloggs,ou=people,dc=mycompany,dc=com
+
+An example Realm element for the OpenLDAP directory
+server configured as described above might look like this, assuming
+that users use their uid (e.g. jjones) to login to the
+application and that an anonymous connection is sufficient to search
+the directory and retrieve role information:
+
+<Realm   className="org.apache.catalina.realm.JNDIRealm"
+     connectionURL="ldap://localhost:389"
+       userPattern="uid={0},ou=people,dc=mycompany,dc=com"
+          roleBase="ou=groups,dc=mycompany,dc=com"
+          roleName="cn"
+        roleSearch="(uniqueMember={0})"
+/>
+
+With this configuration, the realm will determine the user's
+distinguished name by substituting the username into the
+userPattern, authenticate by binding to the directory
+with this DN and the password received from the user, and search the
+directory to find the user's roles.
+
+Now suppose that users are expected to enter their email address
+rather than their userid when logging in. In this case the realm must
+search the directory for the user's entry. (A search is also necessary
+when user entries are held in multiple subtrees corresponding perhaps
+to different organizational units or company locations).
+
+Further, suppose that in addition to the group entries you want to
+use an attribute of the user's entry to hold roles. Now the entry for
+Janet Jones might read as follows:
+
+dn: uid=jjones,ou=people,dc=mycompany,dc=com
+objectClass: inetOrgPerson
+uid: jjones
+sn: jones
+cn: janet jones
+mail: j.jones@mycompany.com
+memberOf: role2
+memberOf: role3
+userPassword: janet
+
+ This realm configuration would satisfy the new requirements:
+
+<Realm   className="org.apache.catalina.realm.JNDIRealm"
+     connectionURL="ldap://localhost:389"
+          userBase="ou=people,dc=mycompany,dc=com"
+        userSearch="(mail={0})"
+      userRoleName="memberOf"
+          roleBase="ou=groups,dc=mycompany,dc=com"
+          roleName="cn"
+        roleSearch="(uniqueMember={0})"
+/>
+
+Now when Janet Jones logs in as "j.jones@mycompany.com", the realm
+searches the directory for a unique entry with that value as its mail
+attribute and attempts to bind to the directory as
+uid=jjones,ou=people,dc=mycompany,dc=com with the given
+password. If authentication succeeds, they are assigned three roles:
+"role2" and "role3", the values of the "memberOf" attribute in their
+directory entry, and "tomcat", the value of the "cn" attribute in the
+only group entry of which they are a member.
+
+Finally, to authenticate the user by retrieving
+the password from the directory and making a local comparison in the
+realm, you might use a realm configuration like this:
+
+<Realm   className="org.apache.catalina.realm.JNDIRealm"
+    connectionName="cn=Manager,dc=mycompany,dc=com"
+connectionPassword="secret"
+     connectionURL="ldap://localhost:389"
+      userPassword="userPassword"
+       userPattern="uid={0},ou=people,dc=mycompany,dc=com"
+          roleBase="ou=groups,dc=mycompany,dc=com"
+          roleName="cn"
+        roleSearch="(uniqueMember={0})"
+/>
+
+However, as discussed above, the default bind mode for
+authentication is usually to be preferred.
+
+Additional Notes
+
+JNDIRealm operates according to the following rules:
+
+When a user attempts to access a protected resource for the first time,
+    Tomcat will call the authenticate() method of this
+    Realm.  Thus, any changes you have made to the directory
+    (new users, changed passwords or roles, etc.) will be immediately
+    reflected.
+Once a user has been authenticated, the user (and their associated
+    roles) are cached within Tomcat for the duration of the user's login.
+    (For FORM-based authentication, that means until the session times out or
+    is invalidated; for BASIC authentication, that means until the user
+    closes their browser).  The cached user is not saved and
+    restored across sessions serialisations. Any changes to the directory
+    information for an already authenticated user will not be
+    reflected until the next time that user logs on again.
+Administering the information in the directory server
+    is the responsibility of your own applications.  Tomcat does not
+    provide any built-in capabilities to maintain users and roles.
+
+
+
+
+
+UserDatabaseRealm

+
+Introduction
+
+UserDatabaseRealm is an implementation of the Tomcat
+Realm interface that uses a JNDI resource to store user
+information. By default, the JNDI resource is backed by an XML file. It is not
+designed for large-scale production use. At startup time, the UserDatabaseRealm
+loads information about all users, and their corresponding roles, from an XML
+document (by default, this document is loaded from
+$CATALINA_BASE/conf/tomcat-users.xml). The users, their passwords
+and their roles may all be editing dynamically, typically via JMX. Changes may
+be saved and will be reflected in the XML file.
+
+Realm Element Attributes
+
+To configure UserDatabaseRealm, you will create a <Realm>
+element and nest it in your $CATALINA_BASE/conf/server.xml file,
+as described above. The attributes for the
+UserDatabaseRealm are defined in the Realm
+configuration documentation.
+
+User File Format
+
+For the XML file based UserDatabase, the users file uses the
+same format as the MemoryRealm.
+
+Example
+
+The default installation of Tomcat is configured with a UserDatabaseRealm
+nested inside the <Engine> element, so that it applies
+to all virtual hosts and web applications.  The default contents of the
+conf/tomcat-users.xml file is:
+<tomcat-users>
+  <user username="tomcat" password="tomcat" roles="tomcat" />
+  <user username="role1"  password="tomcat" roles="role1"  />
+  <user username="both"   password="tomcat" roles="tomcat,role1" />
+</tomcat-users>
+
+Additional Notes
+
+UserDatabaseRealm operates according to the following rules:
+
+When Tomcat first starts up, it loads all defined users and their
+    associated information from the users file. Changes made to the data in
+    this file will not be recognized until Tomcat is
+    restarted. Changes may be made via the UserDatabase resource. Tomcat
+    provides MBeans that may be accessed via JMX for this purpose.
+When a user attempts to access a protected resource for the first time,
+    Tomcat will call the authenticate() method of this
+    Realm.
+Once a user has been authenticated, the user becomes associated within
+    Tomcat for the duration of the user's login.
+    (For FORM-based authentication, that means until the session times out or
+    is invalidated; for BASIC authentication, that means until the user
+    closes their browser). However, the user roles will still reflect the
+    UserDatabase contents, unlike for the other realms. If a user
+    is removed from the database, it will be considered to have no roles.
+    The useStaticPrincipal attribute of the
+    UserDatabaseRealm can be used to instead cache the user along
+    with all its roles. The cached user is not saved and
+    restored across sessions serialisations. When the user's principal object
+    is serialized for any reason, it will also be replaced by a static
+    equivalent object with roles that will no longer reflect the database
+    contents.
+
+
+
+
+
+
+MemoryRealm

+
+Introduction
+
+MemoryRealm is a simple demonstration implementation of the
+Tomcat Realm interface.  It is not designed for production use.
+At startup time, MemoryRealm loads information about all users, and their
+corresponding roles, from an XML document (by default, this document is loaded
+from $CATALINA_BASE/conf/tomcat-users.xml).  Changes to the data
+in this file are not recognized until Tomcat is restarted.
+
+Realm Element Attributes
+
+To configure MemoryRealm, you will create a <Realm>
+element and nest it in your $CATALINA_BASE/conf/server.xml file,
+as described above. The attributes for the
+MemoryRealm are defined in the Realm
+configuration documentation.
+
+User File Format
+
+The users file (by default, conf/tomcat-users.xml must be an
+XML document, with a root element <tomcat-users>.  Nested
+inside the root element will be a <user> element for each
+valid user, consisting of the following attributes:
+
+name - Username this user must log on with.
+password - Password this user must log on with (in
+    clear text if the digest attribute was not set on the
+    <Realm> element, or digested appropriately as
+    described here otherwise).
+roles - Comma-delimited list of the role names
+    associated with this user.
+
+
+Additional Notes
+
+MemoryRealm operates according to the following rules:
+
+When Tomcat first starts up, it loads all defined users and their
+    associated information from the users file.  Changes to the data in
+    this file will not be recognized until Tomcat is
+    restarted.
+When a user attempts to access a protected resource for the first time,
+    Tomcat will call the authenticate() method of this
+    Realm.
+Once a user has been authenticated, the user (and their associated
+    roles) are cached within Tomcat for the duration of the user's login.
+    (For FORM-based authentication, that means until the session times out or
+    is invalidated; for BASIC authentication, that means until the user
+    closes their browser).  The cached user is not saved and
+    restored across sessions serialisations.
+Administering the information in the users file is the responsibility
+    of your application.  Tomcat does not
+    provide any built-in capabilities to maintain users and roles.
+
+
+
+
+
+
+JAASRealm

+
+Introduction
+
+        JAASRealm is an implementation of the Tomcat
+Realm interface that authenticates users through the Java
+Authentication & Authorization Service (JAAS) framework which is now
+provided as part of the standard Java SE API.
+        Using JAASRealm gives the developer the ability to combine
+practically any conceivable security realm with Tomcat's CMA. 
+        JAASRealm is prototype for Tomcat of the JAAS-based
+J2EE authentication framework for J2EE v1.4, based on the JCP Specification
+Request 196 to enhance container-managed security and promote
+'pluggable' authentication mechanisms whose implementations would be
+container-independent.
+        
+        Based on the JAAS login module and principal (see javax.security.auth.spi.LoginModule
+and javax.security.Principal), you can develop your own
+security mechanism or wrap another third-party mechanism for
+integration with the CMA as implemented by Tomcat.
+        
+
+        Quick Start
+        To set up Tomcat to use JAASRealm with your own JAAS login module,
+ you will need to follow these steps:
+        
+          Write your own LoginModule, User and Role classes based
+on JAAS (see
+
+the JAAS Authentication Tutorial and
+
+the JAAS Login Module Developer's Guide) to be managed by the JAAS Login
+Context (javax.security.auth.login.LoginContext)
+When developing your LoginModule, note that JAASRealm's built-in CallbackHandler
+only recognizes the NameCallback and PasswordCallback at present.
+          
+          Although not specified in JAAS, you should create
+separate classes to distinguish between users and roles, extending javax.security.Principal,
+so that Tomcat can tell which Principals returned from your login
+module are users and which are roles (see org.apache.catalina.realm.JAASRealm).
+Regardless, the first Principal returned is always treated as the user Principal.
+          
+          Place the compiled classes on Tomcat's classpath
+          
+          Set up a login.config file for Java (see 
+JAAS LoginConfig file) and tell Tomcat where to find it by specifying
+its location to the JVM, for instance by setting the environment
+variable: JAVA_OPTS=$JAVA_OPTS -Djava.security.auth.login.config==$CATALINA_BASE/conf/jaas.config
+
+          Configure your security-constraints in your web.xml for
+the resources you want to protect
+          Configure the JAASRealm module in your server.xml 
+          Restart Tomcat if it is already running.
+        
+        Realm Element Attributes
+        To configure JAASRealm as for step 6 above, you create
+a <Realm> element and nest it in your
+$CATALINA_BASE/conf/server.xml
+file within your <Engine> node. The attributes for the
+JAASRealm are defined in the Realm
+configuration documentation.
+
+Example
+
+Here is an example of how your server.xml snippet should look.
+
+<Realm className="org.apache.catalina.realm.JAASRealm"
+                appName="MyFooRealm"
+    userClassNames="org.foobar.realm.FooUser"
+     roleClassNames="org.foobar.realm.FooRole"/>
+
+It is the responsibility of your login module to create and save User and
+Role objects representing Principals for the user
+(javax.security.auth.Subject). If your login module doesn't
+create a user object but also doesn't throw a login exception, then the
+Tomcat CMA will break and you will be left at the
+http://localhost:8080/myapp/j_security_check URI or at some other
+unspecified location.
+
+        The flexibility of the JAAS approach is two-fold: 
+        
+          you can carry out whatever processing you require behind
+the scenes in your own login module.
+          you can plug in a completely different LoginModule by changing the configuration
+and restarting the server, without any code changes to your application.
+        
+
+        Additional Notes
+        
+          When a user attempts to access a protected resource for
+              the first time, Tomcat will call the authenticate()
+              method of this Realm.  Thus, any changes you have made in
+              the security mechanism directly (new users, changed passwords or
+              roles, etc.) will be immediately reflected.
+          Once a user has been authenticated, the user (and their
+              associated roles) are cached within Tomcat for the duration of
+              the user's login.  For FORM-based authentication, that means until
+              the session times out or is invalidated; for BASIC authentication,
+              that means until the user closes their browser.  Any changes to the
+              security information for an already authenticated user will not
+              be reflected until the next time that user logs on again.
+          As with other Realm implementations, digested passwords
+              are supported if the <Realm> element in server.xml
+              contains a digest attribute; JAASRealm's CallbackHandler
+              will digest the password prior to passing it back to the LoginModule
+        
+
+
+
+
+CombinedRealm

+
+    Introduction
+
+    CombinedRealm is an implementation of the Tomcat
+    Realm interface that authenticates users through one or more
+    sub-Realms.
+
+    Using CombinedRealm gives the developer the ability to combine multiple
+    Realms of the same or different types. This can be used to authenticate
+    against different sources, provide fall back in case one Realm fails or for
+    any other purpose that requires multiple Realms.
+
+    Sub-realms are defined by nesting Realm elements inside the
+    Realm element that defines the CombinedRealm. Authentication
+    will be attempted against each Realm in the order they are
+    listed. Authentication against any Realm will be sufficient to authenticate
+    the user.
+
+    Realm Element Attributes
+    To configure a CombinedRealm, you create a <Realm>
+    element and nest it in your $CATALINA_BASE/conf/server.xml
+    file within your <Engine> or <Host>.
+    You can also nest inside a <Context> node in a
+    context.xml file.
+
+Example
+
+Here is an example of how your server.xml snippet should look to use a
+UserDatabase Realm and a DataSource Realm.
+
+<Realm className="org.apache.catalina.realm.CombinedRealm" >
+   <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+             resourceName="UserDatabase"/>
+   <Realm className="org.apache.catalina.realm.DataSourceRealm"
+             dataSourceName="jdbc/authority"
+             userTable="users" userNameCol="user_name" userCredCol="user_pass"
+             userRoleTable="user_roles" roleNameCol="role_name"/>
+</Realm>
+
+
+
+LockOutRealm

+
+    Introduction
+
+    LockOutRealm is an implementation of the Tomcat
+    Realm interface that extends the CombinedRealm to provide lock
+    out functionality to provide a user lock out mechanism if there are too many
+    failed authentication attempts in a given period of time.
+
+    To ensure correct operation, there is a reasonable degree of
+    synchronisation in this Realm.
+
+    This Realm does not require modification to the underlying Realms or the
+    associated user storage mechanisms. It achieves this by recording all failed
+    logins, including those for users that do not exist. To prevent a DOS by
+    deliberating making requests with invalid users (and hence causing this
+    cache to grow) the size of the list of users that have failed authentication
+    is limited.
+
+    Sub-realms are defined by nesting Realm elements inside the
+    Realm element that defines the LockOutRealm. Authentication
+    will be attempted against each Realm in the order they are
+    listed. Authentication against any Realm will be sufficient to authenticate
+    the user.
+
+    Realm Element Attributes
+    To configure a LockOutRealm, you create a <Realm>
+    element and nest it in your $CATALINA_BASE/conf/server.xml
+    file within your <Engine> or <Host>.
+    You can also nest inside a <Context> node in a
+    context.xml file. The attributes for the
+    LockOutRealm are defined in the Realm
+    configuration documentation.
+
+Example
+
+Here is an example of how your server.xml snippet should look to add lock out
+functionality to a UserDatabase Realm.
+
+<Realm className="org.apache.catalina.realm.LockOutRealm" >
+   <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
+             resourceName="UserDatabase"/>
+</Realm>
+
+
+
+JDBCRealm

+
+Introduction
+
+The JDBC Database Realm has been deprecated and will be removed
+in Tomcat 10 onwards. Use the DataSourceRealm instead.
+
+JDBCRealm is an implementation of the Tomcat
+Realm interface that looks up users in a relational database
+accessed via a JDBC driver.  There is substantial configuration flexibility
+that lets you adapt to existing table and column names, as long as your
+database structure conforms to the following requirements:
+
+There must be a table, referenced below as the users table,
+    that contains one row for every valid user that this Realm
+    should recognize.
+The users table must contain at least two columns (it may
+    contain more if your existing applications required it):
+    
+    Username to be recognized by Tomcat when the user logs in.
+    Password to be recognized by Tomcat when the user logs in.
+        This value may in cleartext or digested - see below for more
+        information.
+    
+There must be a table, referenced below as the user roles table,
+    that contains one row for every valid role that is assigned to a
+    particular user.  It is legal for a user to have zero, one, or more than
+    one valid role.
+The user roles table must contain at least two columns (it may
+    contain more if your existing applications required it):
+    
+    Username to be recognized by Tomcat (same value as is specified
+        in the users table).
+    Role name of a valid role associated with this user.
+    
+
+
+Quick Start
+
+To set up Tomcat to use JDBCRealm, you will need to follow these steps:
+
+If you have not yet done so, create tables and columns in your database
+    that conform to the requirements described above.
+Configure a database username and password for use by Tomcat, that has
+    at least read only access to the tables described above.  (Tomcat will
+    never attempt to write to these tables.)
+Place a copy of the JDBC driver you will be using inside the
+    $CATALINA_HOME/lib directory.
+    Note that only JAR files are recognized!
+Set up a <Realm> element, as described below, in your
+    $CATALINA_BASE/conf/server.xml file.
+Restart Tomcat if it is already running.
+
+
+Realm Element Attributes
+
+To configure JDBCRealm, you will create a <Realm>
+element and nest it in your $CATALINA_BASE/conf/server.xml file,
+as described above. The attributes for the
+JDBCRealm are defined in the Realm configuration
+documentation.
+
+Example
+
+An example SQL script to create the needed tables might look something
+like this (adapt the syntax as required for your particular database):
+create table users (
+  user_name         varchar(15) not null primary key,
+  user_pass         varchar(15) not null
+);
+
+create table user_roles (
+  user_name         varchar(15) not null,
+  role_name         varchar(15) not null,
+  primary key (user_name, role_name)
+);
+
+Example Realm elements are included (commented out) in the
+default $CATALINA_BASE/conf/server.xml file.  Here's an example
+for using a MySQL database called "authority", configured with the tables
+described above, and accessed with username "dbuser" and password "dbpass":
+<Realm className="org.apache.catalina.realm.JDBCRealm"
+      driverName="org.gjt.mm.mysql.Driver"
+   connectionURL="jdbc:mysql://localhost/authority?user=dbuser&amp;password=dbpass"
+       userTable="users" userNameCol="user_name" userCredCol="user_pass"
+   userRoleTable="user_roles" roleNameCol="role_name"/>
+
+Additional Notes
+
+JDBCRealm operates according to the following rules:
+
+When a user attempts to access a protected resource for the first time,
+    Tomcat will call the authenticate() method of this
+    Realm.  Thus, any changes you have made to the database
+    directly (new users, changed passwords or roles, etc.) will be immediately
+    reflected.
+Once a user has been authenticated, the user (and his or her associated
+    roles) are cached within Tomcat for the duration of the user's login.
+    (For FORM-based authentication, that means until the session times out or
+    is invalidated; for BASIC authentication, that means until the user
+    closes their browser).  The cached user is not saved and
+    restored across sessions serialisations. Any changes to the database
+    information for an already authenticated user will not be
+    reflected until the next time that user logs on again.
+Administering the information in the users and user roles
+    table is the responsibility of your own applications.  Tomcat does not
+    provide any built-in capabilities to maintain users and roles.
+
+
+
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/rewrite.html b/apache-tomcat-9.0.109/webapps/docs/rewrite.html
new file mode 100644
index 0000000..8290aa4
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/rewrite.html
@@ -0,0 +1,789 @@
+
+Apache Tomcat 9 (9.0.109) - The rewrite Valve
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
The rewrite Valve
Introduction

+
+  The rewrite valve implements URL rewrite functionality in a way that is
+  very similar to mod_rewrite from Apache HTTP Server.
+
+
Configuration

+
+  The rewrite valve is configured as a valve using the org.apache.catalina.valves.rewrite.RewriteValve
+  class name.
+
+  The rewrite valve can be configured as a valve added in a Host.
+     See virtual-server documentation for
+     information on how to configure it. It will use a rewrite.config file
+     containing the rewrite directives, it must be placed in the Host configuration
+     folder.
+  
+
+  It can also be in the context.xml of a webapp.
+  The valve will then use a rewrite.config file containing the
+  rewrite directives, it must be placed in the WEB-INF folder of the web application
+  
+
+
Using rewrite rules with special characters

+
+  The URL presented to the rewrite valve is the same URL used for request
+  mapping with any literal '%', ';' and/or
+  '?' characters encoded in %nn form.
+
+  A rewrite rule that wishes to insert a literal '%',
+  ';', '?', '&' or '='
+  character should do so in %nn form. Other characters maybe
+  inserted in either literal or %nn form.
+
+  This enables the rewrite rules to:
+  

+  process URLs containing literal '?' characters;
+  add a query string;
+  insert a literal '%' character without it being confused with
+  %nn encoding.
+  
+  
+
+
Directives

+
+  The rewrite.config file contains a list of directives which closely
+  resemble the directives used by mod_rewrite, in particular the central
+  RewriteRule and RewriteCond directives. Lines that start with a
+  # character are treated as comments and will be ignored.
+
+  Note: This section is a modified version of the mod_rewrite documentation,
+  which is Copyright 1995-2006 The Apache Software Foundation, and licensed under the
+  under the Apache License, Version 2.0.
+
+  RewriteCond

+
+    Syntax: RewriteCond TestString CondPattern
+
+    The RewriteCond directive defines a rule condition. One or more RewriteCond
+    can precede a RewriteRule directive. The following rule is then only used if both
+    the current state of the URI matches its pattern, and if these conditions are met.
+
+      TestString is a string which can contain the
+      following expanded constructs in addition to plain text:
+
+      
+        
+          RewriteRule backreferences: These are
+          backreferences of the form $N
+          (0 <= N <= 9), which provide access to the grouped
+          parts (in parentheses) of the pattern, from the
+          RewriteRule which is subject to the current
+          set of RewriteCond conditions..
+        
+        
+          RewriteCond backreferences: These are
+          backreferences of the form %N
+          (1 <= N <= 9), which provide access to the grouped
+          parts (again, in parentheses) of the pattern, from the last matched
+          RewriteCond in the current set
+          of conditions.
+        
+        
+          RewriteMap expansions: These are
+          expansions of the form ${mapname:key|default}.
+          See the documentation for
+          RewriteMap for more details.
+        
+        
+          Server-Variables: These are variables of
+          the form
+            %{ NAME_OF_VARIABLE
+            }
+          where NAME_OF_VARIABLE can be a string taken
+          from the following list:
+
+          
+          
+          HTTP headers:
+          
+            HTTP_USER_AGENT

+            HTTP_REFERER

+            HTTP_COOKIE

+            HTTP_FORWARDED

+            HTTP_HOST

+            HTTP_PROXY_CONNECTION

+            HTTP_ACCEPT

+          
+          
+          
+          connection & request:
+          
+            REMOTE_ADDR

+            REMOTE_HOST

+            REMOTE_PORT

+            REMOTE_USER

+            REMOTE_IDENT

+            REQUEST_METHOD

+            SCRIPT_FILENAME

+            REQUEST_PATH

+            CONTEXT_PATH

+            SERVLET_PATH

+            PATH_INFO

+            QUERY_STRING

+            AUTH_TYPE

+          
+          
+          
+          server internals:
+          
+            DOCUMENT_ROOT

+            SERVER_NAME

+            SERVER_ADDR

+            SERVER_PORT

+            SERVER_PROTOCOL

+            SERVER_SOFTWARE

+          
+          
+          
+          date and time:
+          
+            TIME_YEAR

+            TIME_MON

+            TIME_DAY

+            TIME_HOUR

+            TIME_MIN

+            TIME_SEC

+            TIME_WDAY

+            TIME

+          
+          
+          
+          specials:
+          
+            THE_REQUEST

+            REQUEST_URI

+            REQUEST_FILENAME

+            HTTPS

+          
+          
+          
+
+                These variables all
+                correspond to the similarly named HTTP
+                MIME-headers and Servlet API methods.
+                Most are documented elsewhere in the Manual or in
+                the CGI specification. Those that are special to
+                the rewrite valve include those below.
+
+                
+
+                  REQUEST_PATH
+
+                  Corresponds to the full path that is used for mapping.
+
+                  CONTEXT_PATH
+
+                  Corresponds to the path of the mapped context.
+
+                  SERVLET_PATH
+
+                  Corresponds to the servlet path.
+
+                  THE_REQUEST
+
+                  The full HTTP request line sent by the
+                  browser to the server (e.g., "GET
+                  /index.html HTTP/1.1"). This does not
+                  include any additional headers sent by the
+                  browser.
+
+                  REQUEST_URI
+
+                  The resource requested in the HTTP request
+                  line. (In the example above, this would be
+                  "/index.html".)
+
+                  REQUEST_FILENAME
+
+                  The full local file system path to the file or
+                  script matching the request.
+
+                  HTTPS
+
+                  Will contain the text "on" if the connection is
+                  using SSL/TLS, or "off" otherwise.
+
+                
+
+        
+      
+
+      Other things you should be aware of:
+
+      
+        The variables SCRIPT_FILENAME and REQUEST_FILENAME
+        contain the same value - the value of the
+        filename field of the internal
+        request_rec structure of the Apache server.
+        The first name is the commonly known CGI variable name
+        while the second is the appropriate counterpart of
+        REQUEST_URI (which contains the value of the
+        uri field of request_rec).
+
+        
+        %{ENV:variable}, where variable can be
+        any Java system property, is also available.
+
+        
+        %{SSL:variable}, where variable is the
+        name of an SSL environment
+        variable, are implemented, except
+        SSL_SESSION_RESUMED, SSL_SECURE_RENEG,
+        SSL_COMPRESS_METHOD, SSL_TLS_SNI,
+        SSL_SRP_USER, SSL_SRP_USERINFO,
+        SSL_CLIENT_VERIFY,
+        SSL_CLIENT_SAN_OTHER_msUPN_n,
+        SSL_CLIENT_CERT_RFC4523_CEA,
+        SSL_SERVER_SAN_OTHER_dnsSRV_n.
+        When OpenSSL is used, the variables related to the server
+        certificate, prefixed by SSL_SERVER_ are not available.
+        Example:
+        %{SSL:SSL_CIPHER_USEKEYSIZE} may expand to
+        128.
+
+        
+        %{HTTP:header}, where header can be
+        any HTTP MIME-header name, can always be used to obtain the
+        value of a header sent in the HTTP request.
+        Example: %{HTTP:Proxy-Connection} is
+        the value of the HTTP header
+        'Proxy-Connection:'.
+
+      
+
+      CondPattern is the condition pattern,
+       a regular expression which is applied to the
+      current instance of the TestString.
+      TestString is first evaluated, before being matched against
+      CondPattern.
+
+      Remember: CondPattern is a
+      perl compatible regular expression with some
+      additions:
+
+      
+        You can prefix the pattern string with a
+        '!' character (exclamation mark) to specify a
+        non-matching pattern.
+
+        
+          There are some special variants of CondPatterns.
+          Instead of real regular expression strings you can also
+          use one of the following:
+
+          
+            '<CondPattern' (lexicographically
+            precedes)

+            Treats the CondPattern as a plain string and
+            compares it lexicographically to TestString. True if
+            TestString lexicographically precedes
+            CondPattern.
+
+            '>CondPattern' (lexicographically
+            follows)

+            Treats the CondPattern as a plain string and
+            compares it lexicographically to TestString. True if
+            TestString lexicographically follows
+            CondPattern.
+
+            '=CondPattern' (lexicographically
+            equal)

+            Treats the CondPattern as a plain string and
+            compares it lexicographically to TestString. True if
+            TestString is lexicographically equal to
+            CondPattern (the two strings are exactly
+            equal, character for character). If CondPattern
+            is "" (two quotation marks) this
+            compares TestString to the empty string.
+
+            '-d' (is
+            directory)

+             Treats the TestString as a pathname and tests
+            whether or not it exists, and is a directory.
+
+            '-f' (is regular
+            file)

+             Treats the TestString as a pathname and tests
+            whether or not it exists, and is a regular file.
+
+            '-s' (is regular file, with
+            size)

+            Treats the TestString as a pathname and tests
+            whether or not it exists, and is a regular file with size greater
+            than zero.
+
+          
+
+Note:
+              All of these tests can
+              also be prefixed by an exclamation mark ('!') to
+              negate their meaning.
+
+        
+
+        You can also set special flags for
+      CondPattern by appending
+        [flags]
+      as the third argument to the RewriteCond
+      directive, where flags is a comma-separated list of any of the
+      following flags:
+
+      
+        'nocase|NC'
+        (no case)

+        This makes the test case-insensitive - differences
+        between 'A-Z' and 'a-z' are ignored, both in the
+        expanded TestString and the CondPattern.
+        This flag is effective only for comparisons between
+        TestString and CondPattern. It has no
+        effect on file system and subrequest checks.
+
+        
+          'ornext|OR'
+          (or next condition)

+          Use this to combine rule conditions with a local OR
+          instead of the implicit AND. Typical example:
+
+RewriteCond %{REMOTE_HOST}  ^host1.*  [OR]
+RewriteCond %{REMOTE_HOST}  ^host2.*  [OR]
+RewriteCond %{REMOTE_HOST}  ^host3.*
+RewriteRule ...some special stuff for any of these hosts...
+
+          Without this flag you would have to write the condition/rule
+          pair three times.
+        
+      
+      
+     
+
+      Example:
+
+       To rewrite the Homepage of a site according to the
+        'User-Agent:' header of the request, you can
+        use the following: 
+
+RewriteCond  %{HTTP_USER_AGENT}  ^Mozilla.*
+RewriteRule  ^/$                 /homepage.max.html  [L]
+
+RewriteCond  %{HTTP_USER_AGENT}  ^Lynx.*
+RewriteRule  ^/$                 /homepage.min.html  [L]
+
+RewriteRule  ^/$                 /homepage.std.html  [L]
+
+        Explanation: If you use a browser which identifies itself
+        as 'Mozilla' (including Netscape Navigator, Mozilla etc), then you
+        get the max homepage (which could include frames, or other special
+        features).
+        If you use the Lynx browser (which is terminal-based), then
+        you get the min homepage (which could be a version designed for
+        easy, text-only browsing).
+        If neither of these conditions apply (you use any other browser,
+        or your browser identifies itself as something non-standard), you get
+        the std (standard) homepage.
+
+  
+
+  RewriteMap

+
+    Syntax: RewriteMap name rewriteMapClassName optionalParameters
+
+    The rewriteMapClassName value also allows special values:
+    

+    int:toupper: Special map converting passed values to upper case
+    int:tolower: Special map converting passed values to lower case
+    int:escape: URL escape the passed value
+    int:unescape: URL unescape the passed value
+    
+    
+
+    The maps are implemented using an interface that users must implement. Its class
+    name is org.apache.catalina.valves.rewrite.RewriteMap, and its code is:
+
+package org.apache.catalina.valves.rewrite;
+
+public interface RewriteMap {
+    default String setParameters(String params...); // calls setParameters(String) with the first parameter if there is only one
+    public String setParameters(String params);
+    public String lookup(String key);
+}
+
+    The referenced implementation of such a class – in our example rewriteMapClassName –
+    will be instantiated and initialized with the optional parameter – optionalParameters from above
+    (be careful with whitespace) – by calling setParameters(String). That instance
+    will then be registered under the name given as the first parameter of RewriteMap rule.
+
+    Note: Starting with Tomcat 9 you can use more than one parameter. These have to be separated by spaces. Parameters
+    can be quoted with ". This enables space characters inside parameters.
+
+    That map instance will be given the lookup value that is configured in the corresponding RewriteRule by
+    calling lookup(String). Your implementation is free to return null to indicate,
+    that the given default should be used, or to return a replacement value.
+
+    Say, you want to implement a rewrite map function that converts all lookup keys to uppercase. You
+    would start by implementing a class that implements the RewriteMap interface.
+
+package example.maps;
+
+import org.apache.catalina.valves.rewrite.RewriteMap;
+
+public class UpperCaseMap implements RewriteMap {
+
+  @Override
+  public String setParameters(String params) {
+    // nothing to be done here
+    return null;
+  }
+
+  @Override
+  public String lookup(String key) {
+    if (key == null) {
+      return null;
+    }
+    return key.toUpperCase(Locale.ENGLISH);
+  }
+
+}
+
+    Compile this class, put it into a jar and place that jar in ${CATALINA_BASE}/lib.
+
+    Having done that, you can now define a map with the RewriteMap directive
+    and further on use that map in a RewriteRule.
+
+RewriteMap uc example.maps.UpperCaseMap
+
+RewriteRule ^/(.*)$ ${uc:$1}
+
+
+    With this setup a request to the url path /index.html would get routed
+    to /INDEX.HTML.
+  
+
+  RewriteRule

+
+    Syntax: RewriteRule Pattern Substitution
+
+      The RewriteRule directive is the real
+      rewriting workhorse. The directive can occur more than once,
+      with each instance defining a single rewrite rule. The
+      order in which these rules are defined is important - this is the order
+      in which they will be applied at run-time.
+
+      Pattern is a perl compatible regular
+      expression, which is applied to the current URL.
+      'Current' means the value of the URL when this rule is
+      applied. This may not be the originally requested URL,
+      which may already have matched a previous rule, and have been
+      altered.
+
+      Security warning: Due to the way Java's
+      regex matching is done, poorly formed regex patterns are vulnerable
+      to "catastrophic backtracking", also known as "regular expression
+      denial of service" or ReDoS. Therefore, extra caution should be used
+      for RewriteRule patterns. In general it is difficult to automatically
+      detect such vulnerable regex, and so a good defense is to read a bit
+      on the subject of catastrophic backtracking. A good reference is the
+      
+      OWASP ReDoS guide.
+
+      Some hints on the syntax of regular
+      expressions:
+
+
++Text:
+  .           Any single character
+  [chars]     Character class: Any character of the class 'chars'
+  [^chars]    Character class: Not a character of the class 'chars'
+  text1|text2 Alternative: text1 or text2
+
+Quantifiers:
+  ?           0 or 1 occurrences of the preceding text
+  *           0 or N occurrences of the preceding text (N > 0)
+  +           1 or N occurrences of the preceding text (N > 1)
+
+Grouping:
+  (text)      Grouping of text
+              (used either to set the borders of an alternative as above, or
+              to make backreferences, where the Nth group can
+              be referred to on the RHS of a RewriteRule as $N)
+
+Anchors:
+  ^           Start-of-line anchor
+  $           End-of-line anchor
+
+Escaping:
+  \char       escape the given char
+              (for instance, to specify the chars ".[]()" etc.)
+
+
+      For more information about regular expressions, have a look at the
+      perl regular expression manpage ("perldoc
+      perlre"). If you are interested in more detailed
+      information about regular expressions and their variants
+      (POSIX regex etc.) the following book is dedicated to this topic:
+
+      
+        Mastering Regular Expressions, 2nd Edition

+         Jeffrey E.F. Friedl

+         O'Reilly & Associates, Inc. 2002

+         ISBN 978-0-596-00289-3

+      
+
+      In the rules, the NOT character
+       ('!') is also available as a possible pattern
+      prefix. This enables you to negate a pattern; to say, for instance:
+      'if the current URL does NOT match this
+      pattern'. This can be used for exceptional cases, where
+      it is easier to match the negative pattern, or as a last
+      default rule.
+
+
+Note: When using the NOT character to negate a pattern, you cannot include
+grouped wildcard parts in that pattern. This is because, when the
+pattern does NOT match (i.e., the negation matches), there are no
+contents for the groups. Thus, if negated patterns are used, you
+cannot use $N in the substitution string!
+
+
+      The substitution of a
+      rewrite rule is the string which is substituted for (or
+      replaces) the original URL which Pattern
+      matched. In addition to plain text, it can include
+
+      
+        back-references ($N) to the RewriteRule
+        pattern
+
+        back-references (%N) to the last matched
+        RewriteCond pattern
+
+        server-variables as in rule condition test-strings
+        (%{VARNAME})
+
+        mapping-function calls
+        (${mapname:key|default})
+      
+      Back-references are identifiers of the form
+      $N
+      (N=0..9), which will be replaced
+      by the contents of the Nth group of the
+      matched Pattern. The server-variables are the same
+      as for the TestString of a RewriteCond
+      directive. The mapping-functions come from the
+      RewriteMap directive and are explained there.
+      These three types of variables are expanded in the order above.
+
+      As already mentioned, all rewrite rules are
+      applied to the Substitution (in the order in which
+      they are defined
+      in the config file). The URL is completely
+      replaced by the Substitution and the
+      rewriting process continues until all rules have been applied,
+      or it is explicitly terminated by a
+      L flag.
+
+      The special characters $ and % can
+      be quoted by prepending them with a backslash character
+      \.
+
+      There is a special substitution string named
+      '-' which means: NO
+      substitution! This is useful in providing
+      rewriting rules which only match
+      URLs but do not substitute anything for them. It is commonly used
+      in conjunction with the C (chain) flag, in order
+      to apply more than one pattern before substitution occurs.
+
+      Unlike newer mod_rewrite versions, the Tomcat rewrite valve does
+      not automatically support absolute URLs (the specific redirect flag
+      must be used to be able to specify an absolute URLs, see below)
+      or direct file serving.
+
+      Additionally you can set special flags for Substitution by
+      appending [flags]
+      as the third argument to the RewriteRule
+      directive. Flags is a comma-separated list of any of the
+      following flags: 
+
+      
+        'chain|C'
+        (chained with next rule)

+         This flag chains the current rule with the next rule
+        (which itself can be chained with the following rule,
+        and so on). This has the following effect: if a rule
+        matches, then processing continues as usual -
+        the flag has no effect. If the rule does
+        not match, then all following chained
+        rules are skipped. For instance, it can be used to remove the
+        '.www' part, inside a per-directory rule set,
+        when you let an external redirect happen (where the
+        '.www' part should not occur!).
+
+        
+        'cookie|CO=NAME:VAL:domain[:lifetime[:path]]'
+        (set cookie)

+        This sets a cookie in the client's browser.  The cookie's name
+        is specified by NAME and the value is
+        VAL. The domain field is the domain of the
+        cookie, such as '.apache.org', the optional lifetime
+        is the lifetime of the cookie in minutes, and the optional
+        path is the path of the cookie
+
+        
+        'env|E=VAR:VAL'
+        (set environment variable)

+        This forces a request attribute named VAR to
+        be set to the value VAL, where VAL can
+        contain regexp backreferences ($N and
+        %N) which will be expanded. You can use this
+        flag more than once, to set more than one variable.
+
+        'forbidden|F' (force URL
+        to be forbidden)

+        This forces the current URL to be forbidden - it immediately
+        sends back an HTTP response of 403 (FORBIDDEN).
+        Use this flag in conjunction with
+        appropriate RewriteConds to conditionally block some
+        URLs.
+
+        'gone|G' (force URL to be
+        gone)

+        This forces the current URL to be gone - it
+        immediately sends back an HTTP response of 410 (GONE). Use
+        this flag to mark pages which no longer exist as gone.
+
+        
+        'host|H=Host'
+        (apply rewriting to host)

+        Rather that rewrite the URL, the virtual host will be
+        rewritten.
+
+        'last|L'
+        (last rule)

+        Stop the rewriting process here and don't apply any more
+        rewrite rules. This corresponds to the Perl
+        last command or the break command
+        in C. Use this flag to prevent the currently
+        rewritten URL from being rewritten further by following
+        rules. For example, use it to rewrite the root-path URL
+        ('/') to a real one, e.g.,
+        '/e/www/'.
+
+        'next|N'
+        (next round)

+        Re-run the rewriting process (starting again with the
+        first rewriting rule). This time, the URL to match is no longer
+        the original URL, but rather the URL returned by the last rewriting rule.
+        This corresponds to the Perl next command or
+        the continue command in C. Use
+        this flag to restart the rewriting process -
+        to immediately go to the top of the loop.

+         Be careful not to create an infinite
+        loop!
+
+        'nocase|NC'
+        (no case)

+        This makes the Pattern case-insensitive,
+        ignoring difference between 'A-Z' and
+        'a-z' when Pattern is matched against the current
+        URL.
+
+        
+          'noescape|NE'
+          (no URI escaping of
+          output)

+          This flag prevents the rewrite valve from applying the usual URI
+          escaping rules to the result of a rewrite. Ordinarily,
+          special characters (such as '%', '$', ';', and so on)
+          will be escaped into their hexcode equivalents ('%25',
+          '%24', and '%3B', respectively); this flag prevents this
+          from happening. This allows percent symbols to appear in
+          the output, as in
+          RewriteRule /foo/(.*) /bar?arg=P1\%3d$1 [R,NE]
+          which would turn '/foo/zed' into a safe
+          request for '/bar?arg=P1=zed'.
+        
+
+
+
+        'qsappend|QSA'
+        (query string
+        append)

+        This flag forces the rewrite engine to append a query
+        string part of the substitution string to the existing string,
+        instead of replacing it. Use this when you want to add more
+        data to the query string via a rewrite rule.
+
+         'redirect|R
+          [=code]' (force 
+          redirect)

+          Prefix Substitution with
+          http://thishost[:thisport]/ (which makes the
+          new URL a URI) to force an external redirection. If no
+          code is given, an HTTP response of 302 (FOUND, previously MOVED
+          TEMPORARILY) will be returned. If you want to use other response
+          codes in the range 300-399, simply specify the appropriate number
+          or use one of the following symbolic names:
+          temp (default), permanent,
+          seeother. Use this for rules to
+          canonicalize the URL and return it to the client - to
+          translate '/~' into
+          '/u/', or to always append a slash to
+          /u/user, etc.

+          Note: When you use this flag, make
+          sure that the substitution field is a valid URL! Otherwise,
+          you will be redirecting to an invalid location. Remember
+          that this flag on its own will only prepend
+          http://thishost[:thisport]/ to the URL, and rewriting
+          will continue. Usually, you will want to stop rewriting at this point,
+          and redirect immediately. To stop rewriting, you should add
+          the 'L' flag.
+        
+
+        'skip|S=num'
+        (skip next rule(s))

+        This flag forces the rewriting engine to skip the next
+        num rules in sequence, if the current rule
+        matches. Use this to make pseudo if-then-else constructs:
+        The last rule of the then-clause becomes
+        skip=N, where N is the number of rules in the
+        else-clause. (This is not the same as the
+        'chain|C' flag!)
+
+        
+        'type|T=MIME-type'
+        (force MIME type)

+         Force the MIME-type of the target file to be
+        MIME-type. This can be used to
+        set up the content-type based on some conditions.
+        For example, the following snippet allows .php files to
+        be displayed by mod_php if they are called with
+        the .phps extension:
+        RewriteRule ^(.+\.php)s$ $1 [T=application/x-httpd-php-source]
+        
+
+        'valveSkip|VS'
+        (skip valve)

+        This flag can be used to setup conditional execution of valves.
+        When the flag is set and the rule matches, the rewrite valve will skip
+        the next valve in the Catalina pipeline. If the rewrite valve is the
+        last of the pipeline, then the flag will be ignored and the container
+        basic valve will be invoked. If rewrite occurred, then the flag will
+        not have any effect.
+        
+
+      
+
+  
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/security-howto.html b/apache-tomcat-9.0.109/webapps/docs/security-howto.html
new file mode 100644
index 0000000..1b7b3d3
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/security-howto.html
@@ -0,0 +1,624 @@
+
+Apache Tomcat 9 (9.0.109) - Security Considerations
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Security Considerations
Table of Contents

+Introduction
Non-Tomcat settingsJMX
Default web applicationsGeneral
ROOT
Documentation
Examples
Manager
Host Manager
Securing Management Applications
User web applications
Security manager
server.xmlGeneral
Server
Listeners
Connectors
Host
Context
Valves
Realms
Manager
Cluster
System Properties
web.xml
Embedded Tomcat
Reverse Proxies
General
+
Introduction

+    Tomcat is configured to be reasonably secure for most use cases by
+    default. Some environments may require more, or less, secure configurations.
+    This page is to provide a single point of reference for configuration
+    options that may impact security and to offer some commentary on the
+    expected impact of changing those options. The intention is to provide a
+    list of configuration options that should be considered when assessing the
+    security of a Tomcat installation.
+
+    Note: Reading this page is not a substitute for reading
+    and understanding the detailed configuration documentation. Fuller
+    descriptions of these attributes may be found in the relevant documentation
+    pages.
+  
Non-Tomcat settings

+    Tomcat configuration should not be the only line of defense. The other
+    components in the system (operating system, network, database, etc.) should
+    also be secured.
+    Tomcat should not be run under the root user. Create a dedicated user for
+    the Tomcat process and provide that user with the minimum necessary
+    permissions for the operating system. For example, it should not be possible
+    to log on remotely using the Tomcat user.
+    File permissions should also be suitably restricted. In the
+    .tar.gz distribution, files and directories are not world
+    readable and the group does not have write access. On Unix like operating
+    systems, Tomcat runs with a default umask of 0027 to maintain
+    these permissions for files created while Tomcat is running (e.g. log files,
+    expanded WARs, etc.).
+    Taking the Tomcat instances at the ASF as an example (where
+    auto-deployment is disabled and web applications are deployed as exploded
+    directories), the standard configuration is to have all Tomcat files owned
+    by root with group Tomcat and whilst owner has read/write privileges, group
+    only has read and world has no permissions. The exceptions are the logs,
+    temp and work directory that are owned by the Tomcat user rather than root.
+    This means that even if an attacker compromises the Tomcat process, they
+    can't change the Tomcat configuration, deploy new web applications or
+    modify existing web applications. The Tomcat process runs with a umask of
+    007 to maintain these permissions.
+    At the network level, consider using a firewall to limit both incoming
+    and outgoing connections to only those connections you  expect to be
+    present.
+
+    JMX

+      The security of the JMX connection is dependent on the implementation
+      provided by the JRE and therefore falls outside the control of Tomcat.
+
+      Typically, access control is very limited (either read-only to
+      everything or read-write to everything). Tomcat exposes a large amount
+      of internal information and control via JMX to aid debugging, monitoring
+      and management. Given the limited access control available, JMX access
+      should be treated as equivalent to local root/admin access and restricted
+      accordingly.
+
+      The JMX access control provided by most (all?) JRE vendors does not
+      log failed authentication attempts, nor does it provide an account
+      lock-out feature after repeated failed authentications. This makes a
+      brute force attack easy to mount and difficult to detect.
+
+      Given all of the above, care should be taken to ensure that, if used,
+      the JMX interface is appropriately secured. Options you may wish to
+      consider to secure the JMX interface include:
+
+      
+        configuring a strong password for all JMX users;
+        binding the JMX listener only to an internal network;
+        limiting network access to the JMX port to trusted clients; and
+        providing an application specific health page for use by external
+            monitoring systems.
+      
+    
+
+  
Default web applications

+
+    General

+      Tomcat ships with a number of web applications that are enabled by
+      default. Vulnerabilities have been discovered in these applications in the
+      past. Applications that are not required should be removed so the system
+      will not be at risk if another vulnerability is discovered.
+    
+
+    ROOT

+      The ROOT web application presents a very low security risk but it does
+      include the version of Tomcat that is being used. The ROOT web application
+      should normally be removed from a publicly accessible Tomcat instance, not
+      for security reasons, but so that a more appropriate default page is shown
+      to users.
+    
+
+    Documentation

+      The documentation web application presents a very low security risk but
+      it does identify the version of Tomcat that is being used. It should
+      normally be removed from a publicly accessible Tomcat instance.
+    
+
+    Examples

+      The examples web application should always be removed from any security
+      sensitive installation. While the examples web application does not
+      contain any known vulnerabilities, it is known to contain features
+      (particularly the cookie examples that display the contents of all cookies
+      received and allow new cookies to be set) that may be used by an attacker
+      in conjunction with a vulnerability in another application deployed on the
+      Tomcat instance to obtain additional information that would otherwise be
+      unavailable.
+    
+
+    Manager

+      The Manager application allows the remote deployment of web
+      applications and is frequently targeted by attackers due to the widespread
+      use of weak passwords and publicly accessible Tomcat instances with the
+      Manager application enabled. The Manager application is not accessible by
+      default as no users are configured with the necessary access. If the
+      Manager application is enabled then guidance in the section
+      Securing Management Applications section should be
+      followed.
+    
+
+    Host Manager

+      The Host Manager application allows the creation and management of
+      virtual hosts - including the enabling of the Manager application for a
+      virtual host. The Host Manager application is not accessible by default
+      as no users are configured with the necessary access. If the Host Manager
+      application is enabled then guidance in the section Securing
+      Management Applications section should be followed.
+    
+
+   Securing Management Applications

+     When deploying a web application that provides management functions for
+     the Tomcat instance, the following guidelines should be followed:
+     
+       Ensure that any users permitted to access the management application
+           have strong passwords.
+       Do not remove the use of the LockOutRealm
+           which prevents brute force attacks against user passwords.
+       Configure the RemoteAddrValve
+           in the context.xml file for the
+           management application which limits access to localhost by default.
+           If remote access is required, limit it to specific IP addresses using
+           this valve.
+     
+   
+  
User web applications

+    Web applications are assumed to be trusted. It is not safe to deploy web
+    applications from untrusted sources.
+
+    Any application functionality that permits the modification of a web
+    application (WebDAV, HTTP PUT requests etc.) may impact the security of
+    either the web application or the Tomcat instance on which it is running.
+    Such functionality should either be restricted to trusted users or
+    limited in scope (e.g. via security constraints) such that users with access
+    to the functionality are unable to imapct the security of either the web
+    application or the Tomcat instance on which it is running.
+  
Security manager

+    Enabling the security manager causes web applications to be run in a
+    sandbox, significantly limiting a web application's ability to perform
+    malicious actions such as calling System.exit(), establishing network
+    connections or accessing the file system outside of the web application's
+    root and temporary directories. However, it should be noted that there are
+    some malicious actions, such as triggering high CPU consumption via an
+    infinite loop, that the security manager cannot prevent.
+
+    Enabling the security manager is usually done to limit the potential
+    impact, should an attacker find a way to compromise a trusted web
+    application . A security manager may also be used to reduce the risks of
+    running untrusted web applications (e.g. in hosting environments) but it
+    should be noted that the security manager only reduces the risks of
+    running untrusted web applications, it does not eliminate them. If running
+    multiple untrusted web applications, it is recommended that each web
+    application is deployed to a separate Tomcat instance (and ideally separate
+    hosts) to reduce the ability of a malicious web application impacting the
+    availability of other applications.
+
+    Tomcat is tested with the security manager enabled; but the majority of
+    Tomcat users do not run with a security manager, so Tomcat is not as well
+    user-tested in this configuration. There have been, and continue to be,
+    bugs reported that are triggered by running under a security manager.
+
+    The restrictions imposed by a security manager are likely to break most
+    applications if the security manager is enabled. The security manager should
+    not be used without extensive testing. Ideally, the use of a security
+    manager should be introduced at the start of the development cycle as it can
+    be time-consuming to track down and fix issues caused by enabling a security
+    manager for a mature application.
+
+    Enabling the security manager changes the defaults for the following
+    settings:
+    
+      The default value for the deployXML attribute of the
+      Host element is changed to false.
+    
+  
server.xml

+    General

+      The default server.xml contains a large number of comments, including
+      some example component definitions that are commented out. Removing these
+      comments makes it considerably easier to read and comprehend
+      server.xml.
+      If a component type is not listed, then there are no settings for that
+      type that directly impact security.
+    
+
+    Server

+      Setting the port attribute to -1 disables
+      the shutdown port.
+      If the shutdown port is not disabled, a strong password should be
+      configured for shutdown.
+    
+
+    Listeners

+      The APR Lifecycle Listener is not stable if compiled on Solaris using
+      gcc. If using the APR/native connector on Solaris, compile it with the
+      Sun Studio compiler.
+      The JNI Library Loading Listener may be used to load native code. It should
+      only be used to load trusted libraries.
+      The Security Lifecycle Listener should be enabled and configured as appropriate.
+      
+    
+
+    Connectors

+      By default, a non-TLS, HTTP/1.1 connector is configured on port 8080.
+      Connectors that will not be used should be removed from server.xml.
+
+      AJP is a clear text protocol. AJP Connectors should normally only be
+      used on trusted networks. If used on an untrusted network, use of the
+      secret attribute will limit access to authorised clients but
+      the secret attribute will be visible to anyone who can
+      observe network traffic.
+
+      AJP Connectors block forwarded requests with unknown request
+      attributes. Known safe and/or expected attributes may be allowed by
+      configuration an appropriate regular expression for the
+      allowedRequestAttributesPattern attribute.
+
+      The address attribute may be used to control which IP
+      address a connector listens on for connections. By default, a connector
+      listens on all configured IP addresses.
+
+      The allowTrace attribute may be used to enable TRACE
+      requests which can be useful for debugging. Due to the way some browsers
+      handle the response from a TRACE request (which exposes the browser to an
+      XSS attack), support for TRACE requests is disabled by default.
+
+      The discardFacades attribute set to true
+      will cause a new facade object to be created for each request. This
+      reduces the chances of a bug in an application exposing data from one
+      request to another.
+
+      The encodedSolidusHandling attribute allows
+      non-standard parsing of the request URI. Setting this attribute to a
+      non-default value when behind a reverse proxy may enable an attacker to
+      bypass any security constraints enforced by the proxy.
+
+      The maxParameterCount attribute controls the maximum
+      total number of request parameters (including uploaded files) obtained
+      from the query string and, for POST requests, the request body if the
+      content type is application/x-www-form-urlencoded or
+      multipart/form-data. Excessive parameters are ignored. If you
+      want to reject such requests, configure a
+      FailedRequestFilter.
+
+      The maxPartCount attribute controls the maximum number
+      of parts supported for a multipart request. This is limited to 50 by
+      default to reduce exposure to a DoS attack. The documentation for
+      maxPartCount provides more details on the memory
+      requirements for processing multipart requests. Excessive parts may be
+      ignored depending on how the application processes the request. If you
+      want to always reject such requests, configure a
+      FailedRequestFilter.
+
+      The maxPostSize attribute controls the maximum size
+      of a POST request that will be parsed for parameters. The parameters are
+      cached for the duration of the request so this is limited to 2 MiB by
+      default to reduce exposure to a DoS attack.
+
+      The maxSavePostSize attribute controls the saving of
+      the request body during FORM and CLIENT-CERT authentication and HTTP/1.1
+      upgrade. For FORM authentication, the request body is cached in the HTTP
+      session for the duration of the authentication so the cached request body
+      is limited to 4 KiB by default to reduce exposure to a DOS attack. To
+      further reduce exposure to a DoS attack by limiting the permitted duration
+      of the FORM authentication, a reduced session timeout is used if the
+      session is created by the FORM authentication. This reduced timeout is
+      controlled by the authenticationSessionTimeout attribute of
+      the FORM
+      authenticator.
+
+      The requiredSecret attribute in AJP connectors
+      configures shared secret between Tomcat and reverse proxy in front of
+      Tomcat. It is used to prevent unauthorized connections over AJP protocol.
+
+      The server attribute controls the value of the Server
+      HTTP header. The default value of this header for Tomcat 4.1.x to
+      8.0.x is Apache-Coyote/1.1. From 8.5.x onwards this header is not set by
+      default. This header can provide limited information to both legitimate
+      clients and attackers.
+
+      The SSLEnabled, scheme and
+      secure attributes may all be independently set. These are
+      normally used when Tomcat is located behind a reverse proxy and the proxy
+      is connecting to Tomcat via HTTP or HTTPS. They allow Tomcat to see the
+      SSL attributes of the connections between the client and the proxy rather
+      than the proxy and Tomcat. For example, the client may connect to the
+      proxy over HTTPS but the proxy connects to Tomcat using HTTP. If it is
+      necessary for Tomcat to be able to distinguish between secure and
+      non-secure connections received by a proxy, the proxy must use separate
+      connectors to pass secure and non-secure requests to Tomcat. If the
+      proxy uses AJP then the SSL attributes of the client connection are
+      passed via the AJP protocol and separate connectors are not needed.
+
+      The tomcatAuthentication and
+      tomcatAuthorization attributes are used with the
+      AJP connectors to determine if Tomcat should handle all authentication and
+      authorisation or if authentication should be delegated to the reverse
+      proxy (the authenticated user name is passed to Tomcat as part of the AJP
+      protocol) with the option for Tomcat to still perform authorization.
+
+      The xpoweredBy attribute controls whether or not the
+      X-Powered-By HTTP header is sent with each request. If sent, the value of
+      the header contains the Servlet and JSP specification versions, the full
+      Tomcat version (e.g. Apache Tomcat/9.0), the name of
+      the JVM vendor and
+      the version of the JVM. This header is disabled by default. This header
+      can provide useful information to both legitimate clients and attackers.
+      
+    
+
+    Host

+      The host element controls deployment. Automatic deployment allows for
+      simpler management but also makes it easier for an attacker to deploy a
+      malicious application. Automatic deployment is controlled by the
+      autoDeploy and deployOnStartup
+      attributes. If both are false, only Contexts defined in
+      server.xml will be deployed and any changes will require a Tomcat restart.
+      
+
+      In a hosted environment where web applications may not be trusted, set
+      the deployXML attribute to false to ignore
+      any context.xml packaged with the web application that may try to assign
+      increased privileges to the web application. Note that if the security
+      manager is enabled that the deployXML attribute will
+      default to false.
+    
+
+    Context

+      This applies to Context
+      elements in all places where they can be defined:
+      server.xml file,
+      default context.xml file,
+      per-host context.xml.default file,
+      web application context file in per-host configuration directory
+      or inside the web application.
+
+      The crossContext attribute controls if a context is
+      allowed to access the resources of another context. It is
+      false by default and should only be changed for trusted web
+      applications.
+
+      The privileged attribute controls if a context is
+      allowed to use container provided servlets like the Manager servlet. It is
+      false by default and should only be changed for trusted web
+      applications.
+
+      The allowLinking attribute of a nested
+      Resources element controls if a context
+      is allowed to use linked files. If enabled and the context is undeployed,
+      the links will be followed when deleting the context resources. Changing
+      this setting from the default of false on case insensitive
+      operating systems (this includes Windows) will disable a number of
+      security measures and allow, among other things, direct access to the
+      WEB-INF directory.
+
+      The sessionCookiePathUsesTrailingSlash can be used to
+      work around a bug in a number of browsers (Internet Explorer, Safari and
+      Edge) to prevent session cookies being exposed across applications when
+      applications share a common path prefix. However, enabling this option
+      can create problems for applications with Servlets mapped to
+      /*. It should also be noted the RFC6265 section 8.5 makes it
+      clear that different paths should not be considered sufficient to isolate
+      cookies from other applications.
+
+      When antiResourceLocking is enabled, Tomcat will copy
+      the unpacked web application to the directory defined by the
+      java.io.tmpdir system property
+      ($CATALINA_BASE/temp by default). This location should be
+      secured with appropriate file permissions - typically read/write for the
+      Tomcat user and no access for other users.
+
+      When mapperContextRootRedirectEnabled and/or
+      mapperDirectoryRedirectEnabled are enabled, request
+      processing will be more efficient but there are security side effects.
+      First, the existence of a web application or a directory may be confirmed
+      even though the user does not have access to that directory. Secondly, any
+      Valves and/or Filters - including those providing security functionality -
+      will not have an opportunity to process the request.
+
+    
+
+    Valves

+      It is strongly recommended that an AccessLogValve is configured. The
+      default Tomcat configuration includes an AccessLogValve. These are
+      normally configured per host but may also be configured per engine or per
+      context as required.
+
+      Any administrative application should be protected by a
+      RemoteAddrValve (this Valve is also available as a Filter).
+      The allow attribute should be used to limit access to a
+      set of known trusted hosts.
+
+      The default ErrorReportValve includes the Tomcat version number in the
+      response sent to clients. To avoid this, custom error handling can be
+      configured within each web application. Alternatively, you can explicitly
+      configure an ErrorReportValve and set its
+      showServerInfo attribute to false.
+      Alternatively, the version number can be changed by creating the file
+      CATALINA_BASE/lib/org/apache/catalina/util/ServerInfo.properties with
+      content as follows:
+      server.info=Apache Tomcat/9.0.x
+      Modify the values as required. Note that this will also change the version
+      number reported in some of the management tools and may make it harder to
+      determine the real version installed. The CATALINA_HOME/bin/version.bat|sh
+      script will still report the correct version number.
+
+      The default ErrorReportValve can display stack traces and/or JSP
+      source code to clients when an error occurs. To avoid this, custom error
+      handling can be configured within each web application. Alternatively, you
+      can explicitly configure an ErrorReportValve
+      and set its showReport attribute to false.
+
+      The RewriteValve uses regular expressions and poorly formed regex
+      patterns may be vulnerable to "catastrophic backtracking" or "ReDoS". See
+      Rewrite docs for more details.
+    
+
+    Realms

+      The MemoryRealm is not intended for production use as any changes to
+      tomcat-users.xml require a restart of Tomcat to take effect.
+
+      The JDBCRealm is not recommended for production use as it is single
+      threaded for all authentication and authorization options. Use the
+      DataSourceRealm instead.
+
+      The UserDatabaseRealm is not intended for large-scale installations. It
+      is intended for small-scale, relatively static environments.
+
+      The JAASRealm is not widely used and therefore the code is not as
+      mature as the other realms. Additional testing is recommended before using
+      this realm.
+
+      By default, the realms do not implement any form of account lock-out.
+      This means that brute force attacks can be successful. To prevent a brute
+      force attack, the chosen realm should be wrapped in a LockOutRealm.
+    
+
+    Manager

+      The manager component is used to generate session IDs.
+
+      The class used to generate random session IDs may be changed with
+      the randomClass attribute.
+
+      The length of the session ID may be changed with the
+      sessionIdLength attribute.
+
+      The persistAuthentication controls whether the
+      authenticated Principal associated with the session (if any) is included
+      when the session is persisted during a restart or to a Store.
+
+      When using the JDBCStore, the session store should be
+      secured (dedicated credentials, appropriate permissions) such that only
+      the JDBCStore is able to access the persisted session
+      data. In particular, the JDBCStore should not be
+      accessible via any credentials available to a web application.
+    
+
+    Cluster

+      The cluster implementation is written on the basis that a secure,
+      trusted network is used for all of the cluster related network traffic. It
+      is not safe to run a cluster on a insecure, untrusted network.
+
+      If you require confidentiality and/or integrity protection then you can
+      use the
+      EncryptInterceptor
+      to encrypt traffic between nodes. This interceptor does not protect
+      against all the risks of running on an untrusted network, particularly
+      DoS attacks.
+    
+  
System Properties

+    The 
+    org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH and
+    org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH
+    system properties allow non-standard parsing of the request URI. Using
+    these options when behind a reverse proxy may enable an attacker to bypass
+    any security constraints enforced by the proxy.
+
+    The 
+    org.apache.catalina.connector.Response.ENFORCE_ENCODING_IN_GET_WRITER
+     system property has security implications if disabled. Many user
+    agents, in breach of RFC2616, try to guess the character encoding of text
+    media types when the specification-mandated default of ISO-8859-1 should be
+    used. Some browsers will interpret as UTF-7 a response containing characters
+    that are safe for ISO-8859-1 but trigger an XSS vulnerability if interpreted
+    as UTF-7.
+  
web.xml

+    This applies to the default conf/web.xml file, the
+    /WEB-INF/tomcat-web.xml and the /WEB-INF/web.xml
+    files in web applications if they define the components mentioned here.
+
+    The DefaultServlet is configured
+    with readonly set to
+    true. Changing this to false allows clients to
+    delete or modify static resources on the server and to upload new
+    resources. This should not normally be changed without requiring
+    authentication.
+
+    The DefaultServlet is configured with listings set to
+    false. This isn't because allowing directory listings is
+    considered unsafe but because generating listings of directories with
+    thousands of files can consume significant CPU leading to a DOS attack.
+    
+
+    The DefaultServlet is configured with showServerInfo
+    set to true. When the directory listings is enabled the Tomcat
+    version number is included in the response sent to clients. To avoid this,
+    you can explicitly configure a DefaultServlet and set its
+    showServerInfo attribute to false.
+    Alternatively, the version number can be changed by creating the file
+    CATALINA_BASE/lib/org/apache/catalina/util/ServerInfo.properties with
+    content as follows:
+    server.info=Apache Tomcat/9.0.x
+    Modify the values as required. Note that this will also change the version
+    number reported in some of the management tools and may make it harder to
+    determine the real version installed. The CATALINA_HOME/bin/version.bat|sh
+    script will still report the correct version number.
+    
+
+    The CGI Servlet is disabled by default. If enabled, the debug
+    initialisation parameter should not be set to 10 or higher on a
+    production system because the debug page is not secure.
+
+    When using the CGI Servlet on Windows with
+    enableCmdLineArguments enabled, review the setting of
+    cmdLineArgumentsDecoded carefully and ensure that it is
+    appropriate for your environment. The default value is secure. Insecure
+    configurations may expose the server to remote code execution. Further
+    information on the potential risks and mitigations may be found by
+    following the links in the CGI How To.
+
+    FailedRequestFilter
+    can be configured and used to reject requests that had errors during
+    request parameter parsing. Without the filter the default behaviour is
+    to ignore invalid or excessive parameters.
+
+    HttpHeaderSecurityFilter can be
+    used to add headers to responses to improve security. If clients access
+    Tomcat directly, then you probably want to enable this filter and all the
+    headers it sets unless your application is already setting them. If Tomcat
+    is accessed via a reverse proxy, then the configuration of this filter needs
+    to be co-ordinated with any headers that the reverse proxy sets.
+
+    The WebDAV servlet enables edit functionality for web application
+    content. If the WebDAV servlet is enabled, the WebDAV functionality should
+    be appropriately secured.
+
+    When configuring security constraints, care should be taken if the URL
+    pattern for one or more constraints covers any segment of the URL that
+    becomes part of the pathInfo for a servlet and the servlet uses the pathInfo
+    to identify some other resource (like the default servlet does). In those
+    circumstances, correct application of the security constraint depends on the
+    implementation of the Servlet. All servlets included with Tomcat will behave
+    correctly in this scenario.
+  
Embedded Tomcat

+    When using embedded Tomcat, the typical defaults provided by the scripts,
+    server.xml and other configuration are not set. Users of embedded Tomcat may
+    wish to consider the following:
+    
+      The listeners normally configured in server.xml, including
+      org.apache.catalina.security.SecurityListener, will not be
+      configured by default. They must be explicitly enabled if required.
+      The java.io.tmpdir will not be set (it is normally set to
+      $CATALINA_BASE/temp). This directory is used for various
+      temporary files that may be security sensitive including file uploads and
+      a copy of the web application if anti-resource locking is enabled.
+      Consider setting the java.io.tmpdir system property to an
+      appropriately secured directory.
+    
+  
Reverse Proxies

+    All clients, including reverse proxies, are responsible for the
+    consequences of the data they present to Tomcat.
+
+    The servlet specification removes path parameters when normalizing
+    requests. HTTP servers do not normally do this. This creates the possibility
+    of a client using a /..;a=b/ type sequence in a URI to bypass a
+    security constraint implemented in the reverse proxy. This possibility can
+    be avoided with appropriate configuration such as using the setting
+    mapping=servlet with httpd's mod_proxy.
+
+    If Tomcat is deployed behind a reverse proxy and that reverse proxy
+    implements one or more security constraints, it is recommended a defense in
+    depth approach is taken and Tomcat is secured as if the reverse proxy was
+    not in use.
+  
General

+    BASIC and FORM authentication pass user names and passwords in clear
+    text. Web applications using these authentication mechanisms with clients
+    connecting over untrusted networks should use SSL.
+
+    The session cookie for a session with an authenticated user is nearly as
+    useful as the user's password to an attacker and should be afforded the same
+    level of protection as the password itself. This usually means
+    authenticating over SSL and continuing to use SSL until the session
+    ends.
+
+    Tomcat's implementation of the Servlet API's file upload support may use
+    the directory defined by the java.io.tmpdir system property
+    ($CATALINA_BASE/temp by default) to store temporary files. This
+    location should be secured with appropriate file permissions - typically
+    read/write for the Tomcat user and no access for other users.
+  

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/security-manager-howto.html b/apache-tomcat-9.0.109/webapps/docs/security-manager-howto.html
new file mode 100644
index 0000000..e9e3c4d
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/security-manager-howto.html
@@ -0,0 +1,477 @@
+
+Apache Tomcat 9 (9.0.109) - Security Manager How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Security Manager How-To
Table of Contents

+Background
Known Issues
PermissionsStandard Permissions
Configuring Tomcat With A SecurityManagerPermissions for packed WAR files
Configuring Package Protection in Tomcat
Troubleshooting
+
Background

+
+  The Java SecurityManager is what allows a web browser
+  to run an applet in its own sandbox to prevent untrusted code from
+  accessing files on the local file system, connecting to a host other
+  than the one the applet was loaded from, and so on.  In the same way
+  the SecurityManager protects you from an untrusted applet running in
+  your browser, use of a SecurityManager while running Tomcat can protect
+  your server from trojan servlets, JSPs, JSP beans, and tag libraries.
+  Or even inadvertent mistakes.
+
+  Imagine if someone who is authorized to publish JSPs on your site
+  inadvertently included the following in their JSP:
+<% System.exit(1); %>
+
+  Every time this JSP was executed by Tomcat, Tomcat would exit.
+  Using the Java SecurityManager is just one more line of defense a
+  system administrator can use to keep the server secure and reliable.
+
+  WARNING - A security audit
+  have been conducted using the Tomcat codebase. Most of the critical
+  package have been protected and a new security package protection mechanism
+  has been implemented. Still, make sure that you are satisfied with your SecurityManager
+  configuration before allowing untrusted users to publish web applications,
+  JSPs, servlets, beans, or tag libraries.  However, running with a
+  SecurityManager is definitely better than running without one.
+
+
Known Issues

+
+  As of Java 17, the SecurityManager has been deprecated with the expectation
+  that it will be removed in a future Java version. Users currently using a
+  SecurityManager are recommended to start planning for its removal.
+
+
Permissions

+
+  Permission classes are used to define what Permissions a class loaded
+  by Tomcat will have.  There are a number of Permission classes that are
+  a standard part of the JDK, and you can create your own Permission class
+  for use in your own web applications.  Both techniques are used in
+  Tomcat.
+
+
+  Standard Permissions

+
+    This is just a short summary of the standard system SecurityManager
+    Permission classes applicable to Tomcat.  See
+    
+    http://docs.oracle.com/javase/7/docs/technotes/guides/security/
+    for more information.
+
+    
+    java.util.PropertyPermission - Controls read/write
+        access to JVM properties such as java.home.
+    java.lang.RuntimePermission - Controls use of
+        some System/Runtime functions like exit() and
+        exec(). Also control the package access/definition.
+    java.io.FilePermission - Controls read/write/execute
+        access to files and directories.
+    java.net.SocketPermission - Controls use of
+        network sockets.
+    java.net.NetPermission - Controls use of
+        multicast network connections.
+    java.lang.reflect.ReflectPermission - Controls
+        use of reflection to do class introspection.
+    java.security.SecurityPermission - Controls access
+        to Security methods.
+    java.security.AllPermission - Allows access to all
+        permissions, just as if you were running Tomcat without a
+        SecurityManager.
+    
+
+  
+
+
Configuring Tomcat With A SecurityManager

+
+  Policy File Format
+
+  The security policies implemented by the Java SecurityManager are
+  configured in the $CATALINA_BASE/conf/catalina.policy file.
+  This file completely replaces the java.policy file present
+  in your JDK system directories.  The catalina.policy file
+  can be edited by hand, or you can use the
+  policytool
+  application that comes with Java 1.2 or later.
+
+  Entries in the catalina.policy file use the standard
+  java.policy file format, as follows:
+// Example policy file entry
+
+grant [signedBy <signer>,] [codeBase <code source>] {
+  permission  <class>  [<name> [, <action list>]];
+};
+
+  The signedBy and codeBase entries are
+  optional when granting permissions.  Comment lines begin with "//" and
+  end at the end of the current line.  The codeBase is in the
+  form of a URL, and for a file URL can use the ${java.home}
+  and ${catalina.home} properties (which are expanded out to
+  the directory paths defined for them by the JAVA_HOME,
+  CATALINA_HOME and CATALINA_BASE environment
+  variables).
+
+  The Default Policy File
+
+  The default $CATALINA_BASE/conf/catalina.policy file
+  looks like this:
+
+
+// Licensed to the Apache Software Foundation (ASF) under one or more
+// contributor license agreements.  See the NOTICE file distributed with
+// this work for additional information regarding copyright ownership.
+// The ASF licenses this file to You under the Apache License, Version 2.0
+// (the "License"); you may not use this file except in compliance with
+// the License.  You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// ============================================================================
+// catalina.policy - Security Policy Permissions for Tomcat
+//
+// This file contains a default set of security policies to be enforced (by the
+// JVM) when Catalina is executed with the "-security" option.  In addition
+// to the permissions granted here, the following additional permissions are
+// granted to each web application:
+//
+// * Read access to the web application's document root directory
+// * Read, write and delete access to the web application's working directory
+// ============================================================================
+
+
+// ========== SYSTEM CODE PERMISSIONS =========================================
+
+
+// These permissions apply to javac
+grant codeBase "file:${java.home}/lib/-" {
+        permission java.security.AllPermission;
+};
+
+// These permissions apply to all shared system extensions
+grant codeBase "file:${java.home}/jre/lib/ext/-" {
+        permission java.security.AllPermission;
+};
+
+// These permissions apply to javac when ${java.home} points at $JAVA_HOME/jre
+grant codeBase "file:${java.home}/../lib/-" {
+        permission java.security.AllPermission;
+};
+
+// These permissions apply to all shared system extensions when
+// ${java.home} points at $JAVA_HOME/jre
+grant codeBase "file:${java.home}/lib/ext/-" {
+        permission java.security.AllPermission;
+};
+
+// This permission is required when using javac to compile JSPs on Java 9
+// onwards
+//grant codeBase "jrt:/jdk.compiler" {
+//        permission java.security.AllPermission;
+//};
+
+
+// ========== CATALINA CODE PERMISSIONS =======================================
+
+// These permissions apply to the daemon code
+grant codeBase "file:${catalina.home}/bin/commons-daemon.jar" {
+        permission java.security.AllPermission;
+};
+
+// These permissions apply to the logging API
+// Note: If tomcat-juli.jar is in ${catalina.base} and not in ${catalina.home},
+// update this section accordingly.
+//  grant codeBase "file:${catalina.base}/bin/tomcat-juli.jar" {..}
+grant codeBase "file:${catalina.home}/bin/tomcat-juli.jar" {
+        permission java.io.FilePermission
+         "${java.home}${file.separator}lib${file.separator}logging.properties", "read";
+
+        permission java.io.FilePermission
+         "${catalina.base}${file.separator}conf${file.separator}logging.properties", "read";
+        permission java.io.FilePermission
+         "${catalina.base}${file.separator}logs", "read, write";
+        permission java.io.FilePermission
+         "${catalina.base}${file.separator}logs${file.separator}*", "read, write, delete";
+
+        permission java.lang.RuntimePermission "shutdownHooks";
+        permission java.lang.RuntimePermission "getClassLoader";
+        permission java.lang.RuntimePermission "setContextClassLoader";
+
+        permission java.lang.management.ManagementPermission "monitor";
+
+        permission java.util.logging.LoggingPermission "control";
+
+        permission java.util.PropertyPermission "java.util.logging.config.class", "read";
+        permission java.util.PropertyPermission "java.util.logging.config.file", "read";
+        permission java.util.PropertyPermission "org.apache.juli.AsyncMaxRecordCount", "read";
+        permission java.util.PropertyPermission "org.apache.juli.AsyncOverflowDropType", "read";
+        permission java.util.PropertyPermission "org.apache.juli.ClassLoaderLogManager.debug", "read";
+        permission java.util.PropertyPermission "catalina.base", "read";
+
+        // Note: To enable per context logging configuration, permit read access to
+        // the appropriate file. Be sure that the logging configuration is
+        // secure before enabling such access.
+        // E.g. for the examples web application (uncomment and unwrap
+        // the following to be on a single line):
+        // permission java.io.FilePermission "${catalina.base}${file.separator}
+        //  webapps${file.separator}examples${file.separator}WEB-INF
+        //  ${file.separator}classes${file.separator}logging.properties", "read";
+};
+
+// These permissions apply to the server startup code
+grant codeBase "file:${catalina.home}/bin/bootstrap.jar" {
+        permission java.security.AllPermission;
+};
+
+// These permissions apply to the servlet API classes
+// and those that are shared across all class loaders
+// located in the "lib" directory
+grant codeBase "file:${catalina.home}/lib/-" {
+        permission java.security.AllPermission;
+};
+
+
+// If using a per instance lib directory, i.e. ${catalina.base}/lib,
+// then the following permission will need to be uncommented
+// grant codeBase "file:${catalina.base}/lib/-" {
+//         permission java.security.AllPermission;
+// };
+
+
+// ========== WEB APPLICATION PERMISSIONS =====================================
+
+
+// These permissions are granted by default to all web applications
+// In addition, a web application will be given a read FilePermission
+// for all files and directories in its document root.
+grant {
+    // Required for JNDI lookup of named JDBC DataSource's and
+    // javamail named MimePart DataSource used to send mail
+    permission java.util.PropertyPermission "java.home", "read";
+    permission java.util.PropertyPermission "java.naming.*", "read";
+    permission java.util.PropertyPermission "javax.sql.*", "read";
+
+    // OS Specific properties to allow read access
+    permission java.util.PropertyPermission "os.name", "read";
+    permission java.util.PropertyPermission "os.version", "read";
+    permission java.util.PropertyPermission "os.arch", "read";
+    permission java.util.PropertyPermission "file.separator", "read";
+    permission java.util.PropertyPermission "path.separator", "read";
+    permission java.util.PropertyPermission "line.separator", "read";
+
+    // JVM properties to allow read access
+    permission java.util.PropertyPermission "java.version", "read";
+    permission java.util.PropertyPermission "java.vendor", "read";
+    permission java.util.PropertyPermission "java.vendor.url", "read";
+    permission java.util.PropertyPermission "java.class.version", "read";
+    permission java.util.PropertyPermission "java.specification.version", "read";
+    permission java.util.PropertyPermission "java.specification.vendor", "read";
+    permission java.util.PropertyPermission "java.specification.name", "read";
+
+    permission java.util.PropertyPermission "java.vm.specification.version", "read";
+    permission java.util.PropertyPermission "java.vm.specification.vendor", "read";
+    permission java.util.PropertyPermission "java.vm.specification.name", "read";
+    permission java.util.PropertyPermission "java.vm.version", "read";
+    permission java.util.PropertyPermission "java.vm.vendor", "read";
+    permission java.util.PropertyPermission "java.vm.name", "read";
+
+    // Required for OpenJMX
+    permission java.lang.RuntimePermission "getAttribute";
+
+    // Allow read of JAXP compliant XML parser debug
+    permission java.util.PropertyPermission "jaxp.debug", "read";
+
+    // All JSPs need to be able to read this package
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat";
+
+    // Precompiled JSPs need access to these packages.
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.el";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.jasper.runtime";
+    permission java.lang.RuntimePermission
+     "accessClassInPackage.org.apache.jasper.runtime.*";
+
+    // Applications using WebSocket need to be able to access these packages
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.tomcat.websocket.server";
+};
+
+
+// The Manager application needs access to the following packages to support the
+// session display functionality. It also requires the custom Tomcat
+// DeployXmlPermission to enable the use of META-INF/context.xml
+// These settings support the following configurations:
+// - default CATALINA_HOME == CATALINA_BASE
+// - CATALINA_HOME != CATALINA_BASE, per instance Manager in CATALINA_BASE
+// - CATALINA_HOME != CATALINA_BASE, shared Manager in CATALINA_HOME
+grant codeBase "file:${catalina.base}/webapps/manager/-" {
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
+    permission org.apache.catalina.security.DeployXmlPermission "manager";
+};
+grant codeBase "file:${catalina.home}/webapps/manager/-" {
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.ha.session";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.manager.util";
+    permission java.lang.RuntimePermission "accessClassInPackage.org.apache.catalina.util";
+    permission org.apache.catalina.security.DeployXmlPermission "manager";
+};
+
+// The Host Manager application needs the custom Tomcat DeployXmlPermission to
+// enable the use of META-INF/context.xml
+// These settings support the following configurations:
+// - default CATALINA_HOME == CATALINA_BASE
+// - CATALINA_HOME != CATALINA_BASE, per instance Host Manager in CATALINA_BASE
+// - CATALINA_HOME != CATALINA_BASE, shared Host Manager in CATALINA_HOME
+grant codeBase "file:${catalina.base}/webapps/host-manager/-" {
+    permission org.apache.catalina.security.DeployXmlPermission "host-manager";
+};
+grant codeBase "file:${catalina.home}/webapps/host-manager/-" {
+    permission org.apache.catalina.security.DeployXmlPermission "host-manager";
+};
+
+
+// You can assign additional permissions to particular web applications by
+// adding additional "grant" entries here, based on the code base for that
+// application, /WEB-INF/classes/, or /WEB-INF/lib/ jar files.
+//
+// Different permissions can be granted to JSP pages, classes loaded from
+// the /WEB-INF/classes/ directory, all jar files in the /WEB-INF/lib/
+// directory, or even to individual jar files in the /WEB-INF/lib/ directory.
+//
+// For instance, assume that the standard "examples" application
+// included a JDBC driver that needed to establish a network connection to the
+// corresponding database and used the scrape taglib to get the weather from
+// the NOAA web server.  You might create a "grant" entries like this:
+//
+// The permissions granted to the context root directory apply to JSP pages.
+// grant codeBase "file:${catalina.base}/webapps/examples/-" {
+//      permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
+//      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
+// };
+//
+// The permissions granted to the context WEB-INF/classes directory
+// grant codeBase "file:${catalina.base}/webapps/examples/WEB-INF/classes/-" {
+// };
+//
+// The permission granted to your JDBC driver
+// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/driver.jar!/-" {
+//      permission java.net.SocketPermission "dbhost.mycompany.com:5432", "connect";
+// };
+// The permission granted to the scrape taglib
+// grant codeBase "jar:file:${catalina.base}/webapps/examples/WEB-INF/lib/scrape.jar!/-" {
+//      permission java.net.SocketPermission "*.noaa.gov:80", "connect";
+// };
+
+// To grant permissions for web applications using packed WAR files, use the
+// Tomcat specific WAR url scheme.
+//
+// The permissions granted to the entire web application
+// grant codeBase "war:file:${catalina.base}/webapps/examples.war*/-" {
+// };
+//
+// The permissions granted to a specific JAR
+// grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {
+// };
+
+  Starting Tomcat With A SecurityManager
+
+  Once you have configured the catalina.policy file for use
+  with a SecurityManager, Tomcat can be started with a SecurityManager in
+  place by using the "-security" option:
+$CATALINA_HOME/bin/catalina.sh start -security    (Unix)
+%CATALINA_HOME%\bin\catalina start -security      (Windows)
+
+  Permissions for packed WAR files

+
+    When using packed WAR files, it is necessary to use Tomcat's custom war
+    URL protocol to assign permissions to web application code.
+
+    To assign permissions to the entire web application the entry in the
+    policy file would look like this:
+
+// Example policy file entry
+grant codeBase "war:file:${catalina.base}/webapps/examples.war*/-" {
+    ...
+};
+
+
+    To assign permissions to a single JAR within the web application the
+    entry in the policy file would look like this:
+
+// Example policy file entry
+grant codeBase "war:file:${catalina.base}/webapps/examples.war*/WEB-INF/lib/foo.jar" {
+    ...
+};
+
+
+  
+
+
Configuring Package Protection in Tomcat

+  Starting with Tomcat 5, it is now possible to configure which Tomcat
+  internal package are protected against package definition and access. See
+  
+    http://www.oracle.com/technetwork/java/seccodeguide-139067.html
+    for more information.
+
+
+  WARNING: Be aware that removing the default package protection
+  could possibly open a security hole
+
+  The Default Properties File
+
+  The default $CATALINA_BASE/conf/catalina.properties file
+  looks like this:
+#
+# List of comma-separated packages that start with or equal this string
+# will cause a security exception to be thrown when
+# passed to checkPackageAccess unless the
+# corresponding RuntimePermission ("accessClassInPackage."+package) has
+# been granted.
+package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.tomcat.,
+org.apache.jasper.
+#
+# List of comma-separated packages that start with or equal this string
+# will cause a security exception to be thrown when
+# passed to checkPackageDefinition unless the
+# corresponding RuntimePermission ("defineClassInPackage."+package) has
+# been granted.
+#
+# by default, no packages are restricted for definition, and none of
+# the class loaders supplied with the JDK call checkPackageDefinition.
+#
+package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,
+org.apache.tomcat.,org.apache.jasper.
+  Once you have configured the catalina.properties file for use
+  with a SecurityManager, remember to re-start Tomcat.
+
Troubleshooting

+
+  If your web application attempts to execute an operation that is
+  prohibited by lack of a required Permission, it will throw an
+  AccessControLException or a SecurityException
+  when the SecurityManager detects the violation.  Debugging the permission
+  that is missing can be challenging, and one option is to turn on debug
+  output of all security decisions that are made during execution.  This
+  is done by setting a system property before starting Tomcat.  The easiest
+  way to do this is via the CATALINA_OPTS environment variable.
+  Execute this command:
+export CATALINA_OPTS=-Djava.security.debug=all    (Unix)
+set CATALINA_OPTS=-Djava.security.debug=all       (Windows)
+
+  before starting Tomcat.
+
+  WARNING - This will generate many megabytes
+  of output!  However, it can help you track down problems by searching
+  for the word "FAILED" and determining which permission was being checked
+  for.  See the Java security documentation for more options that you can
+  specify here as well.
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/servletapi/index.html b/apache-tomcat-9.0.109/webapps/docs/servletapi/index.html
new file mode 100644
index 0000000..4a8608d
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/servletapi/index.html
@@ -0,0 +1,34 @@
+
+
+
+    
+    
+    API docs
+
+
+
+
+The Servlet Javadoc is not installed by default. Download and install
+the "fulldocs" package to get it.
+
+You can also access the javadoc online in the Tomcat
+
+documentation bundle.
+
+
+
diff --git a/apache-tomcat-9.0.109/webapps/docs/setup.html b/apache-tomcat-9.0.109/webapps/docs/setup.html
new file mode 100644
index 0000000..d194269
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/setup.html
@@ -0,0 +1,170 @@
+
+Apache Tomcat 9 (9.0.109) - Tomcat Setup
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Tomcat Setup
Table of Contents

+Introduction
Windows
Unix daemon
+
Introduction

+    
+      There are several ways to set up Tomcat for running on different
+      platforms. The main documentation for this is a file called
+      RUNNING.txt. We encourage you to refer to that
+      file if the information below does not answer some of your questions.
+    
+  
Windows

+
+    
+      Installing Tomcat on Windows can be done easily using the Windows
+      installer. Its interface and functionality is similar to other wizard
+      based installers, with only a few items of interest.
+    
+
+
+      
+        Installation as a service: Tomcat will be
+            installed as a Windows service no matter what setting is selected.
+            Using the checkbox on the component page sets the service as "auto"
+            startup, so that Tomcat is automatically started when Windows
+            starts. For optimal security, the service should be run as a
+            separate user, with reduced permissions (see the Windows Services
+            administration tool and its documentation).
+        Java location: The installer will provide a default
+            JRE to use to run the service. The installer uses the registry to
+            determine the base path of a Java 8 or later JRE,
+            including the JRE installed as part of the full JDK. When running on
+            a 64-bit operating system, the installer will first look for a
+            64-bit JRE and only look for a 32-bit JRE if a 64-bit JRE is not
+            found. If a JRE cannot be found when running on a 64-bit operating
+            system, the installer will look for a 64-bit JDK. Finally, if a JRE
+            or JDK has not been found, the installer will try to use the
+            JAVA_HOME environment variable. It is not mandatory to
+            use the default JRE detected by the installer. Any installed Java
+            8 or later JRE (32-bit or 64-bit) may be
+            used.
+        Tray icon: When Tomcat is run as a service, there
+            will not be any tray icon present when Tomcat is running. Note that
+            when choosing to run Tomcat at the end of installation, the tray
+            icon will be used even if Tomcat was installed as a service.
+        Defaults: The defaults used by the installer may be
+            overridden by use of the /C=<config file> command
+            line argument. The configuration file uses the format
+            name=value with each pair on a separate line. The names
+            of the available configuration options are:
+            
+            JavaHome
+            TomcatPortShutdown
+            TomcatPortHttp
+            TomcatMenuEntriesEnable
+            TomcatShortcutAllUsers
+            TomcatServiceDefaultName
+            TomcatServiceName
+            TomcatServiceFileName
+            TomcatServiceManagerFileName
+            TomcatAdminEnable
+            TomcatAdminUsername
+            TomcatAdminPassword
+            TomcatAdminRoles
+            
+            By using /C=... along with /S and
+            /D= it is possible to perform fully configured
+            unattended installs of Apache Tomcat.
+        
+        Refer to the
+            Windows Service How-To
+            for information on how to manage Tomcat as a Windows service.
+            
+      
+
+
+    The installer will create shortcuts allowing starting and configuring
+       Tomcat. It is important to note that the Tomcat administration web
+       application can only be used when Tomcat is running.
+
+  
Unix daemon

+
+    Tomcat can be run as a daemon using the jsvc tool from the
+       commons-daemon project. Source tarballs for jsvc are included with the
+       Tomcat binaries, and need to be compiled. Building jsvc requires
+       a C ANSI compiler (such as GCC), GNU Autoconf, and a JDK.
+
+    Before running the script, the JAVA_HOME environment
+       variable should be set to the base path of the JDK. Alternately, when
+       calling the ./configure script, the path of the JDK may
+       be specified using the --with-java parameter, such as
+       ./configure --with-java=/usr/java.
+
+    Using the following commands should result in a compiled jsvc binary,
+       located in the $CATALINA_HOME/bin folder. This assumes
+       that GNU TAR is used, and that CATALINA_HOME is an
+       environment variable pointing to the base path of the Tomcat
+       installation.
+
+    Please note that you should use the GNU make (gmake) instead of
+       the native BSD make on FreeBSD systems.
+
+cd $CATALINA_HOME/bin
+tar xvfz commons-daemon-native.tar.gz
+cd commons-daemon-1.1.x-native-src/unix
+./configure
+make
+cp jsvc ../..
+cd ../..
+
+    Tomcat can then be run as a daemon using the following commands.
+
+CATALINA_BASE=$CATALINA_HOME
+cd $CATALINA_HOME
+./bin/jsvc \
+    -classpath $CATALINA_HOME/bin/bootstrap.jar:$CATALINA_HOME/bin/tomcat-juli.jar \
+    -outfile $CATALINA_BASE/logs/catalina.out \
+    -errfile $CATALINA_BASE/logs/catalina.err \
+    -Dcatalina.home=$CATALINA_HOME \
+    -Dcatalina.base=$CATALINA_BASE \
+    -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager \
+    -Djava.util.logging.config.file=$CATALINA_BASE/conf/logging.properties \
+    org.apache.catalina.startup.Bootstrap
+
+    When running on Java 9 you will need to additionally specify the
+    following when starting jsvc.
+...
+--add-opens=java.base/java.lang=ALL-UNNAMED \
+--add-opens=java.base/java.io=ALL-UNNAMED \
+--add-opens=java.base/java.util=ALL-UNNAMED \
+--add-opens=java.base/java.util.concurrent=ALL-UNNAMED \
+--add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED \
+...
+
+
+    You may also need to specify -jvm server if the JVM defaults
+       to using a server VM rather than a client VM. This has been observed on
+       OSX.
+
+    jsvc has other useful parameters, such as -user which
+       causes it to switch to another user after the daemon initialization is
+       complete. This allows, for example, running Tomcat as a non privileged
+       user while still being able to use privileged ports. Note that if you
+       use this option and start Tomcat as root, you'll need to disable the
+       org.apache.catalina.security.SecurityListener check that
+       prevents Tomcat starting when running as root.
+
+    jsvc --help will return the full jsvc usage
+       information. In particular, the -debug option is useful
+       to debug issues running jsvc.
+
+    The file $CATALINA_HOME/bin/daemon.sh can be used as a
+       template for starting Tomcat automatically at boot time from
+       /etc/init.d with jsvc.
+
+    Note that the Commons-Daemon JAR file must be on your runtime classpath
+       to run Tomcat in this manner.  The Commons-Daemon JAR file is in the
+       Class-Path entry of the bootstrap.jar manifest, but if you get a
+       ClassNotFoundException or a NoClassDefFoundError for a Commons-Daemon
+       class, add the Commons-Daemon JAR to the -cp argument when launching
+       jsvc.
+
+  

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/ssi-howto.html b/apache-tomcat-9.0.109/webapps/docs/ssi-howto.html
new file mode 100644
index 0000000..bffaa19
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/ssi-howto.html
@@ -0,0 +1,402 @@
+
+Apache Tomcat 9 (9.0.109) - SSI How To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
SSI How To
Table of Contents

+Introduction
Installation
Servlet Configuration
Filter Configuration
Directives
Variables
+
Introduction

+
+SSI (Server Side Includes) are directives that are placed in HTML pages,
+and evaluated on the server while the pages are being served. They let you
+add dynamically generated content to an existing HTML page, without having
+to serve the entire page via a CGI program, or other dynamic technology.
+
+
+Within Tomcat SSI support can be added when using Tomcat as your
+HTTP server and you require SSI support.  Typically this is done
+during development when you don't want to run a web server like Apache.
+
+Tomcat SSI support implements the same SSI directives as Apache.  See the
+
+Apache Introduction to SSI for information on using SSI directives.
+
+SSI support is available as a servlet and as a filter. You should use one
+or the other to provide SSI support but not both.
+
+Servlet based SSI support is implemented using the class
+org.apache.catalina.ssi.SSIServlet.  Traditionally, this servlet
+is mapped to the URL pattern "*.shtml".
+
+Filter based SSI support is implemented using the class
+org.apache.catalina.ssi.SSIFilter.  Traditionally, this filter
+is mapped to the URL pattern "*.shtml", though it can be mapped to "*" as
+it will selectively enable/disable SSI processing based on mime types.  The
+contentType init param allows you to apply SSI processing to JSP pages,
+JavaScript, or any other content you wish.
+By default SSI support is disabled in Tomcat.
+
Installation

+
+CAUTION - SSI directives can be used to execute programs
+external to the Tomcat JVM. If you are using the Java SecurityManager this
+will bypass your security policy configuration in catalina.policy.
+
+
+To use the SSI servlet, remove the XML comments from around the SSI servlet
+and servlet-mapping configuration in
+$CATALINA_BASE/conf/web.xml.
+
+To use the SSI filter, remove the XML comments from around the SSI filter
+and filter-mapping configuration in
+$CATALINA_BASE/conf/web.xml.
+
+Only Contexts which are marked as privileged may use SSI features (see the
+privileged property of the Context element).
+
+
Servlet Configuration

+
+There are several servlet init parameters which can be used to
+configure the behaviour of the SSI servlet.
+
+buffered - Should output from this servlet be buffered?
+(0=false, 1=true) Default 0 (false).
+debug - Debugging detail level for messages logged
+by this servlet. Default 0.
+expires - The number of seconds before a page with SSI
+directives will expire. Default behaviour is for all SSI directives to be
+evaluated for every request.
+isVirtualWebappRelative - Should "virtual" SSI directive
+paths be interpreted as relative to the context root, instead of the server
+root? Default false.
+inputEncoding - The encoding to be assumed for SSI
+resources if one cannot be determined from the resource itself. Default is
+the default platform encoding.
+outputEncoding - The encoding to be used for the result
+of the SSI processing. Default is UTF-8.
+allowExec - Is the exec command enabled? Default is
+false.
+
+
+
+
Filter Configuration

+
+There are several filter init parameters which can be used to
+configure the behaviour of the SSI filter.
+
+contentType - A regex pattern that must be matched before
+SSI processing is applied. When crafting your own pattern, don't forget that a
+mime content type may be followed by an optional character set in the form
+"mime/type; charset=set" that you must take into account.  Default is
+"text/x-server-parsed-html(;.*)?".
+debug - Debugging detail level for messages logged
+by this servlet. Default 0.
+expires - The number of seconds before a page with SSI
+directives will expire. Default behaviour is for all SSI directives to be
+evaluated for every request.
+isVirtualWebappRelative - Should "virtual" SSI directive
+paths be interpreted as relative to the context root, instead of the server
+root? Default false.
+allowExec - Is the exec command enabled? Default is
+false.
+
+
+
+
Directives

+Server Side Includes are invoked by embedding SSI directives in an HTML document
+ whose type will be processed by the SSI servlet. The directives take the form of an HTML
+ comment. The directive is replaced by the results of interpreting it before sending the
+ page to the client. The general form of a directive is: 
+ <!--#directive [param=value] -->
+The directives are:
+
+
+config - <!--#config errmsg="Error occurred" sizefmt="abbrev"
+timefmt="%B %Y" -->
+Used to set SSI error message, the format of dates and file sizes processed by SSI.

+All are optional but at least one must be used. The available options are as follows:
+

+errmsg - error message used for SSI errors

+sizefmt - format used for sizes in the fsize directive

+timefmt - format used for timestamps in the flastmod directive

+
+
+echo -   <!--#echo var="VARIABLE_NAME" encoding="entity" -->
+will be replaced by the value of the variable.
+

+The optional encoding parameter specifies the type of encoding to use.
+Valid values are entity (default), url or none.
+NOTE: Using an encoding other than entity can lead to security issues.
+
+
+exec - <!--#exec cmd="file-name" -->
+Used to run commands on the host system.
+
+
+exec - <!--#exec cgi="file-name" -->
+This acts the same as the include virtual directive, and doesn't actually execute any commands.
+
+
+include -  <!--#include file="file-name" -->
+inserts the contents. The path is interpreted relative to the document where this directive
+is being used, and IS NOT a "virtual" path relative to either the context root or the server root.
+
+
+include -  <!--#include virtual="file-name" -->
+inserts the contents. The path is interpreted as a "virtual" path which is
+relative to either the context root or the server root (depending on the isVirtualWebappRelative
+parameter).
+
+
+flastmod - <!--#flastmod file="filename.shtml" -->
+Returns the time that a file was last modified. The path is interpreted relative to the document where this directive
+is being used, and IS NOT a "virtual" path relative to either the context root or the server root.
+
+
+flastmod - <!--#flastmod virtual="filename.shtml" -->
+Returns the time that a file was last modified. The path is interpreted as a "virtual" path which is
+relative to either the context root or the server root (depending on the isVirtualWebappRelative
+parameter).
+
+
+fsize - <!--#fsize file="filename.shtml" -->
+Returns the size of a file. The path is interpreted relative to the document where this directive
+is being used, and IS NOT a "virtual" path relative to either the context root or the server root.
+
+
+fsize - <!--#fsize virtual="filename.shtml" -->
+Returns the size of a file. The path is interpreted as a "virtual" path which is
+relative to either the context root or the server root (depending on the isVirtualWebappRelative
+parameter).
+
+
+printenv - <!--#printenv -->
+Returns the list of all the defined variables.
+
+
+set - <!--#set var="foo" value="Bar" -->
+is used to assign a value to a user-defined variable.
+
+
+if elif endif else - Used to create conditional sections. For example:
+<!--#config timefmt="%A" -->
+<!--#if expr="$DATE_LOCAL = /Monday/" -->
+<p>Meeting at 10:00 on Mondays</p>
+<!--#elif expr="$DATE_LOCAL = /Friday/" -->
+<p>Turn in your time card</p>
+<!--#else -->
+<p>Yoga class at noon.</p>
+<!--#endif -->
+
+
+
+See the
+
+Apache Introduction to SSI for more information on using SSI directives.
+
Variables

+
+SSI variables are implemented via request attributes on the javax.servlet.ServletRequest object
+and are not limited to the SSI servlet. Variables starting with the names
+"java.", "javax.", "sun" or "org.apache.catalina.ssi.SSIMediator." are reserved
+and cannot be used.
+
+The SSI servlet currently implements the following variables:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+Variable Name Description
AUTH_TYPE 
+  The type of authentication used for this user: BASIC, FORM, etc.
CONTENT_LENGTH 
+  The length of the data (in bytes or the number of
+  characters) passed from a form.
CONTENT_TYPE 
+  The MIME type of the query data, such as "text/html".
DATE_GMT 
+Current date and time in GMT
DATE_LOCAL 
+Current date and time in the local time zone
DOCUMENT_NAME 
+The current file
DOCUMENT_URI 
+Virtual path to the file
GATEWAY_INTERFACE 
+  The revision of the Common Gateway Interface that the
+  server uses if enabled: "CGI/1.1".
HTTP_ACCEPT 
+  A list of the MIME types that the client can accept.
HTTP_ACCEPT_ENCODING 
+  A list of the compression types that the client can accept.
HTTP_ACCEPT_LANGUAGE 
+  A list of the languages that the client can accept.
HTTP_CONNECTION 
+  The way that the connection from the client is being managed:
+  "Close" or "Keep-Alive".
HTTP_HOST 
+  The web site that the client requested.
HTTP_REFERER 
+  The URL of the document that the client linked from.
HTTP_USER_AGENT 
+  The browser the client is using to issue the request.
LAST_MODIFIED 
+Last modification date and time for current file
PATH_INFO 
+  Extra path information passed to a servlet.
PATH_TRANSLATED 
+  The translated version of the path given by the
+  variable PATH_INFO.
QUERY_STRING 
+The query string that follows the "?" in the URL.
+
QUERY_STRING_UNESCAPED 
+Undecoded query string with all shell metacharacters escaped
+with "\"
REMOTE_ADDR 
+  The remote IP address of the user making the request.
REMOTE_HOST 
+  The remote hostname of the user making the request.
REMOTE_PORT 
+  The port number at remote IP address of the user making the request.
REMOTE_USER 
+  The authenticated name of the user.
REQUEST_METHOD 
+  The method with which the information request was
+  issued: "GET", "POST" etc.
REQUEST_URI 
+  The web page originally requested by the client.
SCRIPT_FILENAME 
+  The location of the current web page on the server.
SCRIPT_NAME 
+  The name of the web page.
SERVER_ADDR 
+  The server's IP address.
SERVER_NAME 
+  The server's hostname or IP address.
SERVER_PORT 
+  The port on which the server received the request.
SERVER_PROTOCOL 
+  The protocol used by the server. E.g. "HTTP/1.1".
SERVER_SOFTWARE 
+  The name and version of the server software that is
+  answering the client request.
UNIQUE_ID 
+  A token used to identify the current session if one
+  has been established.
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/ssl-howto.html b/apache-tomcat-9.0.109/webapps/docs/ssl-howto.html
new file mode 100644
index 0000000..7beea32
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/ssl-howto.html
@@ -0,0 +1,689 @@
+
+Apache Tomcat 9 (9.0.109) - SSL/TLS Configuration How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
SSL/TLS Configuration How-To
Table of Contents

+Quick Start
Introduction to SSL/TLS
SSL/TLS and Tomcat
Certificates
General Tips on Running SSL
ConfigurationPrepare the Certificate Keystore
Edit the Tomcat Configuration File
Installing a Certificate from a Certificate AuthorityCreate a local Certificate Signing Request (CSR)
Importing the Certificate
Using OCSP CertificatesGenerating OCSP-Enabled Certificates
Configuring OCSP Connector
Starting OCSP Responder
Troubleshooting
Using the SSL for session tracking in your application
Miscellaneous Tips and Bits
+
Quick Start

+
+    The description below uses the variable name $CATALINA_BASE to refer the
+    base directory against which most relative paths are resolved. If you have
+    not configured Tomcat for multiple instances by setting a CATALINA_BASE
+    directory, then $CATALINA_BASE will be set to the value of $CATALINA_HOME,
+    the directory into which you have installed Tomcat.
+
+To install and configure SSL/TLS support on Tomcat, you need to follow
+these simple steps.  For more information, read the rest of this How-To.
+
+Create a keystore file to store the server's private key and
+self-signed certificate by executing the following command:
+Windows:
+"%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA
+Unix:
+$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA
+
+and specify a password value of "changeit".
+Uncomment the "SSL HTTP/1.1 Connector" entry in
+    $CATALINA_BASE/conf/server.xml and modify as described in
+    the Configuration section below.
+
+
+
+
+
Introduction to SSL/TLS

+
+Transport Layer Security (TLS) and its predecessor, Secure Sockets Layer
+(SSL), are technologies which allow web browsers and web servers to communicate
+over a secured connection.  This means that the data being sent is encrypted by
+one side, transmitted, then decrypted by the other side before processing.
+This is a two-way process, meaning that both the server AND the browser encrypt
+all traffic before sending out data.
+
+Another important aspect of the SSL/TLS protocol is Authentication.  This means
+that during your initial attempt to communicate with a web server over a secure
+connection, that server will present your web browser with a set of
+credentials, in the form of a "Certificate", as proof the site is who and what
+it claims to be.  In certain cases, the server may also request a Certificate
+from your web browser, asking for proof that you are who you claim
+to be.  This is known as "Client Authentication," although in practice this is
+used more for business-to-business (B2B) transactions than with individual
+users.  Most SSL-enabled web servers do not request Client Authentication.
+
+
SSL/TLS and Tomcat

+
+It is important to note that configuring Tomcat to take advantage of
+secure sockets is usually only necessary when running it as a stand-alone
+web server.  Details can be found in the
+Security Considerations Document.
+When running Tomcat primarily as a Servlet/JSP container behind
+another web server, such as Apache or Microsoft IIS, it is usually necessary
+to configure the primary web server to handle the SSL connections from users.
+Typically, this server will negotiate all SSL-related functionality, then
+pass on any requests destined for the Tomcat container only after decrypting
+those requests.  Likewise, Tomcat will return cleartext responses, that will
+be encrypted before being returned to the user's browser.  In this environment,
+Tomcat knows that communications between the primary web server and the
+client are taking place over a secure connection (because your application
+needs to be able to ask about this), but it does not participate in the
+encryption or decryption itself.
+
+Tomcat is able to use any of the cryptographic protocols that are
+provided by the underlying environment. Java itself provides cryptographic
+capabilities through JCE/JCA
+and encrypted communications capabilities through JSSE.
+Any compliant cryptographic "provider" can provide cryptographic algorithms
+to Tomcat. The built-in provider (SunJCE) includes support for various
+SSL/TLS versions like SSLv3, TLSv1, TLSv1.1, and so on. Check the documentation
+for your version of Java for details on protocol and algorithm support.
+
+If you use the optional tcnative library, you can use
+the OpenSSL cryptographic provider
+through JCA/JCE/JSSE which may provide a different selection of cryptographic
+algorithms and/or performance benefits relative to the SunJCE provider.
+You can also use tcnative to enable the APR
+connector which uses OpenSSL for its cryptographic operations. Check the
+documentation for your version of OpenSSL for details on protocol and
+algorithm support.
+
+
Certificates

+
+In order to implement SSL, a web server must have an associated Certificate
+for each external interface (IP address) that accepts secure connections.
+The theory behind this design is that a server should provide some kind of
+reasonable assurance that its owner is who you think it is, particularly
+before receiving any sensitive information.  While a broader explanation of
+Certificates is beyond the scope of this document, think of a Certificate as a
+"digital passport" for an Internet address. It states which organisation the
+site is associated with, along with some basic contact information about the
+site owner or administrator.
+
+This certificate is cryptographically signed by its owner, and is
+therefore extremely difficult for anyone else to forge. For the certificate to
+work in the visitors browsers without warnings, it needs to be signed by a
+trusted third party. These are called Certificate Authorities (CAs). To
+obtain a signed certificate, you need to choose a CA and follow the instructions
+your chosen CA provides to obtain your certificate. A range of CAs is available
+including some that offer certificates at no cost.
+
+Java provides a relatively simple command-line tool, called
+keytool, which can easily create a "self-signed" Certificate.
+Self-signed Certificates are simply user generated Certificates which have not
+been signed by a well-known CA and are, therefore, not really guaranteed to be
+authentic at all. While self-signed certificates can be useful for some testing
+scenarios, they are not suitable for any form of production use.
+
+
General Tips on Running SSL

+
+When securing a website with SSL it's important to make sure that all assets
+that the site uses are served over SSL, so that an attacker can't bypass
+the security by injecting malicious content in a JavaScript file or similar. To
+further enhance the security of your website, you should evaluate to use the
+HSTS header. It allows you to communicate to the browser that your site should
+always be accessed over https.
+
+Using name-based virtual hosts on a secured connection requires careful
+configuration of the names specified in a single certificate or Tomcat 8.5
+onwards where Server Name Indication (SNI) support is available. SNI allows
+multiple certificates with different names to be associated with a single TLS
+connector.
+
+
Configuration

+
+Prepare the Certificate Keystore

+
+Tomcat currently operates only on JKS, PKCS11 or
+PKCS12 format keystores.  The JKS format
+is Java's standard "Java KeyStore" format, and is the format created by the
+keytool command-line utility.  This tool is included in the JDK.
+The PKCS12 format is an internet standard, and can be manipulated
+via (among other things) OpenSSL and Microsoft's Key-Manager.
+
+
+Each entry in a keystore is identified by an alias string. Whilst many
+keystore implementations treat aliases in a case insensitive manner, case
+sensitive implementations are available. The PKCS11 specification,
+for example, requires that aliases are case sensitive. To avoid issues related
+to the case sensitivity of aliases, it is not recommended to use aliases that
+differ only in case.
+
+
+To import an existing certificate into a JKS keystore, please read the
+documentation (in your JDK documentation package) about keytool.
+Note that OpenSSL often adds readable comments before the key, but
+keytool does not support that. So if your certificate has
+comments before the key data, remove them before importing the certificate with
+keytool.
+
+To import an existing certificate signed by your own CA into a PKCS12
+keystore using OpenSSL you would execute a command like:
+openssl pkcs12 -export -in mycert.crt -inkey mykey.key
+                       -out mycert.p12 -name tomcat -CAfile myCA.crt
+                       -caname root -chain
+For more advanced cases, consult the
+OpenSSL documentation.
+
+To create a new JKS keystore from scratch, containing a single
+self-signed Certificate, execute the following from a terminal command line:
+Windows:
+"%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA
+Unix:
+$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA
+
+(The RSA algorithm should be preferred as a secure algorithm, and this
+also ensures general compatibility with other servers and components.)
+
+This command will create a new file, in the home directory of the user
+under which you run it, named ".keystore".  To specify a
+different location or filename, add the -keystore parameter,
+followed by the complete pathname to your keystore file,
+to the keytool command shown above.  You will also need to
+reflect this new location in the server.xml configuration file,
+as described later.  For example:
+Windows:
+"%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA
+  -keystore \path\to\my\keystore
+Unix:
+$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA
+  -keystore /path/to/my/keystore
+
+After executing this command, you will first be prompted for the keystore
+password.  The default password used by Tomcat is "changeit"
+(all lower case), although you can specify a custom password if you like.
+You will also need to specify the custom password in the
+server.xml configuration file, as described later.
+
+Next, you will be prompted for general information about this Certificate,
+such as company, contact name, and so on.  This information will be displayed
+to users who attempt to access a secure page in your application, so make
+sure that the information provided here matches what they will expect.
+
+Finally, you will be prompted for the key password, which is the
+password specifically for this Certificate (as opposed to any other
+Certificates stored in the same keystore file). The keytool prompt
+will tell you that pressing the ENTER key automatically uses the same password
+for the key as the keystore. You are free to use the same password or to select
+a custom one. If you select a different password to the keystore password, you
+will also need to specify the custom password in the server.xml
+configuration file.
+
+If everything was successful, you now have a keystore file with a
+Certificate that can be used by your server.
+
+
+
+Edit the Tomcat Configuration File

+
+Tomcat can use three different implementations of SSL:
+
+
+JSSE implementation provided as part of the Java runtime
+JSSE implementation that uses OpenSSL
+APR implementation, which uses the OpenSSL engine by default
+
+
+The exact configuration details depend on which implementation is being used.
+If you configured Connector by specifying generic
+protocol="HTTP/1.1" then the implementation used by Tomcat is
+chosen automatically. If the installation uses APR
+- i.e. you have installed the Tomcat native library -
+then it will use the JSSE OpenSSL implementation, otherwise it will use the Java
+JSSE implementation.
+
+
+
+Auto-selection of implementation can be avoided if needed. It is done by specifying a classname
+in the protocol attribute of the Connector.
+
+To define a Java (JSSE) connector, regardless of whether the APR library is
+loaded or not, use one of the following:
+<!-- Define an HTTP/1.1 Connector on port 8443, JSSE NIO implementation -->
+<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
+           sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
+           port="8443" .../>
+
+<!-- Define an HTTP/1.1 Connector on port 8443, JSSE NIO2 implementation -->
+<Connector protocol="org.apache.coyote.http11.Http11Nio2Protocol"
+           sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
+           port="8443" .../>
+
+The OpenSSL JSSE implementation can also be configured explicitly if needed. If the APR library
+is installed (as for using the APR connector), using the sslImplementationName attribute
+allows enabling it. When using the OpenSSL JSSE implementation, the configuration can use
+either the JSSE attributes or
+the OpenSSL attributes (as used for the APR connector), but must not mix attributes from
+both types in the same SSLHostConfig or Connector element.
+<!-- Define an HTTP/1.1 Connector on port 8443, JSSE NIO implementation and OpenSSL -->
+<Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="8443"
+           sslImplementationName="org.apache.tomcat.util.net.openssl.OpenSSLImplementation"
+           .../>
+
+Alternatively, to specify an APR connector (the APR library must be available) use:
+<!-- Define an HTTP/1.1 Connector on port 8443, APR implementation -->
+<Connector protocol="org.apache.coyote.http11.Http11AprProtocol"
+           port="8443" .../>
+
+If you are using APR or JSSE OpenSSL, you have the option of configuring an alternative engine to OpenSSL.
+<Listener className="org.apache.catalina.core.AprLifecycleListener"
+          SSLEngine="someengine" SSLRandomSeed="somedevice" />
+The default value is
+<Listener className="org.apache.catalina.core.AprLifecycleListener"
+          SSLEngine="on" SSLRandomSeed="builtin" />
+Also the useAprConnector attribute may be used to have Tomcat default to
+using the APR connector rather than the NIO connector:
+<Listener className="org.apache.catalina.core.AprLifecycleListener"
+          useAprConnector="true" SSLEngine="on" SSLRandomSeed="builtin" />
+
+So to enable OpenSSL, make sure the SSLEngine attribute is set to something other than off.
+The default value is on and if you specify another value,
+it has to be a valid OpenSSL engine name.
+
+
+
+SSLRandomSeed allows to specify a source of entropy. Productive system needs a reliable source of entropy
+but entropy may need a lot of time to be collected therefore test systems could use no blocking entropy
+sources like "/dev/urandom" that will allow quicker starts of Tomcat.
+
+
+The final step is to configure the Connector in the
+$CATALINA_BASE/conf/server.xml file, where
+$CATALINA_BASE represents the base directory for the
+Tomcat instance.  An example <Connector> element
+for an SSL connector is included in the default server.xml
+file installed with Tomcat. To configure an SSL connector that uses JSSE, you
+will need to remove the comments and edit it so it looks something like
+this:
+<!-- Define an SSL Coyote HTTP/1.1 Connector on port 8443 -->
+<Connector
+           protocol="org.apache.coyote.http11.Http11NioProtocol"
+           port="8443" maxThreads="200"
+           maxParameterCount="1000"
+           scheme="https" secure="true" SSLEnabled="true"
+           keystoreFile="${user.home}/.keystore" keystorePass="changeit"
+           clientAuth="false" sslProtocol="TLS"/>
+
+  Note: If tomcat-native is installed, the configuration will use JSSE with
+  an OpenSSL implementation, which supports either this configuration or the APR
+  configuration example given below.
+
+  The APR connector uses different attributes for many SSL settings,
+  particularly keys and certificates. An example of an APR configuration is:
+<!-- Define an SSL Coyote HTTP/1.1 Connector on port 8443 -->
+<Connector
+           protocol="org.apache.coyote.http11.Http11AprProtocol"
+           port="8443" maxThreads="200"
+           maxParameterCount="1000"
+           scheme="https" secure="true" SSLEnabled="true"
+           SSLCertificateFile="/usr/local/ssl/server.crt"
+           SSLCertificateKeyFile="/usr/local/ssl/server.pem"
+           SSLVerifyClient="optional" SSLProtocol="TLSv1+TLSv1.1+TLSv1.2"/>
+
+
+The configuration options and information on which attributes
+are mandatory, are documented in the SSL Support section of the
+HTTP connector configuration
+reference. Make sure that you use the correct attributes for the connector you
+are using. The NIO and NIO2 connectors use JSSE unless the JSSE OpenSSL implementation is
+installed (in which case it supports either the JSSE or OpenSSL configuration styles),
+whereas the APR/native connector uses APR.
+
+The port attribute is the TCP/IP
+port number on which Tomcat will listen for secure connections.  You can
+change this to any port number you wish (such as to the default port for
+https communications, which is 443).  However, special setup
+(outside the scope of this document) is necessary to run Tomcat on port
+numbers lower than 1024 on many operating systems.
+
+  If you change the port number here, you should also change the
+  value specified for the redirectPort attribute on the
+  non-SSL connector.  This allows Tomcat to automatically redirect
+  users who attempt to access a page with a security constraint specifying
+  that SSL is required, as required by the Servlet Specification.
+
+After completing these configuration changes, you must restart Tomcat as
+you normally do, and you should be in business.  You should be able to access
+any web application supported by Tomcat via SSL.  For example, try:
+https://localhost:8443/
+and you should see the usual Tomcat splash page (unless you have modified
+the ROOT web application).  If this does not work, the following section
+contains some troubleshooting tips.
+
+
+
+
Installing a Certificate from a Certificate Authority

+To obtain and install a Certificate from a Certificate Authority (like verisign.com, thawte.com
+or trustcenter.de), read the previous section and then follow these instructions:
+
+Create a local Certificate Signing Request (CSR)

+In order to obtain a Certificate from the Certificate Authority of your choice
+you have to create a so called Certificate Signing Request (CSR). That CSR will be used
+by the Certificate Authority to create a Certificate that will identify your website
+as "secure". To create a CSR follow these steps:
+
+Create a local self-signed Certificate (as described in the previous section):
+    keytool -genkey -alias tomcat -keyalg RSA
+    -keystore <your_keystore_filename>
+    Note: In some cases you will have to enter the domain of your website (i.e. www.myside.org)
+    in the field "first- and lastname" in order to create a working Certificate.
+
+The CSR is then created with:
+    keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr
+    -keystore <your_keystore_filename>
+
+
+Now you have a file called certreq.csr that you can submit to the Certificate Authority (look at the
+documentation of the Certificate Authority website on how to do this). In return you get a Certificate.
+
+
+Importing the Certificate

+Now that you have your Certificate you can import it into you local keystore.
+First of all you have to import a so called Chain Certificate or Root Certificate into your keystore.
+After that you can proceed with importing your Certificate.
+
+
+Download a Chain Certificate from the Certificate Authority you obtained the Certificate from.

+    For Verisign.com commercial certificates go to:
+            http://www.verisign.com/support/install/intermediate.html

+        For Verisign.com trial certificates go to:
+            http://www.verisign.com/support/verisign-intermediate-ca/Trial_Secure_Server_Root/index.html

+    For Trustcenter.de go to:
+            http://www.trustcenter.de/certservices/cacerts/en/en.htm#server

+    For Thawte.com go to:
+            http://www.thawte.com/certs/trustmap.html

+
+Import the Chain Certificate into your keystore
+    keytool -import -alias root -keystore <your_keystore_filename>
+    -trustcacerts -file <filename_of_the_chain_certificate>
+
+And finally import your new Certificate
+    keytool -import -alias tomcat -keystore <your_keystore_filename>
+    -file <your_certificate_filename>
+
+
+
+Each Certificate Authority tends to differ slightly from the others. They may
+require slightly different information and/or provide the certificate and
+associated certificate chain in different formats. Additionally, the rules that
+the Certificate Authorities use for issuing certificates change over time. As a
+result you may find that the commands given above may need to be modified. If
+you require assistance then help is available via the
+Apache Tomcat users
+mailing list.
+
+
+
Using OCSP Certificates

+To use Online Certificate Status Protocol (OCSP) with Apache Tomcat, ensure
+  you have downloaded, installed, and configured the
+  
+    Tomcat Native Connector.
+Furthermore, if you use the Windows platform, ensure you download the
+ocsp-enabled connector.
+To use OCSP, you require the following:
+
+
+  OCSP-enabled certificates
+  Tomcat with SSL APR connector
+  Configured OCSP responder
+
+
+Generating OCSP-Enabled Certificates

+Apache Tomcat requires the OCSP-enabled certificate to have the OCSP
+  responder location encoded in the certificate. The basic OCSP-related
+  certificate authority settings in the openssl.cnf file could look
+  as follows:
+
+
+#... omitted for brevity
+
+[x509]
+x509_extensions = v3_issued
+
+[v3_issued]
+subjectKeyIdentifier=hash
+authorityKeyIdentifier=keyid,issuer
+# The address of your responder
+authorityInfoAccess = OCSP;URI:http://127.0.0.1:8088
+keyUsage = critical,digitalSignature,nonRepudiation,keyEncipherment,dataEncipherment,keyAgreement,keyCertSign,cRLSign,encipherOnly,decipherOnly
+basicConstraints=critical,CA:FALSE
+nsComment="Testing OCSP Certificate"
+
+#... omitted for brevity
+
+
+The settings above encode the OCSP responder address
+  127.0.0.1:8088 into the certificate. Note that for the following
+   steps, you must have openssl.cnf and other configuration of
+   your CA ready. To generate an OCSP-enabled certificate:
+
+
+  
+    Create a private key:
+    openssl genrsa -aes256 -out ocsp-cert.key 4096
+  
+  
+    Create a signing request (CSR):
+    openssl req -config openssl.cnf -new -sha256 \
+  -key ocsp-cert.key -out ocsp-cert.csr
+  
+    Sign the CSR:
+    openssl ca -openssl.cnf -extensions ocsp -days 375 -notext \
+  -md sha256 -in ocsp-cert.csr -out ocsp-cert.crt
+  
+  
+    You may verify the certificate:
+    openssl x509 -noout -text -in ocsp-cert.crt
+  
+
+
+
+Configuring OCSP Connector

+
+To configure the OCSP connector, first verify that you are loading the Tomcat
+   APR library. Check the 
+   Apache Portable Runtime (APR) based Native library for Tomcat
+for more information about installation of APR. A basic OCSP-enabled connector
+ definition in the server.xml file looks as follows:
+
+<Connector
+    port="8443"
+    protocol="org.apache.coyote.http11.Http11AprProtocol"
+    maxParameterCount="1000"
+    secure="true"
+    scheme="https"
+    SSLEnabled="true"
+  <SSLHostConfig
+      caCertificateFile="/path/to/ca.pem"
+      certificateVerification="require"
+      certificateVerificationDepth="10" >
+    <Certificate
+        certificateFile="/path/to/ocsp-cert.crt"
+        certificateKeyFile="/path/to/ocsp-cert.key" />
+  </SSLHostConfig>
+
+
+
+Starting OCSP Responder

+  Apache Tomcat will query an OCSP responder server to get the certificate
+  status. When testing, an easy way to create an OCSP responder is by executing
+   the following:
+  
openssl ocsp -port 127.0.0.1:8088 \
+    -text -sha256 -index index.txt \
+    -CA ca-chain.cert.pem -rkey ocsp-cert.key \
+    -rsigner ocsp-cert.crt
 
+
+ Do note that when using OCSP, the responder encoded in the connector
+   certificate must be running. For further information, see
+   
+     OCSP documentation
+   .
+ 
+
+
+
+
Troubleshooting

+
+Additional information may be obtained about TLS handshake failures by
+configuring the dedicated TLS handshake logger to log debug level messages by
+adding the following to $CATALINA_BASE/conf/logging.properties:
+
org.apache.tomcat.util.net.NioEndpoint.handshake.level=FINE
+or
+org.apache.tomcat.util.net.Nio2Endpoint.handshake.level=FINE
+depending on the Connector being used.
+
+
+Here is a list of common problems that you may encounter when setting up
+SSL communications, and what to do about them.
+
+
+
+When Tomcat starts up, I get an exception like
+    "java.io.FileNotFoundException: {some-directory}/{some-file} not found".
+
+    A likely explanation is that Tomcat cannot find the keystore file
+    where it is looking.  By default, Tomcat expects the keystore file to
+    be named .keystore in the user home directory under which
+    Tomcat is running (which may or may not be the same as yours :-).  If
+    the keystore file is anywhere else, you will need to add a
+    keystoreFile attribute to the <Connector>
+    element in the Tomcat
+    configuration file.
+    
+
+When Tomcat starts up, I get an exception like
+    "java.io.FileNotFoundException:  Keystore was tampered with, or
+    password was incorrect".
+
+    Assuming that someone has not actually tampered with
+    your keystore file, the most likely cause is that Tomcat is using
+    a different password than the one you used when you created the
+    keystore file.  To fix this, you can either go back and
+    recreate the keystore
+    file, or you can add or update the keystorePass
+    attribute on the <Connector> element in the
+    Tomcat configuration
+    file.  REMINDER - Passwords are case sensitive!
+    
+
+When Tomcat starts up, I get an exception like
+    "java.net.SocketException: SSL handshake error javax.net.ssl.SSLException: No
+    available certificate or key corresponds to the SSL cipher suites which are
+    enabled."
+
+    A likely explanation is that Tomcat cannot find the alias for the server
+    key within the specified keystore. Check that the correct
+    keystoreFile and keyAlias are specified in the
+    <Connector> element in the
+    Tomcat configuration file.
+    REMINDER - keyAlias values may be case
+    sensitive!
+    
+
+My Java-based client aborts handshakes with exceptions such as
+    "java.lang.RuntimeException: Could not generate DH keypair" and
+    "java.security.InvalidAlgorithmParameterException: Prime size must be multiple
+    of 64, and can only range from 512 to 1024 (inclusive)"
+
+    If you are using the APR/native connector or the JSSE OpenSSL implementation,
+    it will determine the strength of ephemeral DH keys from the key size of
+    your RSA certificate. For example a 2048 bit RSA key will result in
+    using a 2048 bit prime for the DH keys. Unfortunately Java 6 only supports
+    768 bit and Java 7 only supports 1024 bit. So if your certificate has a
+    stronger key, old Java clients might produce such handshake failures.
+    As a mitigation you can either try to force them to use another cipher by
+    configuring an appropriate SSLCipherSuite and activate
+    SSLHonorCipherOrder, or embed weak DH params in your
+    certificate file. The latter approach is not recommended because it weakens
+    the SSL security (logjam attack).
+    
+
+
+
+If you are still having problems, a good source of information is the
+TOMCAT-USER mailing list.  You can find pointers to archives
+of previous messages on this list, as well as subscription and unsubscription
+information, at
+https://tomcat.apache.org/lists.html.
+
+
Using the SSL for session tracking in your application

+  This is a new feature in the Servlet 3.0 specification. Because it uses the
+     SSL session ID associated with the physical client-server connection there
+     are some limitations. They are:
+    
+      Tomcat must have a connector with the attribute
+          isSecure set to true.
+      If SSL connections are managed by a proxy or a hardware accelerator
+          they must populate the SSL request headers (see the
+          SSLValve) so that
+          the SSL session ID is visible to Tomcat.
+      If Tomcat terminates the SSL connection, it will not be possible to use
+          session replication as the SSL session IDs will be different on each
+          node.
+    
+
+  
+    To enable SSL session tracking you need to use a context listener to set the
+    tracking mode for the context to be just SSL (if any other tracking mode is
+    enabled, it will be used in preference). It might look something like:
+    package org.apache.tomcat.example;
+
+import java.util.EnumSet;
+
+import javax.servlet.ServletContext;
+import javax.servlet.ServletContextEvent;
+import javax.servlet.ServletContextListener;
+import javax.servlet.SessionTrackingMode;
+
+public class SessionTrackingModeListener implements ServletContextListener {
+
+    @Override
+    public void contextDestroyed(ServletContextEvent event) {
+        // Do nothing
+    }
+
+    @Override
+    public void contextInitialized(ServletContextEvent event) {
+        ServletContext context = event.getServletContext();
+        EnumSet<SessionTrackingMode> modes =
+            EnumSet.of(SessionTrackingMode.SSL);
+
+        context.setSessionTrackingModes(modes);
+    }
+
+}
+
+  Note: SSL session tracking is implemented for the NIO and NIO2 connectors.
+     It is not yet implemented for the APR connector.
+
+
Miscellaneous Tips and Bits

+
+To access the SSL session ID from the request, use:
+
+  String sslID = (String)request.getAttribute("javax.servlet.request.ssl_session_id");
+
+For additional discussion on this area, please see
+Bugzilla.
+
+
+  To terminate an SSL session, use:
+    // Standard HTTP session invalidation
+session.invalidate();
+
+// Invalidate the SSL Session
+org.apache.tomcat.util.net.SSLSessionManager mgr =
+    (org.apache.tomcat.util.net.SSLSessionManager)
+    request.getAttribute("javax.servlet.request.ssl_session_mgr");
+mgr.invalidateSession();
+
+// Close the connection since the SSL session will be active until the connection
+// is closed
+response.setHeader("Connection", "close");
+  
+    Note that this code is Tomcat specific due to the use of the
+    SSLSessionManager class. This is currently only available for the NIO and
+    NIO2 connectors, not the APR/native connector.
+  
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/tribes/developers.html b/apache-tomcat-9.0.109/webapps/docs/tribes/developers.html
new file mode 100644
index 0000000..41d9d1f
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/tribes/developers.html
@@ -0,0 +1,12 @@
+
+Apache Tribes - The Tomcat Cluster Communication Module (9.0.109) - Apache Tribes - Developers
Apache Tribes - The Tomcat Cluster Communication Module

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Developers
Developers

+    TODO
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/tribes/faq.html b/apache-tomcat-9.0.109/webapps/docs/tribes/faq.html
new file mode 100644
index 0000000..591e2cd
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/tribes/faq.html
@@ -0,0 +1,12 @@
+
+Apache Tribes - The Tomcat Cluster Communication Module (9.0.109) - Apache Tribes - Frequently Asked Questions
Apache Tribes - The Tomcat Cluster Communication Module

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Frequently Asked Questions
Frequently Asked Questions

+    TODO
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/tribes/interceptors.html b/apache-tomcat-9.0.109/webapps/docs/tribes/interceptors.html
new file mode 100644
index 0000000..8620617
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/tribes/interceptors.html
@@ -0,0 +1,12 @@
+
+Apache Tribes - The Tomcat Cluster Communication Module (9.0.109) - Apache Tribes - Interceptors
Apache Tribes - The Tomcat Cluster Communication Module

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Interceptors
Interceptors

+    TODO
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/tribes/introduction.html b/apache-tomcat-9.0.109/webapps/docs/tribes/introduction.html
new file mode 100644
index 0000000..8660b0f
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/tribes/introduction.html
@@ -0,0 +1,236 @@
+
+Apache Tribes - The Tomcat Cluster Communication Module (9.0.109) - Apache Tribes - Introduction
Apache Tribes - The Tomcat Cluster Communication Module

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Introduction
Table of Contents

+Quick Start
What is Tribes
Why another messaging framework
Feature Overview
Where can I get Tribes
+
Quick Start

+
+  Apache Tribes is a group or peer-to-peer communication framework that enables you to easily connect
+     your remote objects to communicate with each other.
+  
+  
+    Import: org.apache.catalina.tribes.Channel
+    Import: org.apache.catalina.tribes.Member
+    Import: org.apache.catalina.tribes.MembershipListener
+    Import: org.apache.catalina.tribes.ChannelListener
+    Import: org.apache.catalina.tribes.group.GroupChannel
+    Create a class that implements: org.apache.catalina.tribes.ChannelListener
+    Create a class that implements: org.apache.catalina.tribes.MembershipListener
+    Simple class to demonstrate how to send a message:
+      //create a channel
+Channel myChannel = new GroupChannel();
+
+//create my listeners
+ChannelListener msgListener = new MyMessageListener();
+MembershipListener mbrListener = new MyMemberListener();
+
+//attach the listeners to the channel
+myChannel.addMembershipListener(mbrListener);
+myChannel.addChannelListener(msgListener);
+
+//start the channel
+myChannel.start(Channel.DEFAULT);
+
+//create a message to be sent, message must implement java.io.Serializable
+//for performance reasons you probably want them to implement java.io.Externalizable
+Serializable myMsg = new MyMessage();
+
+//retrieve my current members
+Member[] group = myChannel.getMembers();
+
+//send the message
+myChannel.send(group,myMsg,Channel.SEND_OPTIONS_DEFAULT);
+    
+  
+  
+      Simple yeah? There is a lot more to Tribes than we have shown, hopefully the docs will be able
+      to explain more to you. Remember, that we are always interested in suggestions, improvements, bug fixes
+      and anything that you think would help this project.
+  
+
What is Tribes

+  
+    Tribes is a messaging framework with group communication abilities. Tribes allows you to send and receive
+    messages over a network, it also allows for dynamic discovery of other nodes in the network.

+    And that is the short story, it really is as simple as that. What makes Tribes useful and unique will be
+    described in the section below.

+  
+  
+    The Tribes module was started early 2006 and a small part of the code base comes from the clustering module
+    that has been existing since 2003 or 2004.
+    The current cluster implementation has several short comings and many workarounds were created due
+    to the complexity in group communication. Long story short, what should have been two modules a long time
+    ago, will be now. Tribes takes out the complexity of messaging from the replication module and becomes
+    a fully independent and highly flexible group communication module.

+  
+  
+    In Tomcat the old modules/cluster has now become modules/groupcom(Tribes) and
+    modules/ha (replication). This will allow development to proceed and let the developers
+    focus on the issues they are actually working on rather than getting boggled down in details of a module
+    they are not interested in. The understanding is that both communication and replication are complex enough,
+    and when trying to develop them in the same module, well you know, it becomes a cluster :)

+  
+  
+    Tribes allows for guaranteed messaging, and can be customized in many ways. Why is this important?

+    Well, you as a developer want to know that the messages you are sending are reaching their destination.
+    More than that, if a message doesn't reach its destination, the application on top of Tribes will be notified
+    that the message was never sent, and what node it failed.
+  
+
+
Why another messaging framework

+  
+    I am a big fan of reusing code and would never dream of developing something if someone else has already
+    done it and it was available to me and the community I try to serve.

+    When I did my research to improve the clustering module I was constantly faced with a few obstacles:

+    1. The framework wasn't flexible enough

+    2. The framework was licensed in a way that neither I nor the community could use it

+    3. Several features that I needed were missing

+    4. Messaging was guaranteed, but no feedback was reported to me

+    5. The semantics of my message delivery had to be configured before runtime

+    And the list continues...
+  
+  
+    So I came up with Tribes, to address these issues and other issues that came along.
+    When designing Tribes I wanted to make sure I didn't lose any of the flexibility and
+    delivery semantics that the existing frameworks already delivered. The goal was to create a framework
+    that could do everything that the others already did, but to provide more flexibility for the application
+    developer. In the next section will give you the high level overview of what features tribes offers or will offer.
+  
+
Feature Overview

+  
+    To give you an idea of the feature set I will list it out here.
+    Some of the features are not yet completed, if that is the case they are marked accordingly.
+  
+  
+    Pluggable modules

+    Tribes is built using interfaces. Any of the modules or components that are part of Tribes can be swapped out
+    to customize your own Tribes implementation.
+  
+  
+    Guaranteed Messaging

+    In the default implementation of Tribes uses TCP or UDP for messaging. TCP already has guaranteed message delivery
+    and flow control built in. I believe that the performance of Java TCP, will outperform an implementation of
+    Java/UDP/flow-control/message guarantee since the logic happens further down the stack. UDP messaging has been added in for
+    sending messages over UDP instead of TCP when desired. The same guarantee scenarios as described below are still available
+    over UDP, however, when a UDP message is lost, it's considered failed.

+    Tribes supports both non-blocking and blocking IO operations. The recommended setting is to use non blocking
+    as it promotes better parallelism when sending and receiving messages. The blocking implementation is available
+    for those platforms where NIO is still a trouble child.
+  
+  
+    Different Guarantee Levels

+    There are three different levels of delivery guarantee when a message is sent.
+  
+    
+      IO Based send guarantee. - fastest, least reliable

+          This means that Tribes considers the message transfer to be successful
+          if the message was sent to the socket send buffer and accepted.

+          On blocking IO, this would be socket.getOutputStream().write(msg)

+          On non blocking IO, this would be socketChannel.write(), and the buffer byte buffer gets emptied
+          followed by a socketChannel.read() to ensure the channel still open.
+          The read() has been added since write() will succeed if the connection has been "closed"
+          when using NIO.
+      
+      ACK based. - recommended, guaranteed delivery

+          When the message has been received on a remote node, an ACK is sent back to the sender,
+          indicating that the message was received successfully.
+      
+      SYNC_ACK based. - guaranteed delivery, guaranteed processed, slowest

+          When the message has been received on a remote node, the node will process
+          the message and if the message was processed successfully, an ACK is sent back to the sender
+          indicating that the message was received and processed successfully.
+          If the message was received, but processing it failed, an ACK_FAIL will be sent back
+          to the sender. This is a unique feature that adds an incredible amount value to the application
+          developer. Most frameworks here will tell you that the message was delivered, and the application
+          developer has to build in logic on whether the message was actually processed properly by the application
+          on the remote node. If configured, Tribes will throw an exception when it receives an ACK_FAIL
+          and associate that exception with the member that didn't process the message.
+      
+    
+  
+    You can of course write even more sophisticated guarantee levels, and some of them will be mentioned later on
+    in the documentation. One mentionable level would be a 2-Phase-Commit, where the remote applications don't receive
+    the message until all nodes have received the message. Sort of like a all-or-nothing protocol.
+  
+  
+    Per Message Delivery Attributes

+    Perhaps the feature that makes Tribes stand out from the crowd of group communication frameworks.
+    Tribes enables you to send to decide what delivery semantics a message transfer should have on a per
+    message basis. Meaning, that your messages are not delivered based on some static configuration
+    that remains fixed after the message framework has been started.

+    To give you an example of how powerful this feature is, I'll try to illustrate it with a simple example.
+    Imagine you need to send 10 different messages, you could send them the following way:
+  
+    Message_1 - asynchronous and fast, no guarantee required, fire and forget
+Message_2 - all-or-nothing, either all receivers get it, or none.
+Message_3 - encrypted and SYNC_ACK based
+Message_4 - asynchronous, SYNC_ACK and call back when the message is processed on the remote nodes
+Message_5 - totally ordered, this message should be received in the same order on all nodes that have been
+            send totally ordered
+Message_6 - asynchronous and totally ordered
+Message_7 - RPC message, send a message, wait for all remote nodes to reply before returning
+Message_8 - RPC message, wait for the first reply
+Message_9 - RPC message, asynchronous, don't wait for a reply, collect them via a callback
+Message_10- sent to a member that is not part of this group
+  
+    As you can imagine by now, these are just examples. The number of different semantics you can apply on a
+    per-message-basis is almost limitless. Tribes allows you to set up to 28 different on a message
+    and then configure Tribes to what flag results in what action on the message.

+    Imagine a shared transactional cache, probably >90% are reads, and the dirty reads should be completely
+    unordered and delivered as fast as possible. But transactional writes on the other hand, have to
+    be ordered so that no cache gets corrupted. With tribes you would send the write messages totally ordered,
+    while the read messages you simple fire to achieve highest throughput.

+    There are probably better examples on how this powerful feature can be used, so use your imagination and
+    your experience to think of how this could benefit you in your application.
+  
+  
+    Interceptor based message processing

+    Tribes uses a customizable interceptor stack to process messages that are sent and received.

+    So what, all frameworks have this!

+    Yes, but in Tribes interceptors can react to a message based on the per-message-attributes
+    that are sent runtime. Meaning, that if you add a encryption interceptor that encrypts message
+    you can decide if this interceptor will encrypt all messages, or only certain messages that are decided
+    by the applications running on top of Tribes.

+    This is how Tribes is able to send some messages totally ordered and others fire and forget style
+    like the example above.

+    The number of interceptors that are available will keep growing, and we would appreciate any contributions
+    that you might have.
+  
+  
+    Threadless Interceptor stack
+    The interceptor don't require any separate threads to perform their message manipulation.

+    Messages that are sent will piggy back on the thread that is sending them all the way through transmission.
+    The exception is the MessageDispatchInterceptor that will queue up the message
+    and send it on a separate thread for asynchronous message delivery.
+    Messages received are controlled by a thread pool in the receiver component.

+    The channel object can send a heartbeat() through the interceptor stack to allow
+    for timeouts, cleanup and other events.

+    The MessageDispatchInterceptor is the only interceptor that is configured by default.
+  
+  
+    Parallel Delivery

+    Tribes support parallel delivery of messages. Meaning that node_A could send three messages to node_B in
+    parallel. This feature becomes useful when sending messages with different delivery semantics.
+    Otherwise if Message_1 was sent totally ordered, Message_2 would have to wait for that message to complete.

+    Through NIO, Tribes is also able to send a message to several receivers at the same time on the same thread.
+  
+  
+    Silent Member Messaging

+    With Tribes you are able to send messages to members that are not in your group.
+    So by default, you can already send messages over a wide area network, even though the dynamic discover
+    module today is limited to local area networks by using multicast for dynamic node discovery.
+    Of course, the membership component will be expanded to support WAN memberships in the future.
+    But this is very useful, when you want to hide members from the rest of the group and only communicate with them
+  
+
Where can I get Tribes

+  
+    Tribes ships as a module with Tomcat, and is released as part of the Apache Tomcat release.
+  
+
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/tribes/membership.html b/apache-tomcat-9.0.109/webapps/docs/tribes/membership.html
new file mode 100644
index 0000000..e1e3a06
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/tribes/membership.html
@@ -0,0 +1,12 @@
+
+Apache Tribes - The Tomcat Cluster Communication Module (9.0.109) - Apache Tribes - Membership
Apache Tribes - The Tomcat Cluster Communication Module

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Membership
Membership

+    TODO
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/tribes/setup.html b/apache-tomcat-9.0.109/webapps/docs/tribes/setup.html
new file mode 100644
index 0000000..93de19e
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/tribes/setup.html
@@ -0,0 +1,12 @@
+
+Apache Tribes - The Tomcat Cluster Communication Module (9.0.109) - Apache Tribes - Configuration
Apache Tribes - The Tomcat Cluster Communication Module

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Configuration
Configuration Overview

+    TODO
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/tribes/status.html b/apache-tomcat-9.0.109/webapps/docs/tribes/status.html
new file mode 100644
index 0000000..a6e8c21
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/tribes/status.html
@@ -0,0 +1,12 @@
+
+Apache Tribes - The Tomcat Cluster Communication Module (9.0.109) - Apache Tribes - Status
Apache Tribes - The Tomcat Cluster Communication Module

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Status
Status

+    TODO
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/tribes/transport.html b/apache-tomcat-9.0.109/webapps/docs/tribes/transport.html
new file mode 100644
index 0000000..5f0b0cf
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/tribes/transport.html
@@ -0,0 +1,12 @@
+
+Apache Tribes - The Tomcat Cluster Communication Module (9.0.109) - Apache Tribes - Transport
Apache Tribes - The Tomcat Cluster Communication Module

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
Tribes Docs Home
FAQ
User Comments
User Guide
1) Introduction
2) Setup
3) FAQ
Reference
JavaDoc
Apache Tribes Development
Membership
Transport
Interceptors
Status
Developers
Apache Tribes - Transport
Transport

+    TODO
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/virtual-hosting-howto.html b/apache-tomcat-9.0.109/webapps/docs/virtual-hosting-howto.html
new file mode 100644
index 0000000..c73d64c
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/virtual-hosting-howto.html
@@ -0,0 +1,114 @@
+
+Apache Tomcat 9 (9.0.109) - Virtual Hosting and Tomcat
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Virtual Hosting and Tomcat
Table of Contents

+Assumptions
server.xml
Webapps Directory
Configuring Your ContextsGeneral
context.xml - approach #1
context.xml - approach #2
Defaults per host
Further Information
+
Assumptions

+    
+      For the sake of this how-to, assume you have a development host with two
+      host names, ren and stimpy. Let's also assume
+      one instance of Tomcat running, so $CATALINA_HOME refers to
+      wherever it's installed, perhaps /usr/local/tomcat.
+    
+    
+      Also, this how-to uses Unix-style path separators and commands; if you're
+      on Windows modify accordingly.
+    
+  
server.xml

+    
+      At the simplest, edit the Engine portion
+      of your server.xml file to look like this:
+    
+    <Engine name="Catalina" defaultHost="ren">
+    <Host name="ren"    appBase="renapps"/>
+    <Host name="stimpy" appBase="stimpyapps"/>
+</Engine>
+    
+      Note that the directory structures under the appBase for each host should
+      not overlap each other.
+    
+    
+      Consult the configuration documentation for other attributes of the
+      Engine and 
+      Host elements.
+    
+  
Webapps Directory

+    
+      Create directories for each of the virtual hosts:
+    
+    mkdir $CATALINA_HOME/renapps
+mkdir $CATALINA_HOME/stimpyapps
+  
Configuring Your Contexts

+    General

+      Contexts are normally located underneath the appBase directory. For
+       example, to deploy the foobar context as a war file in
+       the ren host, use
+       $CATALINA_HOME/renapps/foobar.war. Note that the
+       default or ROOT context for ren would be deployed as
+       $CATALINA_HOME/renapps/ROOT.war (WAR) or
+       $CATALINA_HOME/renapps/ROOT (directory).
+      
+      NOTE: The docBase for a context should never be
+        the same as the appBase for a host.
+      
+    
+    context.xml - approach #1

+      
+        Within your Context, create a META-INF directory and then
+        place your Context definition in it in a file named
+        context.xml. i.e.
+        $CATALINA_HOME/renapps/ROOT/META-INF/context.xml
+        This makes deployment easier, particularly if you're distributing a WAR
+        file.
+      
+    
+    context.xml - approach #2

+      
+        Create a structure under $CATALINA_HOME/conf/Catalina
+        corresponding to your virtual hosts, e.g.:
+      
+      mkdir $CATALINA_HOME/conf/Catalina/ren
+mkdir $CATALINA_HOME/conf/Catalina/stimpy
+      
+        Note that the ending directory name "Catalina" represents the
+        name attribute of the
+        Engine element as shown above.
+      
+      
+        Now, for your default webapps, add:
+      
+      $CATALINA_HOME/conf/Catalina/ren/ROOT.xml
+$CATALINA_HOME/conf/Catalina/stimpy/ROOT.xml
+      
+        If you want to use the Tomcat manager webapp for each host, you'll also
+        need to add it here:
+      
+      cd $CATALINA_HOME/conf/Catalina
+cp localhost/manager.xml ren/
+cp localhost/manager.xml stimpy/
+    
+    Defaults per host

+      
+        You can override the default values found in conf/context.xml
+        and conf/web.xml by specifying the new values in files
+        named context.xml.default and web.xml.default
+        from the host specific xml directory.
+      Following our previous example, you could use
+        $CATALINA_HOME/conf/Catalina/ren/web.xml.default
+        to customize the defaults for all webapps that are deployed in the virtual
+        host named ren.
+      
+    
+    Further Information

+      
+        Consult the configuration documentation for other attributes of the
+        Context element.
+      
+    
+  

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/web-socket-howto.html b/apache-tomcat-9.0.109/webapps/docs/web-socket-howto.html
new file mode 100644
index 0000000..4603b0e
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/web-socket-howto.html
@@ -0,0 +1,171 @@
+
+Apache Tomcat 9 (9.0.109) - WebSocket How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
WebSocket How-To
Table of Contents

+Overview
Application development
Tomcat WebSocket specific configuration
+
Overview

+Tomcat provides support for WebSocket as defined by
+   RFC 6455.
+
Application development

+Tomcat implements the Java WebSocket 1.1 API defined by JSR-356.
+
+There are several example applications that demonstrate how the WebSocket API
+   can be used. You will need to look at both the client side 
+   HTML and the server side 
+   code.
+
Tomcat WebSocket specific configuration

+
+Tomcat provides a number of Tomcat specific configuration options for
+   WebSocket. It is anticipated that these will be absorbed into the WebSocket
+   specification over time.
+
+The write timeout used when sending WebSocket messages in blocking mode
+   defaults to 20000 milliseconds (20 seconds). This may be changed by setting
+   the property org.apache.tomcat.websocket.BLOCKING_SEND_TIMEOUT
+   in the user properties collection attached to the WebSocket session. The
+   value assigned to this property should be a Long and represents
+   the timeout to use in milliseconds. For an infinite timeout, use
+   -1.
+
+The time Tomcat waits for a peer to send a WebSocket session close message
+   after Tomcat has sent a close message to the peer defaults to 30000
+   milliseconds (30 seconds). This may be changed by setting the property
+   org.apache.tomcat.websocket.SESSION_CLOSE_TIMEOUT in the user
+   properties collection attached to the WebSocket session. The value assigned
+   to this property should be a Long and represents the timeout to
+   use in milliseconds. Values less than or equal to zero will be ignored.
+
+The write timeout Tomcat uses when writing a session close message when the
+   close is abnormal defaults to 50 milliseconds. This may be changed by setting
+   the property
+   org.apache.tomcat.websocket.ABNORMAL_SESSION_CLOSE_SEND_TIMEOUT
+   in the user properties collection attached to the WebSocket session. The
+   value assigned to this property should be a Long and represents
+   the timeout to use in milliseconds. Values less than or equal to zero will be
+   ignored.
+
+In addition to the Session.setMaxIdleTimeout(long) method which
+   is part of the Java WebSocket API, Tomcat provides greater control of the
+   timing out the session due to lack of activity. Setting the property
+   org.apache.tomcat.websocket.READ_IDLE_TIMEOUT_MS in the user
+   properties collection attached to the WebSocket session will trigger a
+   session timeout if no WebSocket message is received for the specified number
+   of milliseconds. Setting the property
+   org.apache.tomcat.websocket.WRITE_IDLE_TIMEOUT_MS will trigger a
+   session timeout if no WebSocket message is sent for the specified number of
+   milliseconds. These can be used separately or together, with or without
+   Session.setMaxIdleTimeout(long). If the associated property is
+   not specified, the read and/or write idle timeout will be applied.
+
+If the application does not define a MessageHandler.Partial for
+   incoming binary messages, any incoming binary messages must be buffered so
+   the entire message can be delivered in a single call to the registered
+   MessageHandler.Whole for binary messages. The default buffer
+   size for binary messages is 8192 bytes. This may be changed for a web
+   application by setting the servlet context initialization parameter
+   org.apache.tomcat.websocket.binaryBufferSize to the desired
+   value in bytes.
+
+If the application does not define a MessageHandler.Partial for
+   incoming text messages, any incoming text messages must be buffered so the
+   entire message can be delivered in a single call to the registered
+   MessageHandler.Whole for text messages. The default buffer size
+   for text messages is 8192 bytes. This may be changed for a web application by
+   setting the servlet context initialization parameter
+   org.apache.tomcat.websocket.textBufferSize to the desired value
+   in bytes.
+
+The Java WebSocket specification 1.0 does not permit programmatic deployment
+   after the first endpoint has started a WebSocket handshake. By default,
+   Tomcat continues to permit additional programmatic deployment. This
+   behavior is controlled by the
+   org.apache.tomcat.websocket.noAddAfterHandshake servlet context
+   initialization parameter. The default may be changed by setting the
+   org.apache.tomcat.websocket.STRICT_SPEC_COMPLIANCE system
+   property to true but any explicit setting on the servlet context
+   will always take priority.
+
+When using the WebSocket client to connect to server endpoints, the timeout
+   for IO operations while establishing the connection is controlled by the
+   userProperties of the provided
+   javax.websocket.ClientEndpointConfig. The property is
+   org.apache.tomcat.websocket.IO_TIMEOUT_MS and is the
+   timeout as a String in milliseconds. The default is 5000 (5
+   seconds).
+
+When using the WebSocket client to connect to secure server endpoints, the
+   client SSL configuration is controlled by the userProperties
+   of the provided javax.websocket.ClientEndpointConfig. The
+   following user properties are supported:
+   
+     org.apache.tomcat.websocket.SSL_CONTEXT
+     org.apache.tomcat.websocket.SSL_PROTOCOLS
+     org.apache.tomcat.websocket.SSL_TRUSTSTORE
+     org.apache.tomcat.websocket.SSL_TRUSTSTORE_PWD
+   
+   The default truststore password is changeit.
+
+If the org.apache.tomcat.websocket.SSL_CONTEXT property is
+   set then the org.apache.tomcat.websocket.SSL_TRUSTSTORE and
+   org.apache.tomcat.websocket.SSL_TRUSTSTORE_PWD properties
+   will be ignored.
+
+For secure server end points, host name verification is enabled by default.
+   To bypass this verification (not recommended), it is necessary to provide a
+   custom SSLContext via the
+   org.apache.tomcat.websocket.SSL_CONTEXT user property. The
+   custom SSLContext must be configured with a custom
+   TrustManager that extends
+   javax.net.ssl.X509ExtendedTrustManager. The desired verification
+   (or lack of verification) can then be controlled by appropriate
+   implementations of the individual abstract methods.
+
+When using the WebSocket client to connect to server endpoints, the number of
+   HTTP redirects that the client will follow is controlled by the
+   userProperties of the provided
+   javax.websocket.ClientEndpointConfig. The property is
+   org.apache.tomcat.websocket.MAX_REDIRECTIONS. The default value
+   is 20. Redirection support can be disabled by configuring a value of zero.
+   
+
+When using the WebSocket client to connect to a server endpoint that requires
+   BASIC or DIGEST authentication, the following user properties must be set:
+   
+   
+     org.apache.tomcat.websocket.WS_AUTHENTICATION_USER_NAME
+     
+     org.apache.tomcat.websocket.WS_AUTHENTICATION_PASSWORD
+     
+   
+   Optionally, the WebSocket client can be configured only to send
+   credentials if the server authentication challenge includes a specific realm
+   by defining that realm in the optional user property:
+   
+     org.apache.tomcat.websocket.WS_AUTHENTICATION_REALM
+   
+
+When using the WebSocket client to connect to a server endpoint via a forward
+   proxy (also known as a gateway) that requires BASIC or DIGEST authentication,
+   the following user properties must be set:
+   
+   
+     org.apache.tomcat.websocket.WS_PROXY_AUTHENTICATION_USER_NAME
+     
+     org.apache.tomcat.websocket.WS_PROXY_AUTHENTICATION_PASSWORD
+     
+   
+   Optionally, the WebSocket client can be configured only to send
+   credentials if the server authentication challenge includes a specific realm
+   by defining that realm in the optional user property:
+   
+     org.apache.tomcat.websocket.WS_PROXY_AUTHENTICATION_REALM
+     
+   
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/websocketapi/index.html b/apache-tomcat-9.0.109/webapps/docs/websocketapi/index.html
new file mode 100644
index 0000000..a5e7966
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/websocketapi/index.html
@@ -0,0 +1,34 @@
+
+
+
+    
+    
+    API docs
+
+
+
+
+The WebSocket Javadoc is not installed by default. Download and install
+the "fulldocs" package to get it.
+
+You can also access the javadoc online in the Tomcat
+
+documentation bundle.
+
+
+
diff --git a/apache-tomcat-9.0.109/webapps/docs/windows-auth-howto.html b/apache-tomcat-9.0.109/webapps/docs/windows-auth-howto.html
new file mode 100644
index 0000000..f6a516d
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/windows-auth-howto.html
@@ -0,0 +1,307 @@
+
+Apache Tomcat 9 (9.0.109) - Windows Authentication How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Windows Authentication How-To
Table of Contents

+Overview
Built-in Tomcat supportDomain Controller
Tomcat instance (Windows server)
Tomcat instance (Linux server)
Web application
Client
References
Third party librariesWaffle
Spring Security - Kerberos Extension
Jespa
SPNEGO AD project at SourceForge
Reverse proxiesMicrosoft IIS
Apache httpd
+
Overview

+Integrated Windows authentication is most frequently used within intranet
+environments since it requires that the server performing the authentication and
+the user being authenticated are part of the same domain. For the user to be
+authenticated automatically, the client machine used by the user must also be
+part of the domain.
+There are several options for implementing integrated Windows authentication
+with Apache Tomcat. They are:
+
+Built-in Tomcat support.
+Use a third party library such as Waffle.
+Use a reverse proxy that supports Windows authentication to perform the
+authentication step such as IIS or httpd.
+
+The configuration of each of these options is discussed in the following
+sections.
+
Built-in Tomcat support

+Kerberos (the basis for integrated Windows authentication) requires careful
+configuration. If the steps in this guide are followed exactly, then a working
+configuration will result. It is important that the steps below are followed
+exactly. There is very little scope for flexibility in the configuration. From
+the testing to date it is known that:
+
+The host name used to access the Tomcat server must match the host name in
+the SPN exactly else authentication will fail. A checksum error may be reported
+in the debug logs in this case.
+The client must be of the view that the server is part of the local trusted
+intranet.
+The SPN must be HTTP/<hostname> and it must be exactly the same in all
+the places it is used.
+The port number must not be included in the SPN.
+No more than one SPN may be mapped to a domain user.
+Tomcat must run as the domain account with which the SPN has been associated
+or as domain admin. It is NOT recommended to run Tomcat under a
+domain admin user.
+Convention is that the domain name (dev.local) is always used in
+lower case. The domain name is typically not case sensitive.
+Convention is that the Kerberos realm name (DEV.LOCAL) is always
+used in upper case. The realm name is case sensitive.
+The domain must be specified when using the ktpass command.
+
+There are four components to the configuration of the built-in Tomcat
+support for Windows authentication. The domain controller, the server hosting
+Tomcat, the web application wishing to use Windows authentication and the client
+machine. The following sections describe the configuration required for each
+component.
+The names of the three machines used in the configuration examples below are
+win-dc01.dev.local (the domain controller), win-tc01.dev.local (the Tomcat
+instance) and win-pc01.dev.local (client). All are members of the
+dev.local domain.
+Note: In order to use the passwords in the steps below, the domain password
+policy had to be relaxed. This is not recommended for production environments.
+
+
+  Domain Controller

+  These steps assume that the server has already been configured to act as a
+  domain controller. Configuration of a Windows server as a domain controller is
+  outside the scope of this how-to. The steps to configure the domain controller
+  to enable Tomcat to support Windows authentication are as follows:
+  
+  
+  Create a domain user that will be mapped to the service name used by the
+  Tomcat server. In this how-to, this user is called tc01 and has a
+  password of tc01pass.
+  Map the service principal name (SPN) to the user account. SPNs take the
+  form 
+  <service class>/<host>:<port>/<service name>.
+  The SPN used in this how-to is HTTP/win-tc01.dev.local. To
+  map the user to the SPN, run the following:
+  setspn -A HTTP/win-tc01.dev.local tc01
+  
+  Generate the keytab file that the Tomcat server will use to authenticate
+  itself to the domain controller. This file contains the Tomcat private key for
+  the service provider account and should be protected accordingly. To generate
+  the file, run the following command (all on a single line):
+  ktpass /out c:\tomcat.keytab /mapuser tc01@DEV.LOCAL
+          /princ HTTP/win-tc01.dev.local@DEV.LOCAL
+          /pass tc01pass /kvno 0
+  Create a domain user to be used on the client. In this how-to the domain
+  user is test with a password of testpass.
+  
+  The above steps have been tested on a domain controller running Windows
+  Server 2019 Standard using the Windows Server 2016 functional level
+  for both the forest and the domain.
+  
+  
+
+  Tomcat instance (Windows server)

+  These steps assume that Tomcat and an appropriate Java JDK/JRE have already
+  been installed and configured and that Tomcat is running as the tc01@dev.local
+  user. The steps to configure the Tomcat instance for Windows authentication
+  are as follows:
+  
+  
+  Copy the tomcat.keytab file created on the domain controller
+  to $CATALINA_BASE/conf/tomcat.keytab.
+  Create the kerberos configuration file
+  $CATALINA_BASE/conf/krb5.ini. The file used in this how-to
+  contained:[libdefaults]
+default_realm = DEV.LOCAL
+default_keytab_name = FILE:c:\apache-tomcat-9.0.x\conf\tomcat.keytab
+default_tkt_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
+default_tgs_enctypes = rc4-hmac,aes256-cts-hmac-sha1-96,aes128-cts-hmac-sha1-96
+forwardable=true
+
+[realms]
+DEV.LOCAL = {
+        kdc = win-dc01.dev.local:88
+}
+
+[domain_realm]
+dev.local= DEV.LOCAL
+.dev.local= DEV.LOCAL
+  The location of this file can be changed by setting the
+  java.security.krb5.conf system property.
+  Create the JAAS login configuration file
+  $CATALINA_BASE/conf/jaas.conf. The file used in this how-to
+  contained:com.sun.security.jgss.krb5.initiate {
+    com.sun.security.auth.module.Krb5LoginModule required
+    doNotPrompt=true
+    principal="HTTP/win-tc01.dev.local@DEV.LOCAL"
+    useKeyTab=true
+    keyTab="c:/apache-tomcat-9.0.x/conf/tomcat.keytab"
+    storeKey=true;
+};
+
+com.sun.security.jgss.krb5.accept {
+    com.sun.security.auth.module.Krb5LoginModule required
+    doNotPrompt=true
+    principal="HTTP/win-tc01.dev.local@DEV.LOCAL"
+    useKeyTab=true
+    keyTab="c:/apache-tomcat-9.0.x/conf/tomcat.keytab"
+    storeKey=true;
+};
+  The location of this file can be changed by setting the
+  java.security.auth.login.config system property. The LoginModule
+  used is a JVM specific one so ensure that the LoginModule specified matches
+  the JVM being used. The name of the login configuration must match the
+  value used by the authentication
+  valve.
+  
+  The SPNEGO authenticator will work with any 
+  Realm but if used with the JNDI Realm, by default the JNDI Realm will use
+  the user's delegated credentials to connect to the Active Directory. If
+  only the authenticated user name is required then the AuthenticatedUserRealm
+  may be used that will simply return a Principal based on the authenticated
+  user name that does not have any roles.
+  The above steps have been tested on a Tomcat server running Windows Server
+  2019 Standard with AdoptOpenJDK 8u232-b09 (64-bit).
+  
+
+  Tomcat instance (Linux server)

+  This was tested with:
+  
+  Java 1.7.0, update 45, 64-bit
+  Ubuntu Server 12.04.3 LTS 64-bit
+  Tomcat 8.0.x (r1546570)
+  
+  It should work with any Tomcat release although it is recommended that
+  the latest stable release is used.
+  The configuration is the same as for Windows but with the following
+  changes:
+  
+  The Linux server does not have to be part of the Windows domain.
+  The path to the keytab file in krb5.ini and jaas.conf should be updated
+      to reflect the path to the keytab file on the Linux server using Linux
+      style file paths (e.g. /usr/local/tomcat/...).
+  
+  
+
+  Web application

+  The web application needs to be configured to the use Tomcat specific
+  authentication method of SPNEGO (rather than BASIC etc.) in
+  web.xml. As with the other authenticators, behaviour can be customised by
+  explicitly configuring the 
+  authentication valve and setting attributes on the Valve.
+  
+
+  Client

+  The client must be configured to use Kerberos authentication. For Internet
+  Explorer this means making sure that the Tomcat instance is in the "Local
+  intranet" security domain and that it is configured (Tools > Internet
+  Options > Advanced) with integrated Windows authentication enabled. Note that
+  this will not work if you use the same machine for the client
+  and the Tomcat instance as Internet Explorer will use the unsupported NTLM
+  protocol.
+  
+
+  References

+  Correctly configuring Kerberos authentication can be tricky. The following
+  references may prove helpful. Advice is also always available from the
+  Tomcat users
+  mailing list.
+  
+  
+      IIS and Kerberos
+  
+      SPNEGO project at SourceForge
+  
+      Oracle Java GSS-API tutorial (Java 7)
+  
+      Oracle Java GSS-API tutorial - Troubleshooting (Java 7)
+  
+      Geronimo configuration for Windows authentication
+  
+      Encryption Selection in Kerberos Exchanges
+  Supported Kerberos Cipher
+      Suites
+  
+  
+
+
Third party libraries

+
+  Waffle

+  Full details of this solution can be found through the
+  Waffle web site. The
+  key features are:
+  
+  Drop-in solution
+  Simple configuration (no JAAS or Kerberos keytab configuration required)
+  
+  Uses a native library
+  
+  
+
+  Spring Security - Kerberos Extension

+  Full details of this solution can be found through the
+   Kerberos extension web site. The key features are:
+  
+  Extension to Spring Security
+  Requires a Kerberos keytab file to be generated
+  Pure Java solution
+  
+  
+
+  Jespa

+  Full details of this solution can be found through the
+  project web site. The key
+  features are:
+  
+  Pure Java solution
+  Advanced Active Directory integration
+  
+  
+
+  SPNEGO AD project at SourceForge

+  Full details of this solution can be found through the
+  project
+  site. The key features are:
+  
+  Pure Java solution
+  SPNEGO/Kerberos Authenticator
+  Active Directory Realm
+  
+  
+
Reverse proxies

+
+  Microsoft IIS

+  There are three steps to configuring IIS to provide Windows authentication.
+  They are:
+  
+  Configure IIS as a reverse proxy for Tomcat (see the
+  
+  IIS Web Server How-To).
+  Configure IIS to use Windows authentication
+  Configure Tomcat to use the authentication user information from IIS by
+  setting the tomcatAuthentication attribute on the 
+  AJP connector to false. Alternatively, set the
+  tomcatAuthorization attribute to true to allow IIS to
+  authenticate, while Tomcat performs the authorization.
+  
+  
+
+  Apache httpd

+  Apache httpd does not support Windows authentication out of the box but
+  there are a number of third-party modules that can be used. These include:
+  
+  mod_auth_sspi for use on Windows platforms.
+  mod_auth_ntlm_winbind for non-Windows platforms. Known to
+  work with httpd 2.0.x on 32-bit platforms. Some users have reported stability
+  issues with both httpd 2.2.x builds and 64-bit Linux builds.
+  
+  There are three steps to configuring httpd to provide Windows
+  authentication. They are:
+  
+  Configure httpd as a reverse proxy for Tomcat (see the
+  
+  Apache httpd Web Server How-To).
+  Configure httpd to use Windows authentication
+  Configure Tomcat to use the authentication user information from httpd by
+  setting the tomcatAuthentication attribute on the 
+  AJP connector to false.
+  
+  
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/docs/windows-service-howto.html b/apache-tomcat-9.0.109/webapps/docs/windows-service-howto.html
new file mode 100644
index 0000000..5e1bff6
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/docs/windows-service-howto.html
@@ -0,0 +1,552 @@
+
+Apache Tomcat 9 (9.0.109) - Windows Service How-To
Apache Tomcat 9

+            Version 9.0.109,
+            Sep 1 2025
Links
Docs Home
FAQ
User Guide
1) Introduction
2) Setup
3) First webapp
4) Deployer
5) Manager
6) Host Manager
7) Realms and AAA
8) Security Manager
9) JNDI Resources
10) JDBC DataSources
11) Classloading
12) JSPs
13) SSL/TLS
14) SSI
15) CGI
16) Proxy Support
17) MBeans Descriptors
18) Default Servlet
19) Clustering
20) Load Balancer
21) Connectors
22) Monitoring and Management
23) Logging
24) APR/Native
25) Virtual Hosting
26) Advanced IO
27) Mavenized
28) Security Considerations
29) Windows Service
30) Windows Authentication
31) Tomcat's JDBC Pool
32) WebSocket
33) Rewrite
34) CDI 2 and JAX-RS
35) AOT/GraalVM Support
Reference
Release Notes
Configuration
Tomcat Javadocs
Servlet 4.0 Javadocs
JSP 2.3 Javadocs
EL 3.0 Javadocs
WebSocket 1.1 Javadocs
JASPIC 1.1 Javadocs
Common Annotations 1.3 Javadocs
JK 1.2 Documentation
Apache Tomcat Development
Building
Changelog
Status
Developers
Architecture
Tribes
Windows Service How-To
Table of Contents

+Tomcat monitor applicationCommand line directives
Tomcat service applicationCommand line directives
Command line parameters
Installing services
Updating services
Removing services
Debugging services
Multiple Instances
+
Tomcat monitor application

+
+  Tomcat9w is a GUI application for monitoring and
+  configuring Tomcat services.
+
+  Command line directives

+
+  Each command line directive is in the form of
+  //XX[//ServiceName]
+
+  If the //ServiceName component is omitted, then the service
+  name is assumed to be the name of the file less the w suffix. So the default
+  service name is Tomcat9.
+
+  The available command line directives are:
+
+  
+    
+      
+      
+      
+    
+    
+      
+      
+      
+    
+    
+      
+      
+      
+    
+    
+      
+      
+      
+    
+  //ES Edit service configuration This is the default operation. It is called if the no option is
+          provided. Starts the GUI application which allows the service
+          configuration to be modified, started and stopped.
//MS Monitor service Starts the GUI application and minimizes it to the system tray.
//MR Monitor & run service Starts the GUI application and minimizes it to the system tray. Start
+          the service if it is not currently running.
//MQ Monitor quit Stop any running monitor for the service.
+
+
+
Tomcat service application

+
+  Tomcat9 is a service application for running Tomcat
+  9 as a Windows service.
+
+  Command line directives

+
+    Each command line directive is in the form of
+    //XX[//ServiceName]
+
+    The available command line directives are:
+
+    
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+    //TS Run the service as console application This is the default operation. It is called if the no option is
+            provided. The ServiceName is the name of the executable without
+            exe suffix, meaning Tomcat9
//RS Run the service Called only from ServiceManager
//ES Start (execute) the service 
//SS Stop the service 
//US Update service parameters 
//IS Install service 
//DS Delete service Stops the service if running
//PS Print service Prints the command to (re-)create the current configuration
//PP[//seconds] Pause service Default is 60 seconds
//VS Version Print version and exit
//? Help Print usage and exit
+  
+
+  Command line parameters

+
+    Each command line parameter is prefixed with --. If the
+    command line parameter is prefixed with ++, and the parameter
+    supports multiple values, then it's value will be appended to the existing
+    option. In the table below, parameters that support multiple values are
+    prefixed with ++.
+
+    If the environment variable with the same name as command line parameter
+    but prefixed with PR_ exists it will take precedence. For
+    example:
+
+    set PR_CLASSPATH=xx.jar
+
+    is equivalent to providing
+
+    --Classpath=xx.jar
+
+     as command line parameter.
+
+    
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+      
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+      
+        
+        
+        
+      
+    ParameterName Default Description
--Description Service name description (maximum 1024 characters)
--DisplayName ServiceName Service display name
--Install procrun.exe //RS//ServiceName Install image
--Startup manual Service startup mode can be either auto or manual
++DependsOn List of services that this service depend on. Dependent services are
+            separated using either # or ; characters
++Environment List of environment variables that will be provided to the service
+            in the form key=value. They are separated using either
+            # or ; characters. If you need to use either the
+            # or ; character within a value then the entire value
+            must be enclosed inside single quotes.
--User User account used for running executable. It is used only for
+            StartMode java or exe and enables running applications
+            as service under account without LogonAsService privilege.
--Password Password for user account set by --User parameter
--ServiceUser Specifies the name of the account under which the service should
+            run. Use an account name in the form
+            DomainName\UserName. The service process will be logged
+            on as this user. if the account belongs to the built-in domain, you
+            can specify .\UserName. Note that the Service Control
+            Manager does not accept localised forms of the standard names so to
+            use them you need to specify NT Authority\LocalService,
+            NT Authority\NetworkService or LocalSystem
+            as appropriate.
--ServicePassword Password for user account set by --ServiceUser parameter
--LibraryPath Directory added to the search path used to locate the DLLs for the
+            JVM. This directory is added both in front of the PATH
+            environment variable and as a parameter to the
+            SetDLLDirectory function.
--JavaHome JAVA_HOME Set a different JAVA_HOME than defined by JAVA_HOME environment
+            variable
--Jvm auto Use either auto (i.e. find the JVM from the Windows registry)
+            or specify the full path to the jvm.dll.
+            You can use the environment variable expansion here.
++JvmOptions -Xrs List of options in the form of -D or -X that will be
+            passed to the JVM. The options are separated using either
+            # or ; characters. If you need to embed either # or
+            ; characters, put them inside single quotes. (Not used in
+            exe mode.)
++JvmOptions9 List of options in the form of -D or -X that will be
+            passed to the JVM when running on Java 9 or later. The options are
+            separated using either # or ; characters. If you need
+            to embed either # or ; characters, put them inside
+            single quotes. (Not used in exe mode.)
--Classpath Set the Java classpath. (Not used in exe mode.)
--JvmMs Initial memory pool size in MiB. (Not used in exe mode.)
--JvmMx Maximum memory pool size in MiB. (Not used in exe mode.)
--JvmSs Thread stack size in KiB. (Not used in exe mode.)
--StartMode One of jvm, Java or exe. The modes are:
+          
+            jvm - start Java in-process. Depends on jvm.dll, see
+                --Jvm.
+            Java - same as exe, but automatically uses the default Java
+                executable, i.e. %JAVA_HOME%\bin\java.exe. Make sure JAVA_HOME
+                is set correctly, or use --JavaHome to provide the correct
+                location. If neither is set, procrun will try to find the
+                default JDK (not JRE) from the Windows registry.
+            exe - run the image as a separate process
+          
+        
--StartImage Executable that will be run. Only applies to exe mode.
--StartPath Working path for the start image executable.
--StartClass Main Class that contains the startup method. Applies to the jvm and
+            Java modes. (Not used in exe mode.) 
--StartMethod main Method name if differs then main
++StartParams List of parameters that will be passed to either StartImage or
+            StartClass. Parameters are separated using either # or
+            ; character.
--StopMode One of jvm, Java or exe. See --StartMode
+            for further details. 
--StopImage Executable that will be run on Stop service signal. Only applies to
+            exe mode.
--StopPath Working path for the stop image executable. Does not apply to
+            jvm mode.
--StopClass Main Class that will be used on Stop service signal. Applies to the
+            jvm and Java modes. 
--StopMethod main Method name if differs then main
--StopParams List of parameters that will be passed to either StopImage or
+            StopClass. Parameters are separated using either # or
+            ; character.
++StopTimeout No Timeout Defines the timeout in seconds that procrun waits for service to
+            exit gracefully.
--LogPath %SystemRoot%\System32\LogFiles\Apache Defines the path for logging. Creates the directory if
+            necessary.
--LogPrefix commons-daemon Defines the service log filename prefix. The log file is created in
+            the LogPath directory with .YEAR-MONTH-DAY.log
+            suffix
--LogLevel Info Defines the logging level and can be either Error,
+            Info, Warn or Debug. (Case insensitive).
--LogJniMessages 0 Set this non-zero (e.g. 1) to capture JVM jni debug messages in the
+            procrun log file. Is not needed if stdout/stderr redirection is
+            being used. Only applies to jvm mode.
--StdOutput Redirected stdout filename.
+            If named auto then file is created inside LogPath with
+            the name service-stdout.YEAR-MONTH-DAY.log.
--StdError Redirected stderr filename.
+            If named auto then file is created inside LogPath with
+            the name service-stderr.YEAR-MONTH-DAY.log.
--PidFile Defines the file name for storing the running process id. Actual
+        file is created in the LogPath directory
+  
+
Installing services

+
+The safest way to manually install the service is to use the provided
+service.bat script. Administrator privileges are required to run this
+script. If necessary, you can use the /user switch to specify
+a user to use for the installation of the service.
+
+
+NOTE: If User Account Control (UAC) is enabled you will be
+asked for additional privileges when 'Tomcat9.exe' is launched by
+the script.

+If you want to pass additional options to service installer as
+PR_* environment variables, you have to either configure them
+globally in OS, or launch the program that sets them with elevated privileges
+(e.g. right-click on cmd.exe and select "Run as administrator"; on Windows 8
+(or later) or Windows Server 2012 (or later), you can open an elevated command
+prompt for the current directory from the Explorer
+by clicking on the "File" menu bar). See issue 56143 for details.
+
+
+Install the service named 'Tomcat9'
+C:\> service.bat install
+
+There is a 2nd optional parameter that lets you specify the name of the
+service, as displayed in Windows services.
+
+Install the service named 'MyService'
+C:\> service.bat install MyService
+
+When installing the service with a non-default name,
+tomcat9.exe and tomcat9w.exe may be renamed to
+match the chosen service name. To do this, use the --rename
+option.
+
+Install the service named 'MyService' with renaming
+C:\> service.bat install MyService --rename
+
+
+If using tomcat9.exe, you need to use the //IS parameter.
+
+Install the service named 'Tomcat9'
+C:\> tomcat9 //IS//Tomcat9 --DisplayName="Apache Tomcat 9" ^
+     --Install="C:\Program Files\Tomcat\bin\tomcat9.exe" --Jvm=auto ^
+     --StartMode=jvm --StopMode=jvm ^
+     --StartClass=org.apache.catalina.startup.Bootstrap --StartParams=start ^
+     --StopClass=org.apache.catalina.startup.Bootstrap --StopParams=stop
+
+
Updating services

+
+To update the service parameters, you need to use the //US parameter.
+
+
+Update the service named 'Tomcat9'
+C:\> tomcat9 //US//Tomcat9 --Description="Apache Tomcat Server - https://tomcat.apache.org/ " ^
+     --Startup=auto --Classpath=%JAVA_HOME%\lib\tools.jar;%CATALINA_HOME%\bin\bootstrap.jar
+
+If you gave the service an optional name, you need to specify it like this:
+
+
+Update the service named 'MyService'
+C:\> tomcat9 //US//MyService --Description="Apache Tomcat Server - https://tomcat.apache.org/ " ^
+     --Startup=auto --Classpath=%JAVA_HOME%\lib\tools.jar;%CATALINA_HOME%\bin\bootstrap.jar
+
+
Removing services

+
+To remove the service, you need to use the //DS parameter.

+If the service is running it will be stopped and then deleted.
+
+Remove the service named 'Tomcat9'
+C:\> tomcat9 //DS//Tomcat9
+
+If you gave the service an optional name, you need to specify it like this:
+
+
+Remove the service named 'MyService'
+C:\> tomcat9 //DS//MyService
+
+
Debugging services

+
+To run the service in console mode, you need to use the //TS parameter.
+The service shutdown can be initiated by pressing CTRL+C or
+CTRL+BREAK.
+If you rename the tomcat9.exe to testservice.exe then you can just execute the
+testservice.exe and this command mode will be executed by default.
+
+Run the service named 'Tomcat9' in console mode
+C:\> tomcat9 //TS//Tomcat9 [additional arguments]
+Or simply execute:
+C:\> tomcat9
+
+
Multiple Instances

+
+Tomcat supports installation of multiple instances. You can have a single
+installation of Tomcat with multiple instances running on different IP/port
+combinations, or multiple Tomcat versions, each running one or more instances on
+different IP/ports.
+
+Each instance folder will need the following structure:
+
+
+conf
+logs
+temp
+webapps
+work
+
+
+At a minimum, conf should contain a copy of the following files from
+CATALINA_HOME\conf\. Any files not copied and edited, will be picked up by
+default from CATALINA_HOME\conf, i.e. CATALINA_BASE\conf files override defaults
+from CATALINA_HOME\conf.
+
+server.xml
+web.xml
+
+
+You must edit CATALINA_BASE\conf\server.xml to specify a unique IP/port for the
+instance to listen on. Find the line that contains
+<Connector port="8080" ... and add an address attribute and/or
+update the port number so as to specify a unique IP/port combination.
+
+To install an instance, first set the CATALINA_HOME environment variable to the
+name of the Tomcat installation directory. Then create a second environment
+variable CATALINA_BASE and point this to the instance folder. Then run
+"service.bat install" command specifying a service name.
+
+set CATALINA_HOME=c:\tomcat_9
+set CATALINA_BASE=c:\tomcat_9\instances\instance1
+service.bat install instance1
+
+
+To modify the service settings, you can run tomcat9w //ES//instance1.
+
+
+For additional instances, create additional instance folder, update the
+CATALINA_BASE environment variable, and run the "service.bat install" again.
+
+set CATALINA_BASE=c:\tomcat_9\instances\instance2
+service.bat install instance2
+
+

+    Copyright © 1999-2025, The Apache Software Foundation
+    

+    Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo
+    are either registered trademarks or trademarks of the Apache Software
+    Foundation.
+    
\ No newline at end of file
diff --git a/apache-tomcat-9.0.109/webapps/examples/META-INF/context.xml b/apache-tomcat-9.0.109/webapps/examples/META-INF/context.xml
new file mode 100644
index 0000000..2ae7e66
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/META-INF/context.xml
@@ -0,0 +1,23 @@
+
+
+
+  
+  
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/CookieExample.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/CookieExample.class
new file mode 100644
index 0000000..33c0e1f
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/CookieExample.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/CookieExample.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/CookieExample.java
new file mode 100644
index 0000000..0273511
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/CookieExample.java
@@ -0,0 +1,122 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.ResourceBundle;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
+import util.CookieFilter;
+import util.HTMLFilter;
+
+/**
+ * Example servlet showing request headers
+ *
+ * @author James Duncan Davidson <duncan@eng.sun.com>
+ */
+public class CookieExample extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        ResourceBundle rb = ResourceBundle.getBundle("LocalStrings", request.getLocale());
+
+        String cookieName = request.getParameter("cookiename");
+        String cookieValue = request.getParameter("cookievalue");
+        Cookie aCookie = null;
+        if (cookieName != null && cookieValue != null) {
+            aCookie = new Cookie(cookieName, cookieValue);
+            aCookie.setPath(request.getContextPath() + "/");
+            response.addCookie(aCookie);
+        }
+
+        response.setContentType("text/html");
+        response.setCharacterEncoding("UTF-8");
+
+        PrintWriter out = response.getWriter();
+        out.println("");
+        out.println("");
+        out.println("");
+
+        String title = rb.getString("cookies.title");
+        out.println("" + title + "");
+        out.println("");
+        out.println("");
+
+        out.println("");
+        out.println(
+                "");
+        out.println("");
+        out.println(
+                "");
+
+        out.println("
" + title + "");
+
+        Cookie[] cookies = request.getCookies();
+        if ((cookies != null) && (cookies.length > 0)) {
+            HttpSession session = request.getSession(false);
+            String sessionId = null;
+            if (session != null) {
+                sessionId = session.getId();
+            }
+            out.println(rb.getString("cookies.cookies") + "
");
+            for (Cookie cookie : cookies) {
+                String cName = cookie.getName();
+                String cValue = cookie.getValue();
+                out.print("Cookie Name: " + HTMLFilter.filter(cName) + "
");
+                out.println("  Cookie Value: " + HTMLFilter.filter(CookieFilter.filter(cName, cValue, sessionId)) +
+                        "

");
+            }
+        } else {
+            out.println(rb.getString("cookies.no-cookies"));
+        }
+
+        if (aCookie != null) {
+            out.println("");
+            out.println(rb.getString("cookies.set") + "
");
+            out.print(rb.getString("cookies.name") + "  " + HTMLFilter.filter(cookieName) + "
");
+            out.print(rb.getString("cookies.value") + "  " + HTMLFilter.filter(cookieValue));
+        }
+
+        out.println("
");
+        out.println(rb.getString("cookies.make-cookie") + "
");
+        out.print("
");
+        out.print(rb.getString("cookies.name") + "  ");
+        out.println("
");
+        out.print(rb.getString("cookies.value") + "  ");
+        out.println("
");
+        out.println("");
+
+
+        out.println("");
+        out.println("");
+    }
+
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        doGet(request, response);
+    }
+
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/HelloWorldExample.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/HelloWorldExample.class
new file mode 100644
index 0000000..c525a54
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/HelloWorldExample.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/HelloWorldExample.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/HelloWorldExample.java
new file mode 100644
index 0000000..346733a
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/HelloWorldExample.java
@@ -0,0 +1,74 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.ResourceBundle;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * The simplest possible servlet.
+ *
+ * @author James Duncan Davidson
+ */
+
+public class HelloWorldExample extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        ResourceBundle rb = ResourceBundle.getBundle("LocalStrings", request.getLocale());
+        response.setContentType("text/html");
+        response.setCharacterEncoding("UTF-8");
+        PrintWriter out = response.getWriter();
+
+        out.println("");
+        out.println("");
+        out.println("");
+
+        String title = rb.getString("helloworld.title");
+
+        out.println("" + title + "");
+        out.println("");
+        out.println("");
+
+        // note that all links are created to be relative. this
+        // ensures that we can move the web application that this
+        // servlet belongs to a different place in the url
+        // tree and not have any harmful side effects.
+
+        // XXX
+        // making these absolute till we work out the
+        // addition of a PathInfo issue
+
+        out.println("");
+        out.println(
+                "");
+        out.println("");
+        out.println(
+                "");
+        out.println("" + title + "");
+        out.println("");
+        out.println("");
+    }
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings.properties
new file mode 100644
index 0000000..b3d8440
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings.properties
@@ -0,0 +1,51 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.cookies=Your browser is sending the following cookies:
+cookies.make-cookie=Create a cookie to send to your browser
+cookies.name=Name:
+cookies.no-cookies=Your browser isn't sending any cookies
+cookies.set=You just sent the following cookie to your browser:
+cookies.title=Cookies Example
+cookies.value=Value:
+
+helloworld.title=Hello World!
+
+requestheader.title=Request Header Example
+
+requestinfo.label.method=Method:
+requestinfo.label.pathinfo=Path Info:
+requestinfo.label.protocol=Protocol:
+requestinfo.label.remoteaddr=Remote Address:
+requestinfo.label.requesturi=Request URI:
+requestinfo.title=Request Information Example
+
+requestparams.firstname=First Name:
+requestparams.lastname=Last Name:
+requestparams.no-params=No Parameters, Please enter some
+requestparams.params-in-req=Parameters in this request:
+requestparams.title=Request Parameters Example
+
+sessions.adddata=Add data to your session
+sessions.created=Created:
+sessions.data=The following data is in your session:
+sessions.dataname=Name of Session Attribute:
+sessions.datavalue=Value of Session Attribute:
+sessions.id=Session ID:
+sessions.lastaccessed=Last Accessed:
+sessions.title=Sessions Example
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_cs.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_cs.properties
new file mode 100644
index 0000000..bd2d711
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_cs.properties
@@ -0,0 +1,25 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.make-cookie=Vytvo\u0159te cookie pro zasl\u00e1n\u00ed do Va\u0161eho prohl\u00ed\u017ee\u010de
+
+requestheader.title=P\u0159\u00edklad hlavi\u010dky dotazu
+
+requestparams.firstname=K\u0159estn\u00ed jm\u00e9no:
+requestparams.no-params=\u017d\u00e1dn\u00fd parametr, vlo\u017ete n\u011bjak\u00fd pros\u00edm
+requestparams.title=P\u0159\u00edklad parametr\u016f dotazu
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_de.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_de.properties
new file mode 100644
index 0000000..86e8783
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_de.properties
@@ -0,0 +1,31 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.make-cookie=Erzeuge ein Cookie um es an deinen Browser zu senden
+cookies.name=Name:
+
+requestheader.title=Request-Header Beispiel
+
+requestinfo.label.protocol=Protokoll:
+requestinfo.label.requesturi=Anfrage-URI:
+
+requestparams.firstname=Vorname:
+requestparams.no-params=Keine Parameter, bitte geben Sie welche ein
+requestparams.title=Beispiel f\u00fcr Anfrageparameter
+
+sessions.title=Sessions-Beispiel
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_es.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_es.properties
new file mode 100644
index 0000000..7e80482
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_es.properties
@@ -0,0 +1,51 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.cookies=Tu navegador est\u00e1 enviando los siguientes cookies:
+cookies.make-cookie=Crea un cookie para enviarlo a tu navegador
+cookies.name=Nombre:
+cookies.no-cookies=Tu navegador no est\u00e1 enviando cookies
+cookies.set=Acabas de enviar a tu navegador estos cookies:
+cookies.title=Ejemplo de Cookies
+cookies.value=Valor:
+
+helloworld.title=Hola Mundo!
+
+requestheader.title=Ejemplo de Cabecera de Requerimiento:
+
+requestinfo.label.method=M\u00e9todo:
+requestinfo.label.pathinfo=Info de Ruta:
+requestinfo.label.protocol=Protocolo:
+requestinfo.label.remoteaddr=Direccion Remota:
+requestinfo.label.requesturi=URI de Requerimiento:
+requestinfo.title=Ejemplo de Informacion de Requerimiento:
+
+requestparams.firstname=Nombre:
+requestparams.lastname=Apellidos:
+requestparams.no-params=No hay p\u00e1rametro. Por favor, usa alguno
+requestparams.params-in-req=Par\u00e1metros en este Request:
+requestparams.title=Ejemplo de solicitud con par\u00e1metros:
+
+sessions.adddata=A\u00f1ade datos a tu sesi\u00f3n:
+sessions.created=Creado:
+sessions.data=Lo siguientes datos est\u00e1n en tu sesi\u00f3n:
+sessions.dataname=Nombre del atributo de sesi\u00f3n:
+sessions.datavalue=Valor del atributo de sesi\u00f3n:
+sessions.id=ID de Sesi\u00f3n:
+sessions.lastaccessed=Ultimo Acceso:
+sessions.title=Ejemplo de Sesiones
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_fr.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_fr.properties
new file mode 100644
index 0000000..03b23a4
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_fr.properties
@@ -0,0 +1,51 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.cookies=Votre navigateur retourne les cookies suivant :
+cookies.make-cookie=Cr\u00e9ation d'un cookie \u00e0 retourner \u00e0 votre navigateur
+cookies.name=Nom :
+cookies.no-cookies=Votre navigateur ne retourne aucun cookie
+cookies.set=Vous venez d'envoyer le cookie suivant \u00e0 votre navigateur :
+cookies.title=Exemple d'utilisation de Cookies
+cookies.value=Valeur :
+
+helloworld.title=Salut le Monde !
+
+requestheader.title=Exemple d'information sur les ent\u00eates de requ\u00eate
+
+requestinfo.label.method=M\u00e9thode :
+requestinfo.label.pathinfo=Info de chemin :
+requestinfo.label.protocol=Protocole :
+requestinfo.label.remoteaddr=Adresse distante :
+requestinfo.label.requesturi=URI de requ\u00eate :
+requestinfo.title=Exemple d'information sur la requ\u00eate
+
+requestparams.firstname=Pr\u00e9nom :
+requestparams.lastname=Nom :
+requestparams.no-params=Pas de param\u00eatre, merci d'en saisir quelques-uns
+requestparams.params-in-req=Param\u00eatres dans la requ\u00eate :
+requestparams.title=Exemple de Requ\u00eate avec Param\u00e8tres
+
+sessions.adddata=Ajouter des donn\u00e9es \u00e0 votre session
+sessions.created=Cr\u00e9e le :
+sessions.data=Les donn\u00e9es existantes dans votre session :
+sessions.dataname=Nom de l'Attribut de Session :
+sessions.datavalue=Valeur de l'Attribut de Session :
+sessions.id=ID de Session :
+sessions.lastaccessed=Dernier acc\u00e8s :
+sessions.title=Exemple de Sessions
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_ja.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_ja.properties
new file mode 100644
index 0000000..25f119b
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_ja.properties
@@ -0,0 +1,51 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.cookies=\u3042\u306a\u305f\u306e\u306e\u30d6\u30e9\u30a6\u30b6\u304b\u3089\u6b21\u306eCookie\u304c\u9001\u4fe1\u3055\u308c\u3066\u3044\u307e\u3059\uff1a
+cookies.make-cookie=\u30d6\u30e9\u30a6\u30b6\u3078\u9001\u4fe1\u3059\u308b cookie \u3092\u4f5c\u6210\u3057\u307e\u3059\u3002
+cookies.name=Name:
+cookies.no-cookies=\u3042\u306a\u305f\u306e\u30d6\u30e9\u30a6\u30b6\u306f\u30af\u30c3\u30ad\u30fc\u3092\u9001\u4fe1\u3057\u3066\u3044\u307e\u305b\u3093\u3002
+cookies.set=\u30d6\u30e9\u30a6\u30b6\u306b cookie \u3092\u9001\u4fe1\u3057\u307e\u3057\u305f\u3002
+cookies.title=Cookie \u4f8b
+cookies.value=\u5024\uff1a
+
+helloworld.title=Hello World!
+
+requestheader.title=\u30ea\u30af\u30a8\u30b9\u30c8\u30d8\u30c3\u30c0\u4f8b
+
+requestinfo.label.method=\u30e1\u30bd\u30c3\u30c9\uff1a
+requestinfo.label.pathinfo=\u30d1\u30b9\u60c5\u5831\uff1a
+requestinfo.label.protocol=\u30d7\u30ed\u30c8\u30b3\u30eb\uff1a
+requestinfo.label.remoteaddr=\u30ea\u30e2\u30fc\u30c8\u30a2\u30c9\u30ec\u30b9\uff1a
+requestinfo.label.requesturi=Request URI:
+requestinfo.title=\u30ea\u30af\u30a8\u30b9\u30c8\u60c5\u5831\u4f8b
+
+requestparams.firstname=First Name:
+requestparams.lastname=Last Name:
+requestparams.no-params=\u30d1\u30e9\u30e1\u30fc\u30bf\u304c\u3042\u308a\u307e\u305b\u3093\u3002\u4f55\u304b\u5165\u529b\u3057\u3066\u304f\u3060\u3055\u3044\u3002
+requestparams.params-in-req=\u3053\u306e\u30ea\u30af\u30a8\u30b9\u30c8\u306e\u30d1\u30e9\u30e1\u30fc\u30bf\uff1a
+requestparams.title=\u30ea\u30af\u30a8\u30b9\u30c8\u30d1\u30e9\u30e1\u30fc\u30bf\u4f8b
+
+sessions.adddata=\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u30c7\u30fc\u30bf\u3092\u8ffd\u52a0\u3057\u307e\u3059
+sessions.created=\u4f5c\u6210\uff1a
+sessions.data=\u3042\u306a\u305f\u306e\u30bb\u30c3\u30b7\u30e7\u30f3\u306b\u306f\u6b21\u306e\u30c7\u30fc\u30bf\u304c\u3042\u308a\u307e\u3059\uff1a
+sessions.dataname=\u30bb\u30c3\u30b7\u30e7\u30f3\u5c5e\u6027\u540d\uff1a
+sessions.datavalue=\u30bb\u30c3\u30b7\u30e7\u30f3\u5c5e\u6027\u306e\u5024\uff1a
+sessions.id=\u30bb\u30c3\u30b7\u30e7\u30f3ID
+sessions.lastaccessed=\u6700\u7d42\u30a2\u30af\u30bb\u30b9\uff1a
+sessions.title=\u30bb\u30c3\u30b7\u30e7\u30f3\u4f8b
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_ko.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_ko.properties
new file mode 100644
index 0000000..b9c5450
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_ko.properties
@@ -0,0 +1,51 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.cookies=\uadc0\ud558\uc758 \ube0c\ub77c\uc6b0\uc800\uac00 \ub2e4\uc74c \ucfe0\ud0a4\ub4e4\uc744 \ubcf4\ub0c5\ub2c8\ub2e4.
+cookies.make-cookie=\uadc0\ud558\uc758 \ube0c\ub77c\uc6b0\uc800\uc5d0 \uc804\uc1a1\ud558\uae30 \uc704\ud55c \ucfe0\ud0a4 \uc0dd\uc131
+cookies.name=\uc774\ub984:
+cookies.no-cookies=\uadc0\ud558\uc758 \ube0c\ub77c\uc6b0\uc800\ub294 \uc5b4\ub5a4 \ucfe0\ud0a4\ub3c4 \uc804\uc1a1\ud558\uc9c0 \uc54a\uc2b5\ub2c8\ub2e4.
+cookies.set=\uadc0\ud558\ub294 \ub2e4\uc74c \ucfe0\ud0a4\ub97c, \uadc0\ud558\uc758 \ube0c\ub77c\uc6b0\uc800\uc5d0 \uc804\uc1a1\ud588\uc2b5\ub2c8\ub2e4.
+cookies.title=\ucfe0\ud0a4\ub4e4\uc758 \uc608\uc81c
+cookies.value=\uac12:
+
+helloworld.title=\uc548\ub155 \uc138\uacc4\uc5ec!
+
+requestheader.title=\uc694\uccad\uc758 \ud5e4\ub354 \uc608\uc81c
+
+requestinfo.label.method=\uba54\uc18c\ub4dc:
+requestinfo.label.pathinfo=\uacbd\ub85c \uc815\ubcf4:
+requestinfo.label.protocol=\ud504\ub85c\ud1a0\ucf5c:
+requestinfo.label.remoteaddr=\uc6d0\uaca9 \uc8fc\uc18c:
+requestinfo.label.requesturi=\uc694\uccad URI:
+requestinfo.title=\uc694\uccad \uc815\ubcf4 \uc608\uc81c
+
+requestparams.firstname=\uc774\ub984:
+requestparams.lastname=\uc131
+requestparams.no-params=\ud30c\ub77c\ubbf8\ud130\ub4e4\uc774 \uc5c6\uc2b5\ub2c8\ub2e4. \ud30c\ub77c\ubbf8\ud130\ub4e4\uc744 \uc785\ub825\ud558\uc2ed\uc2dc\uc624.
+requestparams.params-in-req=\uc774 \uc694\uccad\uc758 \ud30c\ub77c\ubbf8\ud130\ub4e4:
+requestparams.title=\uc694\uccad \ud30c\ub77c\ubbf8\ud130\ub4e4\uc758 \uc608\uc81c
+
+sessions.adddata=\uadc0\ud558\uc758 \uc138\uc158\uc5d0 \ub370\uc774\ud130\ub97c \ucd94\uac00
+sessions.created=\uc0dd\uc131\uc2dc\uac04:
+sessions.data=\uadc0\ud558\uc758 \uc138\uc158\uc5d0 \ub2e4\uc74c \ub370\uc774\ud130\uac00 \uc788\uc2b5\ub2c8\ub2e4:
+sessions.dataname=\uc138\uc158 \uc18d\uc131 \uc774\ub984:
+sessions.datavalue=\uc138\uc158 \uc18d\uc131 \uac12:
+sessions.id=\uc138\uc158 ID:
+sessions.lastaccessed=\ucd5c\uc885 \uc811\uadfc \uc2dc\uac04:
+sessions.title=\uc138\uc158\ub4e4\uc758 \uc608\uc81c
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_pt.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_pt.properties
new file mode 100644
index 0000000..e5c77b7
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_pt.properties
@@ -0,0 +1,51 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.cookies=O se browser esta a enviar os seguintes cookies:
+cookies.make-cookie=Crie um cookie para enviar para o seu browser
+cookies.name=Nome:
+cookies.no-cookies=O seu browser nao esta a enviar nenhuns cookies
+cookies.set=Acabou de enviar o seguinte cookie para o seu browser:
+cookies.title=CExamplo de Cookies
+cookies.value=Valor:
+
+helloworld.title=Ola Mundo!
+
+requestheader.title=Exemplo da Cebeceira do Pedido
+
+requestinfo.label.method=Metodo:
+requestinfo.label.pathinfo=Informacao do Caminho:
+requestinfo.label.protocol=Protocolo:
+requestinfo.label.remoteaddr=Endereco Remoto:
+requestinfo.label.requesturi=URI do Pedido:
+requestinfo.title=Exemplo da Informacao do Pedido
+
+requestparams.firstname=Primeiro Nome:
+requestparams.lastname=Apelido:
+requestparams.no-params=Sem Parametros, Por favor entre alguns
+requestparams.params-in-req=Parametros neste pedido:
+requestparams.title=Examplo de Parametros do Pedido
+
+sessions.adddata=Adicione data a sua sessao
+sessions.created=Criada:
+sessions.data=Os seguintes dados fazem parte da sua sessao:
+sessions.dataname=Nome do atributo da sessao:
+sessions.datavalue=Valor do atributo da Sessao:
+sessions.id=Identificador da Sessao:
+sessions.lastaccessed=Ultima vez acedida:
+sessions.title=Examplo de sessoes
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_pt_BR.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_pt_BR.properties
new file mode 100644
index 0000000..65ddc51
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_pt_BR.properties
@@ -0,0 +1,19 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+requestparams.title=Exemplo de Par\u00e2metros de Requisi\u00e7\u00e3o
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_ru.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_ru.properties
new file mode 100644
index 0000000..9b4fe6b
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_ru.properties
@@ -0,0 +1,50 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.cookies=\u0412\u0430\u0448 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u043a\u0443\u043a\u0438:
+cookies.make-cookie=\u0421\u043e\u0437\u0434\u0430\u0439\u0442\u0435 \u043a\u0443\u043a\u0443 \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0432 \u0432\u0430\u0448 \u0431\u0440\u0430\u0443\u0437\u0435\u0440
+cookies.name=\u0418\u043c\u044f:
+cookies.no-cookies=\u0412\u0430\u0448 \u0431\u0440\u0430\u0443\u0437\u0435\u0440 \u043d\u0435 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u043d\u0438\u043a\u0430\u043a\u0438\u0445 \u043a\u0443\u043a.
+cookies.set=\u0412\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0442\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u043b\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0443\u044e \u043a\u0443\u043a\u0443 \u0432 \u0432\u0430\u0448 \u0431\u0440\u0430\u0443\u0437\u0435\u0440:
+cookies.value=\u0417\u043d\u0430\u0447\u0435\u043d\u0438\u0435:
+
+helloworld.title=Hello World!
+
+requestheader.title=\u041f\u0440\u0438\u043c\u0435\u0440 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u0430
+
+requestinfo.label.method=\u041c\u0435\u0442\u043e\u0434:
+requestinfo.label.pathinfo=\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043f\u0443\u0442\u0438:
+requestinfo.label.protocol=\u041f\u0440\u043e\u0442\u043e\u043a\u043e\u043b:
+requestinfo.label.remoteaddr=\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0439 \u0430\u0434\u0440\u0435\u0441:
+requestinfo.label.requesturi=URI \u0437\u0430\u043f\u0440\u043e\u0441\u0430:
+requestinfo.title=\u041f\u0440\u0438\u043c\u0435\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e \u0437\u0430\u043f\u0440\u043e\u0441\u0435
+
+requestparams.firstname=\u0418\u043c\u044f:
+requestparams.lastname=\u0424\u0430\u043c\u0438\u043b\u0438\u044f:
+requestparams.no-params=\u041d\u0435\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432, \u041f\u043e\u0436\u0430\u043b\u0443\u0439\u0441\u0442\u0430 \u0434\u043e\u0431\u0430\u0432\u044c\u0442\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e
+requestparams.params-in-req=\u041f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0432 \u044d\u0442\u043e\u043c \u0437\u0430\u043f\u0440\u043e\u0441\u0435:
+requestparams.title=\u041f\u0440\u0438\u043c\u0435\u0440 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0437\u0430\u043f\u0440\u043e\u0441\u0430
+
+sessions.adddata=\u0414\u043e\u0431\u0430\u0432\u044c\u0442\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0432 \u0432\u0430\u0448\u0443 \u0441\u0435\u0441\u0441\u0438\u044e
+sessions.created=\u0421\u043e\u0437\u0434\u0430\u043d\u043e:
+sessions.data=\u0412 \u0432\u0430\u0448\u0435\u0439 \u0441\u0435\u0441\u0441\u0438\u0438 \u043d\u0430\u0445\u043e\u0434\u044f\u0442\u0441\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0435:
+sessions.dataname=\u0418\u043c\u044f \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 \u0441\u0435\u0441\u0441\u0438\u0438:
+sessions.datavalue=\u0417\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0430\u0442\u0440\u0438\u0431\u0443\u0442\u0430 \u0441\u0435\u0441\u0441\u0438\u0438:
+sessions.id=ID \u0421\u0435\u0441\u0441\u0438\u0438:
+sessions.lastaccessed=\u041f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0435 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0435:
+sessions.title=\u041f\u0440\u0438\u043c\u0435\u0440 \u0441\u0435\u0441\u0441\u0438\u0439
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_zh_CN.properties b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_zh_CN.properties
new file mode 100644
index 0000000..c8eee82
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/LocalStrings_zh_CN.properties
@@ -0,0 +1,51 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Do not edit this file directly.
+# To edit translations see: https://tomcat.apache.org/getinvolved.html#Translations
+
+cookies.cookies=\u4f60\u7684\u6d4f\u89c8\u5668\u6b63\u5728\u53d1\u9001\u4e0b\u9762\u7684cookie\uff1a
+cookies.make-cookie=\u521b\u5efa\u4e00\u4e2a\u53d1\u9001\u5230\u4f60\u7684\u6d4f\u89c8\u5668\u7684cookie
+cookies.name=\u540d.\u79f0:
+cookies.no-cookies=\u4f60\u7684\u6d4f\u89c8\u5668\u672a\u53d1\u9001\u4efb\u4f55cookie
+cookies.set=\u4f60\u521a\u521a\u5c06\u4ee5\u4e0bcookie\u53d1\u9001\u5230\u4f60\u7684\u6d4f\u89c8\u5668\uff1a
+cookies.title=cookie\u793a\u4f8b
+cookies.value=\u503c\uff1a
+
+helloworld.title=\u4f60\u597d\uff0c\u4e16\u754c.
+
+requestheader.title=\u8bf7\u6c42 Header \u793a\u4f8b
+
+requestinfo.label.method=\u65b9\u6cd5\uff1a
+requestinfo.label.pathinfo=\u8def\u5f84\u4fe1\u606f\uff1a
+requestinfo.label.protocol=\u534f\u8bae\uff1a
+requestinfo.label.remoteaddr=\u8fdc\u7a0b\u5730\u5740\uff1a
+requestinfo.label.requesturi=\u8bf7\u6c42 URI (:
+requestinfo.title=\u8bf7\u6c42\u4fe1\u606f\u8303\u4f8b
+
+requestparams.firstname=\u59d3\uff1a
+requestparams.lastname=\u59d3\u6c0f\uff1a
+requestparams.no-params=\u6ca1\u6709\u53c2\u6570\uff0c\u8bf7\u8f93\u5165\u4e00\u4e9b
+requestparams.params-in-req=\u53c2\u6570\u5728\u8bf7\u6c42\u4e2d.
+requestparams.title=\u8bf7\u6c42\u53c2\u6570\u793a\u4f8b
+
+sessions.adddata=\u5c06\u6570\u636e\u6dfb\u52a0\u5230\u4f60\u7684\u4f1a\u8bdd\u4e2d
+sessions.created=\u5df2\u521b\u5efa\u7684\uff1a
+sessions.data=\u4ee5\u4e0b\u6570\u636e\u5728\u60a8\u7684\u4f1a\u8bdd\u4e2d\uff1a
+sessions.dataname=\u4f1a\u8bdd\u5c5e\u6027\u540d\uff1a
+sessions.datavalue=\u4f1a\u8bdd\u5c5e\u6027\u503c\uff1a
+sessions.id=\u4f1a\u8bddID\uff1a
+sessions.lastaccessed=\u6700\u540e\u8bbf\u95ee\uff1a
+sessions.title=\u4f1a\u8bdd.\u793a\u4f8b
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestHeaderExample.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestHeaderExample.class
new file mode 100644
index 0000000..a975f69
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestHeaderExample.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestHeaderExample.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestHeaderExample.java
new file mode 100644
index 0000000..b324e02
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestHeaderExample.java
@@ -0,0 +1,170 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.Enumeration;
+import java.util.Locale;
+import java.util.ResourceBundle;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
+import org.apache.tomcat.util.json.JSONFilter;
+
+import util.CookieFilter;
+import util.HTMLFilter;
+
+/**
+ * Example servlet showing request headers
+ *
+ * @author James Duncan Davidson <duncan@eng.sun.com>
+ */
+public class RequestHeaderExample extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        if (prefersJSON(request.getHeader("Accept"))) {
+            renderJSON(request, response);
+        } else {
+            renderHTML(request, response);
+        }
+    }
+
+    /**
+     * Returns true if the client appears to prefer a JSON response, false otherwise. Note that this method is not very
+     * pedantic and uses only a very lazy algorithm for checking whether JSON is "preferred".
+     *
+     * @param acceptHeader The value of the HTTP "Accept" header from the client.
+     *
+     * @return true if the client appears to prefer a JSON response, false otherwise.
+     */
+    protected boolean prefersJSON(String acceptHeader) {
+        if (null == acceptHeader) {
+            return false;
+        }
+        // mime/type, mime/type;q=n, ...
+
+        // Don't bother with the q-factor.
+        // This is not expected to be 100% accurate or spec-compliant
+        String[] accepts = acceptHeader.split(",");
+        for (String accept : accepts) {
+            if (accept.contains("application/json")) {
+                return true;
+            }
+
+            // text/html, application/html, etc.
+            if (accept.contains("html")) {
+                return false;
+            }
+        }
+        return false;
+    }
+
+    protected void renderHTML(HttpServletRequest request, HttpServletResponse response) throws IOException {
+        ResourceBundle rb = ResourceBundle.getBundle("LocalStrings", request.getLocale());
+
+        response.setContentType("text/html");
+        response.setCharacterEncoding("UTF-8");
+
+        PrintWriter out = response.getWriter();
+        out.println("");
+        out.println("");
+        out.println("");
+
+        String title = rb.getString("requestheader.title");
+        out.println("" + title + "");
+        out.println("");
+        out.println("");
+
+        out.println("");
+        out.println(
+                "");
+        out.println("");
+        out.println(
+                "");
+
+        out.println("" + title + "");
+        out.println("");
+        Enumeration e = request.getHeaderNames();
+        while (e.hasMoreElements()) {
+            String headerName = e.nextElement();
+            String headerValue = request.getHeader(headerName);
+            out.println("");
+        }
+        out.println("");
+            out.println(HTMLFilter.filter(headerName));
+            out.println(" ");
+            if (headerName.toLowerCase(Locale.ENGLISH).contains("cookie")) {
+                HttpSession session = request.getSession(false);
+                String sessionId = null;
+                if (session != null) {
+                    sessionId = session.getId();
+                }
+                out.println(HTMLFilter.filter(CookieFilter.filter(headerValue, sessionId)));
+            } else {
+                out.println(HTMLFilter.filter(headerValue));
+            }
+            out.println("");
+    }
+
+    protected void renderJSON(HttpServletRequest request, HttpServletResponse response) throws IOException {
+        response.setContentType("application/json");
+        response.setCharacterEncoding("UTF-8");
+
+        PrintWriter out = response.getWriter();
+
+        out.append('[');
+        Enumeration e = request.getHeaderNames();
+        while (e.hasMoreElements()) {
+            String headerName = e.nextElement();
+            String headerValue = request.getHeader(headerName);
+
+            out.append("{\"").append(JSONFilter.escape(headerName)).append("\":\"");
+
+
+            if (headerName.toLowerCase(Locale.ENGLISH).contains("cookie")) {
+                HttpSession session = request.getSession(false);
+                String sessionId = null;
+                if (session != null) {
+                    sessionId = session.getId();
+                }
+                out.append(JSONFilter.escape(CookieFilter.filter(headerValue, sessionId)));
+            } else {
+                out.append(JSONFilter.escape(headerValue));
+            }
+            out.append("\"}");
+
+            if (e.hasMoreElements()) {
+                out.append(',');
+            }
+        }
+
+        out.print("]");
+    }
+
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        doGet(request, response);
+    }
+
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestInfoExample.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestInfoExample.class
new file mode 100644
index 0000000..621b907
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestInfoExample.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestInfoExample.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestInfoExample.java
new file mode 100644
index 0000000..1538f5b
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestInfoExample.java
@@ -0,0 +1,110 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.ResourceBundle;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import util.HTMLFilter;
+
+/**
+ * Example servlet showing request information.
+ *
+ * @author James Duncan Davidson <duncan@eng.sun.com>
+ */
+
+public class RequestInfoExample extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        ResourceBundle rb = ResourceBundle.getBundle("LocalStrings", request.getLocale());
+
+        response.setContentType("text/html");
+        response.setCharacterEncoding("UTF-8");
+
+        PrintWriter out = response.getWriter();
+        out.println("");
+        out.println("");
+        out.println("");
+
+        String title = rb.getString("requestinfo.title");
+        out.println("" + title + "");
+        out.println("");
+        out.println("");
+
+        /*
+         * Can't use relative paths since this servlet might have pathInfo. Allows for deployment to a different context
+         * path but otherwise assumes that the web application structure is not changed.
+         */
+        String baseURI = request.getServletContext().getContextPath() + "/servlets";
+
+        out.println("");
+        out.println("");
+        out.println("");
+        out.println("");
+
+        out.println("" + title + "");
+        out.println("");
+
+        String cipherSuite = (String) request.getAttribute("javax.servlet.request.cipher_suite");
+        if (cipherSuite != null) {
+            out.println("");
+        }
+
+        out.println("");
+        out.println(rb.getString("requestinfo.label.method"));
+        out.println(" ");
+        out.println(HTMLFilter.filter(request.getMethod()));
+        out.println("
");
+        out.println(rb.getString("requestinfo.label.requesturi"));
+        out.println(" ");
+        out.println(HTMLFilter.filter(request.getRequestURI()));
+        out.println("
");
+        out.println(rb.getString("requestinfo.label.protocol"));
+        out.println(" ");
+        out.println(HTMLFilter.filter(request.getProtocol()));
+        out.println("
");
+        out.println(rb.getString("requestinfo.label.pathinfo"));
+        out.println(" ");
+        out.println(HTMLFilter.filter(request.getPathInfo()));
+        out.println("
");
+        out.println(rb.getString("requestinfo.label.remoteaddr"));
+        out.println(" ");
+        out.println(HTMLFilter.filter(request.getRemoteAddr()));
+        out.println("
");
+            out.println("SSLCipherSuite:");
+            out.println(" ");
+            out.println(HTMLFilter.filter(cipherSuite));
+            out.println("");
+    }
+
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        doGet(request, response);
+    }
+
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestParamExample.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestParamExample.class
new file mode 100644
index 0000000..214cc99
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestParamExample.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestParamExample.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestParamExample.java
new file mode 100644
index 0000000..ac27ed4
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/RequestParamExample.java
@@ -0,0 +1,96 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.ResourceBundle;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import util.HTMLFilter;
+
+/**
+ * Example servlet showing request headers
+ *
+ * @author James Duncan Davidson <duncan@eng.sun.com>
+ */
+
+public class RequestParamExample extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        ResourceBundle rb = ResourceBundle.getBundle("LocalStrings", request.getLocale());
+
+        response.setContentType("text/html");
+        response.setCharacterEncoding("UTF-8");
+
+        PrintWriter out = response.getWriter();
+        out.println("");
+        out.println("");
+        out.println("");
+
+        String title = rb.getString("requestparams.title");
+        out.println("" + title + "");
+        out.println("");
+        out.println("");
+
+        out.println("");
+        out.println(
+                "");
+        out.println("");
+        out.println(
+                "");
+
+        out.println("" + title + "");
+        String firstName = request.getParameter("firstname");
+        String lastName = request.getParameter("lastname");
+        out.println(rb.getString("requestparams.params-in-req") + "
");
+        if (firstName != null || lastName != null) {
+            out.println(rb.getString("requestparams.firstname"));
+            out.println(" = " + HTMLFilter.filter(firstName) + "
");
+            out.println(rb.getString("requestparams.lastname"));
+            out.println(" = " + HTMLFilter.filter(lastName));
+        } else {
+            out.println(rb.getString("requestparams.no-params"));
+        }
+        out.println("");
+        out.print("
");
+        out.println(rb.getString("requestparams.firstname"));
+        out.println("");
+        out.println("
");
+        out.println(rb.getString("requestparams.lastname"));
+        out.println("");
+        out.println("
");
+        out.println("");
+        out.println("");
+
+        out.println("");
+        out.println("");
+    }
+
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        doGet(request, response);
+    }
+
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/ServletToJsp.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/ServletToJsp.class
new file mode 100644
index 0000000..ff6eaae
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/ServletToJsp.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/ServletToJsp.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/ServletToJsp.java
new file mode 100644
index 0000000..e83bbf3
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/ServletToJsp.java
@@ -0,0 +1,38 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class ServletToJsp extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response) {
+
+        try {
+            // Set the attribute and Forward to hello.jsp
+            request.setAttribute("servletName", "servletToJsp");
+            getServletConfig().getServletContext().getRequestDispatcher("/jsp/jsptoserv/hello.jsp").forward(request,
+                    response);
+        } catch (Exception ex) {
+            ex.printStackTrace();
+        }
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/SessionExample.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/SessionExample.class
new file mode 100644
index 0000000..c9d9a39
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/SessionExample.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/SessionExample.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/SessionExample.java
new file mode 100644
index 0000000..14e7c97
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/SessionExample.java
@@ -0,0 +1,165 @@
+
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.net.URLEncoder;
+import java.util.Date;
+import java.util.Enumeration;
+import java.util.ResourceBundle;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
+import util.HTMLFilter;
+
+/**
+ * Example servlet showing request headers
+ *
+ * @author James Duncan Davidson <duncan@eng.sun.com>
+ */
+
+public class SessionExample extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    private static final int SESSION_ATTRIBUTE_COUNT_LIMIT = 10;
+
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        ResourceBundle rb = ResourceBundle.getBundle("LocalStrings", request.getLocale());
+
+        response.setContentType("text/html");
+        response.setCharacterEncoding("UTF-8");
+
+        PrintWriter out = response.getWriter();
+        out.println("");
+        out.println("");
+        out.println("");
+
+
+        String title = rb.getString("sessions.title");
+        out.println("" + title + "");
+        out.println("");
+        out.println("");
+
+        out.println("");
+        out.println(
+                "");
+        out.println("");
+        out.println(
+                "");
+
+        out.println("" + title + "");
+
+        HttpSession session = request.getSession(true);
+        out.println(rb.getString("sessions.id") + " " + session.getId());
+        out.println("
");
+        out.println(rb.getString("sessions.created") + " ");
+        out.println(new Date(session.getCreationTime()) + "
");
+        out.println(rb.getString("sessions.lastaccessed") + " ");
+        out.println(new Date(session.getLastAccessedTime()));
+
+        // Count the existing attributes
+        int sessionAttributeCount = 0;
+        Enumeration names = session.getAttributeNames();
+        while (names.hasMoreElements()) {
+            names.nextElement();
+            sessionAttributeCount++;
+        }
+
+        String dataName = request.getParameter("dataname");
+        String dataValue = request.getParameter("datavalue");
+        if (dataName != null) {
+            if (dataValue == null) {
+                session.removeAttribute(dataName);
+                sessionAttributeCount--;
+            } else if (sessionAttributeCount < SESSION_ATTRIBUTE_COUNT_LIMIT) {
+                session.setAttribute(dataName, dataValue);
+                sessionAttributeCount++;
+            } else {
+                out.print(" Session attribute [");
+                out.print(HTMLFilter.filter(dataName));
+                out.print("] not added as there are already "+ SESSION_ATTRIBUTE_COUNT_LIMIT + " attributes in the ");
+                out.println("session. Delete an attribute before adding another.");
+            }
+        }
+
+        out.println("
");
+        out.println(rb.getString("sessions.data") + "
");
+        names = session.getAttributeNames();
+        while (names.hasMoreElements()) {
+            String name = names.nextElement();
+            String value = session.getAttribute(name).toString();
+            out.println(HTMLFilter.filter(name) + " = " + HTMLFilter.filter(value));
+            out.print("delete");
+            out.println("
");
+        }
+
+        if (sessionAttributeCount < SESSION_ATTRIBUTE_COUNT_LIMIT) {
+            out.println("
");
+            out.print("
");
+            out.println(rb.getString("sessions.dataname"));
+            out.println("");
+            out.println("
");
+            out.println(rb.getString("sessions.datavalue"));
+            out.println("");
+            out.println("
");
+            out.println("");
+            out.println("");
+
+            out.println("GET based form:
");
+            out.print("
");
+            out.println(rb.getString("sessions.dataname"));
+            out.println("");
+            out.println("
");
+            out.println(rb.getString("sessions.datavalue"));
+            out.println("");
+            out.println("
");
+            out.println("");
+            out.println("");
+
+            out.print("URL encoded ");
+        } else {
+            out.print("
You may not add more than " + SESSION_ATTRIBUTE_COUNT_LIMIT + " attributes to this session.");
+        }
+
+        out.println("");
+        out.println("");
+    }
+
+    @Override
+    public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
+        doGet(request, response);
+    }
+
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async0$1.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async0$1.class
new file mode 100644
index 0000000..9b58b7c
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async0$1.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async0.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async0.class
new file mode 100644
index 0000000..0f17ef9
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async0.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async0.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async0.java
new file mode 100644
index 0000000..83bd22a
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async0.java
@@ -0,0 +1,69 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package async;
+
+import java.io.IOException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+
+import javax.servlet.AsyncContext;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+
+public class Async0 extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    private static final Log log = LogFactory.getLog(Async0.class);
+
+    @Override
+    protected void service(final HttpServletRequest req, final HttpServletResponse resp) throws ServletException, IOException {
+        if (Boolean.TRUE.equals(req.getAttribute("dispatch"))) {
+            log.info("Received dispatch, completing on the worker thread.");
+            log.info("After complete called started:"+req.isAsyncStarted());
+            Date date = new Date(System.currentTimeMillis());
+            SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss Z");
+            resp.getWriter().write("Async dispatch worked: " + sdf.format(date) + "\n");
+        } else {
+            resp.setContentType("text/plain");
+            final AsyncContext actx = req.startAsync();
+            actx.setTimeout(Long.MAX_VALUE);
+            Runnable run = new Runnable() {
+                @Override
+                public void run() {
+                    try {
+                        req.setAttribute("dispatch", Boolean.TRUE);
+                        Thread.currentThread().setName("Async0-Thread");
+                        log.info("Putting AsyncThread to sleep");
+                        Thread.sleep(2*1000);
+                        log.info("Dispatching");
+                        actx.dispatch();
+                    }catch (InterruptedException | IllegalStateException x) {
+                        log.error("Async1",x);
+                    }
+                }
+            };
+            Thread t = new Thread(run);
+            t.start();
+        }
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async1$1.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async1$1.class
new file mode 100644
index 0000000..f680072
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async1$1.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async1.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async1.class
new file mode 100644
index 0000000..356fbb9
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async1.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async1.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async1.java
new file mode 100644
index 0000000..ad8b1ef
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async1.java
@@ -0,0 +1,60 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package async;
+
+import java.io.IOException;
+
+import javax.servlet.AsyncContext;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+
+public class Async1 extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    private static final Log log = LogFactory.getLog(Async1.class);
+
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        final AsyncContext actx = req.startAsync();
+        actx.setTimeout(30*1000);
+        Runnable run = new Runnable() {
+            @Override
+            public void run() {
+                try {
+                    String path = "/jsp/async/async1.jsp";
+                    Thread.currentThread().setName("Async1-Thread");
+                    log.info("Putting AsyncThread to sleep");
+                    Thread.sleep(2*1000);
+                    log.info("Dispatching to "+path);
+                    actx.dispatch(path);
+                }catch (InterruptedException | IllegalStateException x) {
+                    log.error("Async1",x);
+                }
+            }
+        };
+        Thread t = new Thread(run);
+        t.start();
+    }
+
+
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async2$1.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async2$1.class
new file mode 100644
index 0000000..4ed8108
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async2$1.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async2.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async2.class
new file mode 100644
index 0000000..2f6aaa4
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async2.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async2.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async2.java
new file mode 100644
index 0000000..c88c21e
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async2.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package async;
+
+import java.io.IOException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+
+import javax.servlet.AsyncContext;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+
+public class Async2 extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    private static final Log log = LogFactory.getLog(Async2.class);
+
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp)
+            throws ServletException, IOException {
+        final AsyncContext actx = req.startAsync();
+        actx.setTimeout(30*1000);
+        Runnable run = new Runnable() {
+            @Override
+            public void run() {
+                try {
+                    Thread.currentThread().setName("Async2-Thread");
+                    log.info("Putting AsyncThread to sleep");
+                    Thread.sleep(2*1000);
+                    log.info("Writing data.");
+                    Date date = new Date(System.currentTimeMillis());
+                    SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss Z");
+                    actx.getResponse().getWriter().write(
+                            "Output from background thread. Time: " + sdf.format(date) + "\n");
+                    actx.complete();
+                }catch (InterruptedException | IllegalStateException | IOException x) {
+                    log.error("Async2",x);
+                }
+            }
+        };
+        Thread t = new Thread(run);
+        t.start();
+    }
+
+
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async3.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async3.class
new file mode 100644
index 0000000..f3ae6c3
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async3.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async3.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async3.java
new file mode 100644
index 0000000..70dc56f
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Async3.java
@@ -0,0 +1,39 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package async;
+
+import java.io.IOException;
+
+import javax.servlet.AsyncContext;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+public class Async3 extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
+        final AsyncContext actx = req.startAsync();
+        actx.setTimeout(30*1000);
+        actx.dispatch("/jsp/async/async3.jsp");
+    }
+
+
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockContextListener.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockContextListener.class
new file mode 100644
index 0000000..fadc6d3
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockContextListener.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockContextListener.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockContextListener.java
new file mode 100644
index 0000000..685ac23
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockContextListener.java
@@ -0,0 +1,44 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one or more
+ *  contributor license agreements.  See the NOTICE file distributed with
+ *  this work for additional information regarding copyright ownership.
+ *  The ASF licenses this file to You under the Apache License, Version 2.0
+ *  (the "License"); you may not use this file except in compliance with
+ *  the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package async;
+
+import javax.servlet.ServletContext;
+import javax.servlet.ServletContextEvent;
+import javax.servlet.ServletContextListener;
+
+/*
+ * Ensures the Stockticker is shut down cleanly when the context stops. This
+ * also covers the case when the server shuts down.
+ */
+public class AsyncStockContextListener implements ServletContextListener {
+
+    public static final String STOCK_TICKER_KEY = "StockTicker";
+
+    @Override
+    public void contextInitialized(ServletContextEvent sce) {
+        Stockticker stockticker = new Stockticker();
+        ServletContext sc = sce.getServletContext();
+        sc.setAttribute(STOCK_TICKER_KEY, stockticker);
+    }
+
+    @Override
+    public void contextDestroyed(ServletContextEvent sce) {
+        ServletContext sc = sce.getServletContext();
+        Stockticker stockticker = (Stockticker) sc.getAttribute(STOCK_TICKER_KEY);
+        stockticker.shutdown();
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.class
new file mode 100644
index 0000000..585a4b7
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.java
new file mode 100644
index 0000000..0ae07ac
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/AsyncStockServlet.java
@@ -0,0 +1,144 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one or more
+ *  contributor license agreements.  See the NOTICE file distributed with
+ *  this work for additional information regarding copyright ownership.
+ *  The ASF licenses this file to You under the Apache License, Version 2.0
+ *  (the "License"); you may not use this file except in compliance with
+ *  the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package async;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.util.concurrent.ConcurrentLinkedQueue;
+import java.util.concurrent.atomic.AtomicInteger;
+
+import javax.servlet.AsyncContext;
+import javax.servlet.AsyncEvent;
+import javax.servlet.AsyncListener;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.juli.logging.Log;
+import org.apache.juli.logging.LogFactory;
+
+import async.Stockticker.Stock;
+import async.Stockticker.TickListener;
+
+public class AsyncStockServlet extends HttpServlet implements TickListener, AsyncListener{
+
+    private static final long serialVersionUID = 1L;
+
+    private static final Log log = LogFactory.getLog(AsyncStockServlet.class);
+
+    private static final ConcurrentLinkedQueue clients =
+            new ConcurrentLinkedQueue<>();
+    private static final AtomicInteger clientcount = new AtomicInteger(0);
+
+    public AsyncStockServlet() {
+        log.info("AsyncStockServlet created");
+    }
+
+
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp)
+            throws ServletException, IOException {
+        if (req.isAsyncStarted()) {
+            req.getAsyncContext().complete();
+        } else if (req.isAsyncSupported()) {
+            AsyncContext actx = req.startAsync();
+            actx.addListener(this);
+            resp.setContentType("text/plain");
+            clients.add(actx);
+            if (clientcount.incrementAndGet()==1) {
+                Stockticker ticker = (Stockticker) req.getServletContext().getAttribute(
+                        AsyncStockContextListener.STOCK_TICKER_KEY);
+                ticker.addTickListener(this);
+            }
+        } else {
+            new Exception("Async Not Supported").printStackTrace();
+            resp.sendError(400,"Async is not supported.");
+        }
+    }
+
+
+    @Override
+    public void tick(Stock stock) {
+        for (AsyncContext actx : clients) {
+            try {
+                writeStock(actx, stock);
+            } catch (Exception e) {
+                // Ignore. The async error handling will deal with this.
+            }
+        }
+    }
+
+
+    public void writeStock(AsyncContext actx, Stock stock) throws IOException {
+        HttpServletResponse response = (HttpServletResponse)actx.getResponse();
+        PrintWriter writer = response.getWriter();
+        writer.write("STOCK#");//make client parsing easier
+        writer.write(stock.getSymbol());
+        writer.write("#");
+        writer.write(stock.getValueAsString());
+        writer.write("#");
+        writer.write(stock.getLastChangeAsString());
+        writer.write("#");
+        writer.write(String.valueOf(stock.getCnt()));
+        writer.write("\n");
+        writer.flush();
+        response.flushBuffer();
+    }
+
+
+    @Override
+    public void shutdown() {
+        // The web application is shutting down. Complete any AsyncContexts
+        // associated with an active client.
+        for (AsyncContext actx : clients) {
+            try {
+                actx.complete();
+            } catch (Exception e) {
+                // Ignore. The async error handling will deal with this.
+            }
+        }
+    }
+
+
+    @Override
+    public void onComplete(AsyncEvent event) throws IOException {
+        if (clients.remove(event.getAsyncContext()) && clientcount.decrementAndGet()==0) {
+            ServletContext sc = event.getAsyncContext().getRequest().getServletContext();
+            Stockticker ticker = (Stockticker) sc.getAttribute(
+                    AsyncStockContextListener.STOCK_TICKER_KEY);
+            ticker.removeTickListener(this);
+        }
+    }
+
+    @Override
+    public void onError(AsyncEvent event) throws IOException {
+        event.getAsyncContext().complete();
+    }
+
+    @Override
+    public void onTimeout(AsyncEvent event) throws IOException {
+        event.getAsyncContext().complete();
+    }
+
+
+    @Override
+    public void onStartAsync(AsyncEvent event) throws IOException {
+        // NOOP
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker$Stock.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker$Stock.class
new file mode 100644
index 0000000..c2de521
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker$Stock.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker$TickListener.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker$TickListener.class
new file mode 100644
index 0000000..22ca3fc
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker$TickListener.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker.class
new file mode 100644
index 0000000..0fc88ab
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker.java
new file mode 100644
index 0000000..905dfe2
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/async/Stockticker.java
@@ -0,0 +1,212 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one or more
+ *  contributor license agreements.  See the NOTICE file distributed with
+ *  this work for additional information regarding copyright ownership.
+ *  The ASF licenses this file to You under the Apache License, Version 2.0
+ *  (the "License"); you may not use this file except in compliance with
+ *  the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package async;
+
+import java.text.DecimalFormat;
+import java.util.List;
+import java.util.Random;
+import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.atomic.AtomicInteger;
+
+public class Stockticker implements Runnable {
+        public volatile boolean run = true;
+        protected final AtomicInteger counter = new AtomicInteger(0);
+        final List listeners = new CopyOnWriteArrayList<>();
+        protected volatile Thread ticker = null;
+        protected volatile int ticknr = 0;
+
+        public synchronized void start() {
+            run = true;
+            ticker = new Thread(this);
+            ticker.setName("Ticker Thread");
+            ticker.start();
+        }
+
+        public synchronized void stop() {
+            // On context stop this can be called multiple times.
+            // NO-OP if the ticker thread is not set
+            // (i.e. stop() has already completed)
+            if (ticker == null) {
+                return;
+            }
+            run = false;
+            try {
+                ticker.join();
+            }catch (InterruptedException x) {
+                Thread.interrupted();
+            }
+
+            ticker = null;
+        }
+
+        public void shutdown() {
+            // Notify each listener of the shutdown. This enables them to
+            // trigger any necessary clean-up.
+            for (TickListener l : listeners) {
+                l.shutdown();
+            }
+            // Wait for the thread to stop. This prevents warnings in the logs
+            // that the thread is still active when the context stops.
+            stop();
+        }
+
+        public void addTickListener(TickListener listener) {
+            if (listeners.add(listener)) {
+                if (counter.incrementAndGet()==1) {
+                    start();
+                }
+            }
+
+        }
+
+        public void removeTickListener(TickListener listener) {
+            if (listeners.remove(listener)) {
+                if (counter.decrementAndGet()==0) {
+                    stop();
+                }
+            }
+        }
+
+        @Override
+        public void run() {
+            try {
+
+                Stock[] stocks = new Stock[] { new Stock("GOOG", 435.43),
+                        new Stock("YHOO", 27.88), new Stock("ASF", 1015.55), };
+                Random r = new Random(System.currentTimeMillis());
+                while (run) {
+                    for (int j = 0; j < 1; j++) {
+                        int i = r.nextInt() % 3;
+                        if (i < 0) {
+                            i = i * (-1);
+                        }
+                        Stock stock = stocks[i];
+                        double change = r.nextDouble();
+                        boolean plus = r.nextBoolean();
+                        if (plus) {
+                            stock.setValue(stock.getValue() + change);
+                        } else {
+                            stock.setValue(stock.getValue() - change);
+                        }
+                        stock.setCnt(++ticknr);
+                        for (TickListener l : listeners) {
+                            l.tick(stock);
+                        }
+
+                    }
+                    Thread.sleep(850);
+                }
+            } catch (InterruptedException ix) {
+                // Ignore
+            } catch (Exception x) {
+                x.printStackTrace();
+            }
+        }
+
+
+    public interface TickListener {
+        void tick(Stock stock);
+        void shutdown();
+    }
+
+    public static final class Stock implements Cloneable {
+        protected static final DecimalFormat df = new DecimalFormat("0.00");
+        protected final String symbol;
+        protected double value = 0.0d;
+        protected double lastchange = 0.0d;
+        protected int cnt = 0;
+
+        public Stock(String symbol, double initvalue) {
+            this.symbol = symbol;
+            this.value = initvalue;
+        }
+
+        public void setCnt(int c) {
+            this.cnt = c;
+        }
+
+        public int getCnt() {
+            return cnt;
+        }
+
+        public String getSymbol() {
+            return symbol;
+        }
+
+        public double getValue() {
+            return value;
+        }
+
+        public void setValue(double value) {
+            double old = this.value;
+            this.value = value;
+            this.lastchange = value - old;
+        }
+
+        public String getValueAsString() {
+            return df.format(value);
+        }
+
+        public double getLastChange() {
+            return this.lastchange;
+        }
+
+        public void setLastChange(double lastchange) {
+            this.lastchange = lastchange;
+        }
+
+        public String getLastChangeAsString() {
+            return df.format(lastchange);
+        }
+
+        @Override
+        public int hashCode() {
+            return symbol.hashCode();
+        }
+
+        @Override
+        public boolean equals(Object other) {
+            if (other instanceof Stock) {
+                return this.symbol.equals(((Stock) other).symbol);
+            }
+
+            return false;
+        }
+
+        @Override
+        public String toString() {
+            StringBuilder buf = new StringBuilder("STOCK#");
+            buf.append(getSymbol());
+            buf.append('#');
+            buf.append(getValueAsString());
+            buf.append('#');
+            buf.append(getLastChangeAsString());
+            buf.append('#');
+            buf.append(String.valueOf(getCnt()));
+            return buf.toString();
+
+        }
+
+        @Override
+        public Object clone() {
+            Stock s = new Stock(this.getSymbol(), this.getValue());
+            s.setLastChange(this.getLastChange());
+            s.setCnt(this.cnt);
+            return s;
+        }
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/checkbox/CheckTest.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/checkbox/CheckTest.class
new file mode 100644
index 0000000..9234999
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/checkbox/CheckTest.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/checkbox/CheckTest.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/checkbox/CheckTest.java
new file mode 100644
index 0000000..a19caf0
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/checkbox/CheckTest.java
@@ -0,0 +1,30 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package checkbox;
+
+public class CheckTest {
+
+    String b[] = new String[] { "1", "2", "3", "4" };
+
+    public String[] getFruit() {
+        return b;
+    }
+
+    public void setFruit(String [] b) {
+        this.b = b;
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/colors/ColorGameBean.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/colors/ColorGameBean.class
new file mode 100644
index 0000000..15bd974
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/colors/ColorGameBean.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/colors/ColorGameBean.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/colors/ColorGameBean.java
new file mode 100644
index 0000000..37df405
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/colors/ColorGameBean.java
@@ -0,0 +1,114 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package colors;
+
+public class ColorGameBean {
+
+    private String background = "yellow";
+    private String foreground = "red";
+    private String color1 = foreground;
+    private String color2 = background;
+    private String hint = "no";
+    private int attempts = 0;
+        private int intval = 0;
+    private boolean tookHints = false;
+
+    public void processRequest() {
+
+        // background = "yellow";
+        // foreground = "red";
+
+        if (! color1.equals(foreground)) {
+            if (color1.equalsIgnoreCase("black") ||
+                        color1.equalsIgnoreCase("cyan")) {
+                        background = color1;
+                }
+        }
+
+        if (! color2.equals(background)) {
+            if (color2.equalsIgnoreCase("black") ||
+                        color2.equalsIgnoreCase("cyan")) {
+                        foreground = color2;
+            }
+        }
+
+        attempts++;
+    }
+
+    public void setColor2(String x) {
+        color2 = x;
+    }
+
+    public void setColor1(String x) {
+        color1 = x;
+    }
+
+    public void setAction(String x) {
+        if (!tookHints) {
+            tookHints = x.equalsIgnoreCase("Hint");
+        }
+        hint = x;
+    }
+
+    public String getColor2() {
+         return background;
+    }
+
+    public String getColor1() {
+         return foreground;
+    }
+
+    public int getAttempts() {
+        return attempts;
+    }
+
+    public boolean getHint() {
+        return hint.equalsIgnoreCase("Hint");
+    }
+
+    public boolean getSuccess() {
+        if (background.equalsIgnoreCase("black") ||
+            background.equalsIgnoreCase("cyan")) {
+
+            if (foreground.equalsIgnoreCase("black") ||
+                foreground.equalsIgnoreCase("cyan")) {
+                return true;
+            }
+            return false;
+        }
+
+        return false;
+    }
+
+    public boolean getHintTaken() {
+        return tookHints;
+    }
+
+    public void reset() {
+        foreground = "red";
+        background = "yellow";
+    }
+
+    public void setIntval(int value) {
+        intval = value;
+        }
+
+    public int getIntval() {
+        return intval;
+        }
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.class
new file mode 100644
index 0000000..9dad971
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.java
new file mode 100644
index 0000000..7cd0f89
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilter.java
@@ -0,0 +1,224 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package compressionFilters;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Enumeration;
+import java.util.List;
+import java.util.StringTokenizer;
+
+import javax.servlet.FilterChain;
+import javax.servlet.GenericFilter;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * Implementation of javax.servlet.Filter used to compress
+ * the ServletResponse if it is bigger than a threshold.
+ *
+ * @author Amy Roh
+ * @author Dmitri Valdin
+ */
+public class CompressionFilter extends GenericFilter {
+
+    private static final long serialVersionUID = 1L;
+
+    /**
+     * Minimal reasonable threshold.
+     */
+    private static final int MIN_THRESHOLD = 128;
+
+    /**
+     * Minimal reasonable buffer.
+     */
+    // 8 KiB is what tomcat would use by default anyway
+    private static final int MIN_BUFFER = 8192;
+
+    /**
+     * The threshold number to compress.
+     */
+    protected int compressionThreshold = 0;
+
+    /**
+     * The compression buffer size to avoid chunking.
+     */
+    protected int compressionBuffer = 0;
+
+    /**
+     * The mime types to compress.
+     */
+    protected String[] compressionMimeTypes = {"text/html", "text/xml", "text/plain"};
+
+    /**
+     * Debug level for this filter.
+     */
+    private int debug = 0;
+
+    @Override
+    public void init() {
+        String str = getInitParameter("debug");
+        if (str != null) {
+            debug = Integer.parseInt(str);
+        }
+
+        str = getInitParameter("compressionThreshold");
+        if (str != null) {
+            compressionThreshold = Integer.parseInt(str);
+            if (compressionThreshold != 0 && compressionThreshold < MIN_THRESHOLD) {
+                if (debug > 0) {
+                    System.out.println("compressionThreshold should be either 0 - no compression or >= " + MIN_THRESHOLD);
+                    System.out.println("compressionThreshold set to " + MIN_THRESHOLD);
+                }
+                compressionThreshold = MIN_THRESHOLD;
+            }
+        }
+
+        str = getInitParameter("compressionBuffer");
+        if (str != null) {
+            compressionBuffer = Integer.parseInt(str);
+            if (compressionBuffer < MIN_BUFFER) {
+                if (debug > 0) {
+                    System.out.println("compressionBuffer should be >= " + MIN_BUFFER);
+                    System.out.println("compressionBuffer set to " + MIN_BUFFER);
+                }
+                compressionBuffer = MIN_BUFFER;
+            }
+        }
+
+        str = getInitParameter("compressionMimeTypes");
+        if (str != null) {
+            List values = new ArrayList<>();
+            StringTokenizer st = new StringTokenizer(str, ",");
+
+            while (st.hasMoreTokens()) {
+                String token = st.nextToken().trim();
+                if (token.length() > 0) {
+                    values.add(token);
+                }
+            }
+
+            if (values.size() > 0) {
+                compressionMimeTypes = values.toArray(new String[0]);
+            } else {
+                compressionMimeTypes = null;
+            }
+
+            if (debug > 0) {
+                System.out.println("compressionMimeTypes set to " +
+                        Arrays.toString(compressionMimeTypes));
+            }
+        }
+    }
+
+    /**
+     * The doFilter method of the Filter is called by the container
+     * each time a request/response pair is passed through the chain due
+     * to a client request for a resource at the end of the chain.
+     * The FilterChain passed into this method allows the Filter to pass on the
+     * request and response to the next entity in the chain.

+     * This method first examines the request to check whether the client support
+     * compression. 

+     * It simply just pass the request and response if there is no support for
+     * compression.

+     * If the compression support is available, it creates a
+     * CompressionServletResponseWrapper object which compresses the content and
+     * modifies the header if the content length is big enough.
+     * It then invokes the next entity in the chain using the FilterChain object
+     * (chain.doFilter()), 

+     **/
+    @Override
+    public void doFilter (ServletRequest request, ServletResponse response, FilterChain chain )
+            throws IOException, ServletException {
+
+        if (debug > 0) {
+            System.out.println("@doFilter");
+        }
+
+        if (compressionThreshold == 0) {
+            if (debug > 0) {
+                System.out.println("doFilter got called, but compressionThreshold is set to 0 - no compression");
+            }
+            chain.doFilter(request, response);
+            return;
+        }
+
+        boolean supportCompression = false;
+        if (request instanceof HttpServletRequest) {
+            if (debug > 1) {
+                System.out.println("requestURI = " + ((HttpServletRequest)request).getRequestURI());
+            }
+
+            // Are we allowed to compress ?
+            String s = request.getParameter("gzip");
+            if ("false".equals(s)) {
+                if (debug > 0) {
+                    System.out.println("got parameter gzip=false --> don't compress, just chain filter");
+                }
+                chain.doFilter(request, response);
+                return;
+            }
+
+            Enumeration e =
+                ((HttpServletRequest)request).getHeaders("Accept-Encoding");
+            while (e.hasMoreElements()) {
+                String name = e.nextElement();
+                if (name.indexOf("gzip") != -1) {
+                    if (debug > 0) {
+                        System.out.println("supports compression");
+                    }
+                    supportCompression = true;
+                } else {
+                    if (debug > 0) {
+                        System.out.println("no support for compression");
+                    }
+                }
+            }
+        }
+
+        if (supportCompression) {
+            if (response instanceof HttpServletResponse) {
+                CompressionServletResponseWrapper wrappedResponse =
+                    new CompressionServletResponseWrapper((HttpServletResponse)response);
+                wrappedResponse.setDebugLevel(debug);
+                wrappedResponse.setCompressionThreshold(compressionThreshold);
+                wrappedResponse.setCompressionBuffer(compressionBuffer);
+                wrappedResponse.setCompressionMimeTypes(compressionMimeTypes);
+                if (debug > 0) {
+                    System.out.println("doFilter gets called with compression");
+                }
+                try {
+                    chain.doFilter(request, wrappedResponse);
+                } finally {
+                    wrappedResponse.finishResponse();
+                }
+                return;
+            }
+        } else {
+            if (debug > 0) {
+                System.out.println("doFilter gets called w/o compression");
+            }
+            chain.doFilter(request, response);
+            return;
+        }
+    }
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.class
new file mode 100644
index 0000000..e41eeb3
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.java
new file mode 100644
index 0000000..58ec164
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionFilterTestServlet.java
@@ -0,0 +1,65 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package compressionFilters;
+
+import java.io.IOException;
+import java.util.Enumeration;
+
+import javax.servlet.ServletException;
+import javax.servlet.ServletOutputStream;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+/**
+ * Very Simple test servlet to test compression filter
+ * @author Amy Roh
+ */
+public class CompressionFilterTestServlet extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    public void doGet(HttpServletRequest request, HttpServletResponse response)
+        throws ServletException, IOException {
+
+        ServletOutputStream out = response.getOutputStream();
+        response.setContentType("text/plain");
+
+        Enumeration e = request.getHeaders("Accept-Encoding");
+        while (e.hasMoreElements()) {
+            String name = e.nextElement();
+            out.println(name);
+            if (name.indexOf("gzip") != -1) {
+                out.println("gzip supported -- able to compress");
+            } else {
+                out.println("gzip not supported");
+            }
+        }
+
+
+        out.println("Compression Filter Test Servlet");
+        out.println("Minimum content length for compression is 128 bytes");
+        out.println("**********  32 bytes  **********");
+        out.println("**********  32 bytes  **********");
+        out.println("**********  32 bytes  **********");
+        out.println("**********  32 bytes  **********");
+        out.close();
+    }
+
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.class
new file mode 100644
index 0000000..4930bff
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.java
new file mode 100644
index 0000000..6b6e850
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionResponseStream.java
@@ -0,0 +1,448 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package compressionFilters;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.util.Arrays;
+import java.util.zip.GZIPOutputStream;
+
+import javax.servlet.ServletOutputStream;
+import javax.servlet.WriteListener;
+
+/**
+ * Implementation of ServletOutputStream that works with
+ * the CompressionServletResponseWrapper implementation.
+ *
+ * @author Amy Roh
+ * @author Dmitri Valdin
+ */
+public class CompressionResponseStream extends ServletOutputStream {
+
+    // ----------------------------------------------------------- Constructors
+
+    /**
+     * Construct a servlet output stream associated with the specified Response.
+     *
+     * @param responseWrapper The associated response wrapper
+     * @param originalOutput the output stream
+     */
+    public CompressionResponseStream(
+            CompressionServletResponseWrapper responseWrapper,
+            ServletOutputStream originalOutput) {
+
+        super();
+        closed = false;
+        this.response = responseWrapper;
+        this.output = originalOutput;
+    }
+
+
+    // ----------------------------------------------------- Instance Variables
+
+
+    /**
+     * The threshold number which decides to compress or not.
+     * Users can configure in web.xml to set it to fit their needs.
+     */
+    protected int compressionThreshold = 0;
+
+    /**
+     * The compression buffer size to avoid chunking
+     */
+    protected int compressionBuffer = 0;
+
+    /**
+     * The mime types to compress
+     */
+    protected String[] compressionMimeTypes = {"text/html", "text/xml", "text/plain"};
+
+    /**
+     * Debug level
+     */
+    private int debug = 0;
+
+    /**
+     * The buffer through which all of our output bytes are passed.
+     */
+    protected byte[] buffer = null;
+
+    /**
+     * The number of data bytes currently in the buffer.
+     */
+    protected int bufferCount = 0;
+
+    /**
+     * The underlying gzip output stream to which we should write data.
+     */
+    protected OutputStream gzipstream = null;
+
+    /**
+     * Has this stream been closed?
+     */
+    protected boolean closed = false;
+
+    /**
+     * The response with which this servlet output stream is associated.
+     */
+    protected final CompressionServletResponseWrapper response;
+
+    /**
+     * The underlying servlet output stream to which we should write data.
+     */
+    protected final ServletOutputStream output;
+
+
+    // --------------------------------------------------------- Public Methods
+
+    /**
+     * Set debug level.
+     *
+     * @param debug The higher the number, the more detail shown. Currently the
+     *              range 0 (none) to 3 (everything) is used.
+     */
+    public void setDebugLevel(int debug) {
+        this.debug = debug;
+    }
+
+
+    /**
+     * Set the compressionThreshold number and create buffer for this size
+     *
+     * @param compressionThreshold Responses above this size in bytes will be
+     *                             compressed
+     */
+    protected void setCompressionThreshold(int compressionThreshold) {
+        this.compressionThreshold = compressionThreshold;
+        buffer = new byte[this.compressionThreshold];
+        if (debug > 1) {
+            System.out.println("compressionThreshold is set to "+ this.compressionThreshold);
+        }
+    }
+
+    /**
+     * The compression buffer size to avoid chunking
+     *
+     * @param compressionBuffer The compression buffer size in bytes
+     */
+    protected void setCompressionBuffer(int compressionBuffer) {
+        this.compressionBuffer = compressionBuffer;
+        if (debug > 1) {
+            System.out.println("compressionBuffer is set to "+ this.compressionBuffer);
+        }
+    }
+
+    /**
+     * Set supported mime types.
+     *
+     * @param compressionMimeTypes The mimetypes that will be compressed.
+     */
+    public void setCompressionMimeTypes(String[] compressionMimeTypes) {
+        this.compressionMimeTypes = compressionMimeTypes;
+        if (debug > 1) {
+            System.out.println("compressionMimeTypes is set to " +
+                    Arrays.toString(this.compressionMimeTypes));
+        }
+    }
+
+    /**
+     * Close this output stream, causing any buffered data to be flushed and
+     * any further output data to throw an IOException.
+     */
+    @Override
+    public void close() throws IOException {
+
+        if (debug > 1) {
+            System.out.println("close() @ CompressionResponseStream");
+        }
+        if (closed) {
+            throw new IOException("This output stream has already been closed");
+        }
+
+        if (gzipstream != null) {
+            flushToGZip();
+            gzipstream.close();
+            gzipstream = null;
+        } else {
+            if (bufferCount > 0) {
+                if (debug > 2) {
+                    System.out.print("output.write(");
+                    System.out.write(buffer, 0, bufferCount);
+                    System.out.println(")");
+                }
+                output.write(buffer, 0, bufferCount);
+                bufferCount = 0;
+            }
+        }
+
+        output.close();
+        closed = true;
+
+    }
+
+
+    /**
+     * Flush any buffered data for this output stream, which also causes the
+     * response to be committed.
+     */
+    @Override
+    public void flush() throws IOException {
+
+        if (debug > 1) {
+            System.out.println("flush() @ CompressionResponseStream");
+        }
+        if (closed) {
+            throw new IOException("Cannot flush a closed output stream");
+        }
+
+        if (gzipstream != null) {
+            gzipstream.flush();
+        }
+
+    }
+
+    public void flushToGZip() throws IOException {
+
+        if (debug > 1) {
+            System.out.println("flushToGZip() @ CompressionResponseStream");
+        }
+        if (bufferCount > 0) {
+            if (debug > 1) {
+                System.out.println("flushing out to GZipStream, bufferCount = " + bufferCount);
+            }
+            writeToGZip(buffer, 0, bufferCount);
+            bufferCount = 0;
+        }
+
+    }
+
+    /**
+     * Write the specified byte to our output stream.
+     *
+     * @param b The byte to be written
+     *
+     * @exception IOException if an input/output error occurs
+     */
+    @Override
+    public void write(int b) throws IOException {
+
+        if (debug > 1) {
+            System.out.println("write "+b+" in CompressionResponseStream ");
+        }
+        if (closed) {
+            throw new IOException("Cannot write to a closed output stream");
+        }
+
+        if (bufferCount >= buffer.length) {
+            flushToGZip();
+        }
+
+        buffer[bufferCount++] = (byte) b;
+
+    }
+
+
+    /**
+     * Write b.length bytes from the specified byte array
+     * to our output stream.
+     *
+     * @param b The byte array to be written
+     *
+     * @exception IOException if an input/output error occurs
+     */
+    @Override
+    public void write(byte b[]) throws IOException {
+
+        write(b, 0, b.length);
+
+    }
+
+
+
+    /**
+     * TODO SERVLET 3.1
+     */
+    @Override
+    public boolean isReady() {
+        // TODO Auto-generated method stub
+        return false;
+    }
+
+
+    /**
+     * TODO SERVLET 3.1
+     */
+    @Override
+    public void setWriteListener(WriteListener listener) {
+        // TODO Auto-generated method stub
+
+    }
+
+
+    /**
+     * Write len bytes from the specified byte array, starting
+     * at the specified offset, to our output stream.
+     *
+     * @param b The byte array containing the bytes to be written
+     * @param off Zero-relative starting offset of the bytes to be written
+     * @param len The number of bytes to be written
+     *
+     * @exception IOException if an input/output error occurs
+     */
+    @Override
+    public void write(byte b[], int off, int len) throws IOException {
+
+        if (debug > 1) {
+            System.out.println("write, bufferCount = " + bufferCount + " len = " + len + " off = " + off);
+        }
+        if (debug > 2) {
+            System.out.print("write(");
+            System.out.write(b, off, len);
+            System.out.println(")");
+        }
+
+        if (closed) {
+            throw new IOException("Cannot write to a closed output stream");
+        }
+
+        if (len == 0) {
+            return;
+        }
+
+        // Can we write into buffer ?
+        if (len <= (buffer.length - bufferCount)) {
+            System.arraycopy(b, off, buffer, bufferCount, len);
+            bufferCount += len;
+            return;
+        }
+
+        // There is not enough space in buffer. Flush it ...
+        flushToGZip();
+
+        // ... and try again. Note, that bufferCount = 0 here !
+        if (len <= (buffer.length - bufferCount)) {
+            System.arraycopy(b, off, buffer, bufferCount, len);
+            bufferCount += len;
+            return;
+        }
+
+        // write direct to gzip
+        writeToGZip(b, off, len);
+    }
+
+    public void writeToGZip(byte b[], int off, int len) throws IOException {
+
+        if (debug > 1) {
+            System.out.println("writeToGZip, len = " + len);
+        }
+        if (debug > 2) {
+            System.out.print("writeToGZip(");
+            System.out.write(b, off, len);
+            System.out.println(")");
+        }
+        if (gzipstream == null) {
+            if (debug > 1) {
+                System.out.println("new GZIPOutputStream");
+            }
+
+            boolean alreadyCompressed = false;
+            String contentEncoding = response.getHeader("Content-Encoding");
+            if (contentEncoding != null) {
+                if (contentEncoding.contains("gzip")) {
+                    alreadyCompressed = true;
+                    if (debug > 0) {
+                        System.out.println("content is already compressed");
+                    }
+                } else {
+                    if (debug > 0) {
+                        System.out.println("content is not compressed yet");
+                    }
+                }
+            }
+
+            boolean compressibleMimeType = false;
+            // Check for compatible MIME-TYPE
+            if (compressionMimeTypes != null) {
+                if (startsWithStringArray(compressionMimeTypes, response.getContentType())) {
+                    compressibleMimeType = true;
+                    if (debug > 0) {
+                        System.out.println("mime type " + response.getContentType() + " is compressible");
+                    }
+                } else {
+                    if (debug > 0) {
+                        System.out.println("mime type " + response.getContentType() + " is not compressible");
+                    }
+                }
+            }
+
+            if (response.isCommitted()) {
+                if (debug > 1) {
+                    System.out.print("Response already committed. Using original output stream");
+                }
+                gzipstream = output;
+            } else if (alreadyCompressed) {
+                if (debug > 1) {
+                    System.out.print("Response already compressed. Using original output stream");
+                }
+                gzipstream = output;
+            } else if (!compressibleMimeType) {
+                if (debug > 1) {
+                    System.out.print("Response mime type is not compressible. Using original output stream");
+                }
+                gzipstream = output;
+            } else {
+                response.addHeader("Content-Encoding", "gzip");
+                response.setContentLength(-1);  // don't use any preset content-length as it will be wrong after gzipping
+                response.setBufferSize(compressionBuffer);
+                gzipstream = new GZIPOutputStream(output);
+            }
+        }
+        gzipstream.write(b, off, len);
+
+    }
+
+
+    // -------------------------------------------------------- Package Methods
+
+    /**
+     * Has this response stream been closed?
+     *
+     * @return true if the stream has been closed, otherwise false.
+     */
+    public boolean closed() {
+        return closed;
+    }
+
+
+    /**
+     * Checks if any entry in the string array starts with the specified value
+     *
+     * @param sArray the StringArray
+     * @param value string
+     */
+    private boolean startsWithStringArray(String sArray[], String value) {
+        if (value == null) {
+            return false;
+        }
+        for (String s : sArray) {
+            if (value.startsWith(s)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.class
new file mode 100644
index 0000000..4a361a5
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.java
new file mode 100644
index 0000000..7420eb7
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/compressionFilters/CompressionServletResponseWrapper.java
@@ -0,0 +1,295 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package compressionFilters;
+
+import java.io.IOException;
+import java.io.OutputStreamWriter;
+import java.io.PrintWriter;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.servlet.ServletOutputStream;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpServletResponseWrapper;
+
+/**
+ * Implementation of HttpServletResponseWrapper that works with
+ * the CompressionServletResponseStream implementation..
+ *
+ * @author Amy Roh
+ * @author Dmitri Valdin
+ */
+public class CompressionServletResponseWrapper
+        extends HttpServletResponseWrapper {
+
+    // ----------------------------------------------------- Constructor
+
+    /**
+     * Calls the parent constructor which creates a ServletResponse adaptor
+     * wrapping the given response object.
+     *
+     * @param response The response object to be wrapped.
+     */
+    public CompressionServletResponseWrapper(HttpServletResponse response) {
+        super(response);
+        origResponse = response;
+        if (debug > 1) {
+            System.out.println("CompressionServletResponseWrapper constructor gets called");
+        }
+    }
+
+
+    // ----------------------------------------------------- Instance Variables
+
+    /**
+     * Original response
+     */
+    protected final HttpServletResponse origResponse;
+
+    /**
+     * The ServletOutputStream that has been returned by
+     * getOutputStream(), if any.
+     */
+    protected ServletOutputStream stream = null;
+
+
+    /**
+     * The PrintWriter that has been returned by
+     * getWriter(), if any.
+     */
+    protected PrintWriter writer = null;
+
+    /**
+     * The threshold number to compress
+     */
+    protected int compressionThreshold = 0;
+
+    /**
+     * The compression buffer size
+     */
+    protected int compressionBuffer = 8192;  // 8 KiB default
+
+    /**
+     * The mime types to compress
+     */
+    protected String[] compressionMimeTypes = {"text/html", "text/xml", "text/plain"};
+
+    /**
+     * Debug level
+     */
+    protected int debug = 0;
+
+    /**
+     * keeps a copy of all headers set
+     */
+    private final Map headerCopies = new HashMap<>();
+
+
+    // --------------------------------------------------------- Public Methods
+
+
+    /**
+     * Set threshold number.
+     *
+     * @param threshold The new compression threshold
+     */
+    public void setCompressionThreshold(int threshold) {
+        if (debug > 1) {
+            System.out.println("setCompressionThreshold to " + threshold);
+        }
+        this.compressionThreshold = threshold;
+    }
+
+    /**
+     * Set compression buffer.
+     *
+     * @param buffer New size of buffer to use for compressed output
+     */
+    public void setCompressionBuffer(int buffer) {
+        if (debug > 1) {
+            System.out.println("setCompressionBuffer to " + buffer);
+        }
+        this.compressionBuffer = buffer;
+    }
+
+    /**
+     * Set compressible mime types.
+     *
+     * @param mimeTypes The new list of mime types that will be considered for
+     *                  compression
+     */
+    public void setCompressionMimeTypes(String[] mimeTypes) {
+        if (debug > 1) {
+            System.out.println("setCompressionMimeTypes to " +
+                    Arrays.toString(mimeTypes));
+        }
+        this.compressionMimeTypes = mimeTypes;
+    }
+
+    /**
+     * Set debug level.
+     *
+     * @param debug The new debug level
+     */
+    public void setDebugLevel(int debug) {
+        this.debug = debug;
+    }
+
+
+    /**
+     * Create and return a ServletOutputStream to write the content
+     * associated with this Response.
+     *
+     * @exception IOException if an input/output error occurs
+     *
+     * @return A new servlet output stream that compressed any data written to
+     *         it
+     */
+    protected ServletOutputStream createOutputStream() throws IOException {
+        if (debug > 1) {
+            System.out.println("createOutputStream gets called");
+        }
+
+        CompressionResponseStream stream = new CompressionResponseStream(
+                this, origResponse.getOutputStream());
+        stream.setDebugLevel(debug);
+        stream.setCompressionThreshold(compressionThreshold);
+        stream.setCompressionBuffer(compressionBuffer);
+        stream.setCompressionMimeTypes(compressionMimeTypes);
+
+        return stream;
+    }
+
+
+    /**
+     * Finish a response.
+     */
+    public void finishResponse() {
+        try {
+            if (writer != null) {
+                writer.close();
+            } else {
+                if (stream != null) {
+                    stream.close();
+                }
+            }
+        } catch (IOException ignore) {
+            // Ignore
+        }
+    }
+
+
+    // ------------------------------------------------ ServletResponse Methods
+
+
+    /**
+     * Flush the buffer and commit this response.
+     *
+     * @exception IOException if an input/output error occurs
+     */
+    @Override
+    public void flushBuffer() throws IOException {
+        if (debug > 1) {
+            System.out.println("flush buffer @ GZipServletResponseWrapper");
+        }
+        ((CompressionResponseStream)stream).flush();
+
+    }
+
+    /**
+     * Return the servlet output stream associated with this Response.
+     *
+     * @exception IllegalStateException if getWriter has
+     *  already been called for this response
+     * @exception IOException if an input/output error occurs
+     */
+    @Override
+    public ServletOutputStream getOutputStream() throws IOException {
+
+        if (writer != null) {
+            throw new IllegalStateException("getWriter() has already been called for this response");
+        }
+
+        if (stream == null) {
+            stream = createOutputStream();
+        }
+        if (debug > 1) {
+            System.out.println("stream is set to "+stream+" in getOutputStream");
+        }
+
+        return stream;
+    }
+
+    /**
+     * Return the writer associated with this Response.
+     *
+     * @exception IllegalStateException if getOutputStream has
+     *  already been called for this response
+     * @exception IOException if an input/output error occurs
+     */
+    @Override
+    public PrintWriter getWriter() throws IOException {
+
+        if (writer != null) {
+            return writer;
+        }
+
+        if (stream != null) {
+            throw new IllegalStateException("getOutputStream() has already been called for this response");
+        }
+
+        stream = createOutputStream();
+        if (debug > 1) {
+            System.out.println("stream is set to "+stream+" in getWriter");
+        }
+        String charEnc = origResponse.getCharacterEncoding();
+        if (debug > 1) {
+            System.out.println("character encoding is " + charEnc);
+        }
+        writer = new PrintWriter(new OutputStreamWriter(stream, charEnc));
+
+        return writer;
+    }
+
+    @Override
+    public String getHeader(String name) {
+        return headerCopies.get(name);
+    }
+
+    @Override
+    public void addHeader(String name, String value) {
+        if (headerCopies.containsKey(name)) {
+            String existingValue = headerCopies.get(name);
+            if ((existingValue != null) && (existingValue.length() > 0)) {
+                headerCopies.put(name, existingValue + "," + value);
+            } else {
+                headerCopies.put(name, value);
+            }
+        } else {
+            headerCopies.put(name, value);
+        }
+        super.addHeader(name, value);
+    }
+
+
+    @Override
+    public void setHeader(String name, String value) {
+        headerCopies.put(name, value);
+        super.setHeader(name, value);
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/dates/JspCalendar.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/dates/JspCalendar.class
new file mode 100644
index 0000000..c153d33
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/dates/JspCalendar.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/dates/JspCalendar.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/dates/JspCalendar.java
new file mode 100644
index 0000000..24466d9
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/dates/JspCalendar.java
@@ -0,0 +1,155 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package dates;
+
+import java.util.Calendar;
+import java.util.Date;
+
+public class JspCalendar {
+    final Calendar calendar;
+
+    public JspCalendar() {
+        calendar = Calendar.getInstance();
+        Date trialTime = new Date();
+        calendar.setTime(trialTime);
+    }
+
+    public int getYear() {
+        return calendar.get(Calendar.YEAR);
+    }
+
+    public String getMonth() {
+        int m = getMonthInt();
+        String[] months = new String [] { "January", "February", "March",
+                                        "April", "May", "June",
+                                        "July", "August", "September",
+                                        "October", "November", "December" };
+        if (m > 12) {
+            return "Unknown to Man";
+        }
+
+        return months[m - 1];
+
+    }
+
+    public String getDay() {
+        int x = getDayOfWeek();
+        String[] days = new String[] {"Sunday", "Monday", "Tuesday", "Wednesday",
+                                      "Thursday", "Friday", "Saturday"};
+
+        if (x > 7) {
+            return "Unknown to Man";
+        }
+
+        return days[x - 1];
+
+    }
+
+    public int getMonthInt() {
+        return 1 + calendar.get(Calendar.MONTH);
+    }
+
+    public String getDate() {
+        return getMonthInt() + "/" + getDayOfMonth() + "/" +  getYear();
+
+    }
+
+    public String getTime() {
+        return getHour() + ":" + getMinute() + ":" + getSecond();
+    }
+
+    public int getDayOfMonth() {
+        return calendar.get(Calendar.DAY_OF_MONTH);
+    }
+
+    public int getDayOfYear() {
+        return calendar.get(Calendar.DAY_OF_YEAR);
+    }
+
+    public int getWeekOfYear() {
+        return calendar.get(Calendar.WEEK_OF_YEAR);
+    }
+
+    public int getWeekOfMonth() {
+        return calendar.get(Calendar.WEEK_OF_MONTH);
+    }
+
+    public int getDayOfWeek() {
+        return calendar.get(Calendar.DAY_OF_WEEK);
+    }
+
+    public int getHour() {
+        return calendar.get(Calendar.HOUR_OF_DAY);
+    }
+
+    public int getMinute() {
+        return calendar.get(Calendar.MINUTE);
+    }
+
+
+    public int getSecond() {
+        return calendar.get(Calendar.SECOND);
+    }
+
+    public static void main(String args[]) {
+        JspCalendar db = new JspCalendar();
+        p("date: " + db.getDayOfMonth());
+        p("year: " + db.getYear());
+        p("month: " + db.getMonth());
+        p("time: " + db.getTime());
+        p("date: " + db.getDate());
+        p("Day: " + db.getDay());
+        p("DayOfYear: " + db.getDayOfYear());
+        p("WeekOfYear: " + db.getWeekOfYear());
+        p("era: " + db.getEra());
+        p("ampm: " + db.getAMPM());
+        p("DST: " + db.getDSTOffset());
+        p("ZONE Offset: " + db.getZoneOffset());
+        p("TIMEZONE: " + db.getUSTimeZone());
+    }
+
+    private static void p(String x) {
+        System.out.println(x);
+    }
+
+
+    public int getEra() {
+        return calendar.get(Calendar.ERA);
+    }
+
+    public String getUSTimeZone() {
+        String[] zones = new String[] {"Hawaii", "Alaskan", "Pacific",
+                                       "Mountain", "Central", "Eastern"};
+
+        return zones[10 + getZoneOffset()];
+    }
+
+    public int getZoneOffset() {
+        return calendar.get(Calendar.ZONE_OFFSET)/(60*60*1000);
+    }
+
+
+    public int getDSTOffset() {
+        return calendar.get(Calendar.DST_OFFSET)/(60*60*1000);
+    }
+
+
+    public int getAMPM() {
+        return calendar.get(Calendar.AM_PM);
+    }
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/error/Smart.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/error/Smart.class
new file mode 100644
index 0000000..ce3a2d3
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/error/Smart.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/error/Smart.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/error/Smart.java
new file mode 100644
index 0000000..82c22f6
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/error/Smart.java
@@ -0,0 +1,30 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package error;
+
+public class Smart {
+
+    String name = "JSP";
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.class
new file mode 100644
index 0000000..3eaac0c
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.java
new file mode 100644
index 0000000..8e4088b
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ExampleTagBase.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package examples;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.tagext.BodyContent;
+import javax.servlet.jsp.tagext.BodyTagSupport;
+import javax.servlet.jsp.tagext.Tag;
+
+public abstract class ExampleTagBase extends BodyTagSupport {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    public void setParent(Tag parent) {
+        this.parent = parent;
+    }
+
+    @Override
+    public void setBodyContent(BodyContent bodyOut) {
+        this.bodyOut = bodyOut;
+    }
+
+    @Override
+    public Tag getParent() {
+        return this.parent;
+    }
+
+    @Override
+    public int doStartTag() throws JspException {
+        return SKIP_BODY;
+    }
+
+    @Override
+    public int doEndTag() throws JspException {
+        return EVAL_PAGE;
+    }
+
+
+    @Override
+    public void doInitBody() throws JspException {
+        // Default implementations for BodyTag methods as well
+        // just in case a tag decides to implement BodyTag.
+    }
+
+    @Override
+    public int doAfterBody() throws JspException {
+        return SKIP_BODY;
+    }
+
+    @Override
+    public void release() {
+        bodyOut = null;
+        pageContext = null;
+        parent = null;
+    }
+
+    protected BodyContent bodyOut;
+    protected Tag parent;
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTag.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTag.class
new file mode 100644
index 0000000..7b70a16
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTag.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTag.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTag.java
new file mode 100644
index 0000000..ad92e21
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTag.java
@@ -0,0 +1,87 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package examples;
+
+import java.io.IOException;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.JspTagException;
+
+/**
+ * Example1: the simplest tag
+ * Collect attributes and call into some actions
+ *
+ * 
+ */
+
+public class FooTag extends ExampleTagBase {
+
+    private static final long serialVersionUID = 1L;
+
+    private final String atts[] = new String[3];
+    int i = 0;
+
+    private void setAtt(int index, String value) {
+        atts[index] = value;
+    }
+
+    public void setAtt1(String value) {
+        setAtt(0, value);
+    }
+
+    public void setAtt2(String value) {
+        setAtt(1, value);
+    }
+
+    public void setAtt3(String value) {
+        setAtt(2, value);
+    }
+
+    /**
+     * Process start tag
+     *
+     * @return EVAL_BODY_INCLUDE
+     */
+    @Override
+    public int doStartTag() throws JspException {
+        i = 0;
+        return EVAL_BODY_BUFFERED;
+    }
+
+    @Override
+    public void doInitBody() throws JspException {
+        pageContext.setAttribute("member", atts[i]);
+        i++;
+    }
+
+    @Override
+    public int doAfterBody() throws JspException {
+        try {
+            if (i == 3) {
+                bodyOut.writeOut(bodyOut.getEnclosingWriter());
+                return SKIP_BODY;
+            }
+
+            pageContext.setAttribute("member", atts[i]);
+            i++;
+            return EVAL_BODY_BUFFERED;
+        } catch (IOException ioe) {
+            throw new JspTagException(ioe.toString());
+        }
+    }
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.class
new file mode 100644
index 0000000..d136613
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.java
new file mode 100644
index 0000000..99023d6
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/FooTagExtraInfo.java
@@ -0,0 +1,36 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package examples;
+
+import javax.servlet.jsp.tagext.TagData;
+import javax.servlet.jsp.tagext.TagExtraInfo;
+import javax.servlet.jsp.tagext.VariableInfo;
+
+public class FooTagExtraInfo extends TagExtraInfo {
+    @Override
+    public VariableInfo[] getVariableInfo(TagData data) {
+        return new VariableInfo[]
+            {
+                new VariableInfo("member",
+                                 "String",
+                                 true,
+                                 VariableInfo.NESTED)
+            };
+    }
+}
+
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/LogTag.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/LogTag.class
new file mode 100644
index 0000000..802d693
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/LogTag.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/LogTag.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/LogTag.java
new file mode 100644
index 0000000..9dbf0d2
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/LogTag.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package examples;
+
+import java.io.IOException;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.JspTagException;
+
+/**
+ * Log the contents of the body. Could be used to handle errors etc.
+ */
+public class LogTag extends ExampleTagBase {
+
+    private static final long serialVersionUID = 1L;
+
+    boolean toBrowser = false;
+
+    public void setToBrowser(String value) {
+        if (value == null) {
+            toBrowser = false;
+        } else if (value.equalsIgnoreCase("true")) {
+            toBrowser = true;
+        } else {
+            toBrowser = false;
+        }
+    }
+
+    @Override
+    public int doStartTag() throws JspException {
+        return EVAL_BODY_BUFFERED;
+    }
+
+    @Override
+    public int doAfterBody() throws JspException {
+        try {
+            String s = bodyOut.getString();
+            System.err.println(s);
+            if (toBrowser) {
+                bodyOut.writeOut(bodyOut.getEnclosingWriter());
+            }
+            return SKIP_BODY;
+        } catch (IOException ioe) {
+            throw new JspTagException(ioe.toString());
+        }
+    }
+}
+
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ValuesTag.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ValuesTag.class
new file mode 100644
index 0000000..cbad129
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ValuesTag.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ValuesTag.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ValuesTag.java
new file mode 100644
index 0000000..d40303d
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/examples/ValuesTag.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package examples;
+
+import java.io.IOException;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.JspTagException;
+import javax.servlet.jsp.JspWriter;
+import javax.servlet.jsp.tagext.TagSupport;
+
+/**
+ * Accept and display a value.
+ */
+public class ValuesTag extends TagSupport {
+
+    private static final long serialVersionUID = 1L;
+
+    // Using "-1" as the default value,
+    // in the assumption that it won't be used as the value.
+    // Cannot use null here, because null is an important case
+    // that should be present in the tests.
+    private Object objectValue = "-1";
+    private String stringValue = "-1";
+    private long longValue = -1;
+    private double doubleValue = -1;
+
+    public void setObject(Object objectValue) {
+        this.objectValue = objectValue;
+    }
+
+    public void setString(String stringValue) {
+        this.stringValue = stringValue;
+    }
+
+    public void setLong(long longValue) {
+        this.longValue = longValue;
+    }
+
+    public void setDouble(double doubleValue) {
+        this.doubleValue = doubleValue;
+    }
+
+    @Override
+    public int doEndTag() throws JspException {
+        JspWriter out = pageContext.getOut();
+
+        try {
+            if (!"-1".equals(objectValue)) {
+                out.print(objectValue);
+            } else if (!"-1".equals(stringValue)) {
+                out.print(stringValue);
+            } else if (longValue != -1) {
+                out.print(longValue);
+            } else if (doubleValue != -1) {
+                out.print(doubleValue);
+            } else {
+                out.print("-1");
+            }
+        } catch (IOException ioe) {
+            throw new JspTagException("IOException: " + ioe.toString(), ioe);
+        }
+        return super.doEndTag();
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/filters/ExampleFilter.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/filters/ExampleFilter.class
new file mode 100644
index 0000000..92b2dd3
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/filters/ExampleFilter.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/filters/ExampleFilter.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/filters/ExampleFilter.java
new file mode 100644
index 0000000..6130742
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/filters/ExampleFilter.java
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package filters;
+
+
+import java.io.IOException;
+
+import javax.servlet.FilterChain;
+import javax.servlet.GenericFilter;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
+
+/**
+ * Example filter that can be attached to either an individual servlet
+ * or to a URL pattern.  This filter performs the following functions:
+ * 

+ * Attaches itself as a request attribute, under the attribute name
+ *     defined by the value of the attribute initialization
+ *     parameter.
+ * Calculates the number of milliseconds required to perform the
+ *     servlet processing required by this request, including any
+ *     subsequently defined filters, and logs the result to the servlet
+ *     context log for this application.
+ * 
+ *
+ * @author Craig McClanahan
+ */
+public final class ExampleFilter extends GenericFilter {
+
+
+    private static final long serialVersionUID = 1L;
+
+
+    /**
+     * The request attribute name under which we store a reference to ourself.
+     */
+    private String attribute = null;
+
+
+    /**
+     * Time the processing that is performed by all subsequent filters in the
+     * current filter stack, including the ultimately invoked servlet.
+     *
+     * @param request The servlet request we are processing
+     * @param response The servlet response we are creating
+     * @param chain The filter chain we are processing
+     *
+     * @exception IOException if an input/output error occurs
+     * @exception ServletException if a servlet error occurs
+     */
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+
+        // Store ourselves as a request attribute (if requested)
+        if (attribute != null) {
+            request.setAttribute(attribute, this);
+        }
+
+        // Time and log the subsequent processing
+        long startTime = System.currentTimeMillis();
+        chain.doFilter(request, response);
+        long stopTime = System.currentTimeMillis();
+        getServletContext().log(this.toString() + ": " + (stopTime - startTime) +
+             " milliseconds");
+    }
+
+
+    @Override
+    public void init() throws ServletException {
+        this.attribute = getInitParameter("attribute");
+    }
+
+
+    /**
+     * Return a String representation of this object.
+     */
+    @Override
+    public String toString() {
+        return "ExampleFilter(" + getFilterConfig() + ")";
+    }
+}
+
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.class
new file mode 100644
index 0000000..688c612
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.java
new file mode 100644
index 0000000..3b72828
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/http2/SimpleImagePush.java
@@ -0,0 +1,59 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one or more
+ *  contributor license agreements.  See the NOTICE file distributed with
+ *  this work for additional information regarding copyright ownership.
+ *  The ASF licenses this file to You under the Apache License, Version 2.0
+ *  (the "License"); you may not use this file except in compliance with
+ *  the License.  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package http2;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.PushBuilder;
+
+public class SimpleImagePush extends HttpServlet {
+
+    private static final long serialVersionUID = 1L;
+
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws ServletException, IOException {
+
+        resp.setCharacterEncoding("UTF-8");
+        resp.setContentType("text/html");
+        PrintWriter pw = resp.getWriter();
+
+        PushBuilder pb = req.newPushBuilder();
+        if (pb != null) {
+            pb.path("servlets/images/code.gif");
+            pb.push();
+            pw.println("");
+            pw.println("");
+            pw.println("The following image was provided via a push request.");
+            pw.println("");
+            pw.println("");
+            pw.println("");
+            pw.flush();
+        } else {
+            pw.println("");
+            pw.println("");
+            pw.println("Server push requests are not supported by this protocol.");
+            pw.println("");
+            pw.println("");
+        }
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.class
new file mode 100644
index 0000000..a131846
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.java
new file mode 100644
index 0000000..30a8450
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/BookBean.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package jsp2.examples;
+
+public class BookBean {
+    private final String title;
+    private final String author;
+    private final String isbn;
+
+    public BookBean( String title, String author, String isbn ) {
+        this.title = title;
+        this.author = author;
+        this.isbn = isbn;
+    }
+
+    public String getTitle() {
+        return this.title;
+    }
+
+    public String getAuthor() {
+        return this.author;
+    }
+
+    public String getIsbn() {
+        return this.isbn;
+    }
+
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.class
new file mode 100644
index 0000000..2f5f577
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.java
new file mode 100644
index 0000000..4334856
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/FooBean.java
@@ -0,0 +1,34 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package jsp2.examples;
+
+public class FooBean {
+    private String bar;
+
+    public FooBean() {
+        bar = "Initial value";
+    }
+
+    public String getBar() {
+        return this.bar;
+    }
+
+    public void setBar(String bar) {
+        this.bar = bar;
+    }
+
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.class
new file mode 100644
index 0000000..184a5c1
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.java
new file mode 100644
index 0000000..aac414f
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/ValuesBean.java
@@ -0,0 +1,50 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package jsp2.examples;
+
+/**
+ * Accept and display a value.
+ */
+public class ValuesBean {
+    private String string;
+    private double doubleValue;
+    private long longValue;
+
+    public String getStringValue() {
+        return this.string;
+    }
+
+    public void setStringValue(String string) {
+        this.string = string;
+    }
+
+    public double getDoubleValue() {
+        return doubleValue;
+    }
+
+    public void setDoubleValue(double doubleValue) {
+        this.doubleValue = doubleValue;
+    }
+
+    public long getLongValue() {
+        return longValue;
+    }
+
+    public void setLongValue(long longValue) {
+        this.longValue = longValue;
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.class
new file mode 100644
index 0000000..cf90f71
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.java
new file mode 100644
index 0000000..79f9eac
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/el/Functions.java
@@ -0,0 +1,45 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package jsp2.examples.el;
+
+import java.util.Locale;
+
+/**
+ * Defines the functions for the jsp2 example tag library.
+ *
+ * Each function is defined as a static method.
+ */
+public class Functions {
+    public static String reverse( String text ) {
+        return new StringBuilder( text ).reverse().toString();
+    }
+
+    public static int numVowels( String text ) {
+        String vowels = "aeiouAEIOU";
+        int result = 0;
+        for( int i = 0; i < text.length(); i++ ) {
+            if( vowels.indexOf( text.charAt( i ) ) != -1 ) {
+                result++;
+            }
+        }
+        return result;
+    }
+
+    public static String caps( String text ) {
+        return text.toUpperCase(Locale.ENGLISH);
+    }
+}
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.class b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.class
new file mode 100644
index 0000000..91c6305
Binary files /dev/null and b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.class differ
diff --git a/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.java b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.java
new file mode 100644
index 0000000..b096707
--- /dev/null
+++ b/apache-tomcat-9.0.109/webapps/examples/WEB-INF/classes/jsp2/examples/simpletag/EchoAttributesTag.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package jsp2.examples.simpletag;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.JspWriter;
+import javax.servlet.jsp.tagext.DynamicAttributes;
+import javax.servlet.jsp.tagext.SimpleTagSupport;
+
+/**
+ * SimpleTag handler that echoes all its attributes
+ */
+public class EchoAttributesTag
+    extends SimpleTagSupport
+    implements DynamicAttributes
+{
+    private final List keys = new ArrayList<>();
+    private final List

Java -> Code Style -> Formatter -> Edit...	Tab policy: Spaces only Tab and Indentation size: 4
General -> Editors -> Text Editors	Displayed tab width: 2 Insert spaces for tabs Show whitespace characters (optional)
XML -> XML Files -> Editor	Indent using spaces Indentation size: 2
Ant -> Editor -> Formatter	Tab size: 2 Use tab character instead of spaces: unchecked

+ Attribute +	+ Description +
`className`	+ `org.apache.catalina.ha.session.JvmRouteBinderValve` +
`enabled`	+ Default value is `true` + Runtime attribute to turn on and off turn over of the session's jvmRoute value. +
`sessionIdAttribute`	+ Old sessionid before failover is registered in request attributes with this attribute. + Default attribute name is `org.apache.catalina.ha.session.JvmRouteOriginalSessionID`. +

+ Attribute +	+ Description +
`className`	+ The main cluster class, currently only one is available, + `org.apache.catalina.ha.tcp.SimpleTcpCluster` + +
`channelSendOptions`	+ The Tribes channel send options, default is `8`. + This option is used to set the flag that all messages sent through the + SimpleTcpCluster uses. The flag decides how the messages are sent, and is a simple logical OR. + + `int options = Channel.SEND_OPTIONS_ASYNCHRONOUS \| + Channel.SEND_OPTIONS_SYNCHRONIZED_ACK \| + Channel.SEND_OPTIONS_USE_ACK;` + Some of the values are: + `Channel.SEND_OPTIONS_SYNCHRONIZED_ACK = 0x0004` + `Channel.SEND_OPTIONS_ASYNCHRONOUS = 0x0008` + `Channel.SEND_OPTIONS_USE_ACK = 0x0002` + So to use ACK and ASYNC messaging, the flag would be `10` (8+2) + + Note that if you use ASYNC messaging it is possible for update messages + for a session to be processed by the receiving nodes in a different order + to the order in which they were sent. + + + The various `channelSendOptions` values offer a tradeoff + between throughput on the sending node and the reliability of + replication should the sending or receiving node(s) fail. Here are + some common options. "Message" could be any message sent between nodes, + but only session-change messages are considered, here. + + + `channelSendOptions="8"` / `channelSendOptions="async"` + As far as the sender is concerned, the message is "sent" + as soon as it has been placed in the queue on the sender for + transmission to the other nodes. The message may not reach any or all + of the recipient nodes and may not be successfully processed on any + nodes that it does reach. This option offers the highest throughput on + the sender but the least reliability, as the triggering request will + complete without any knowledge of the success/failure of the session + replication. + + + `channelSendOptions="2"` / `channelSendOptions="use_ack"` + The sender will block the completion of the current request until all + of the receiving nodes have acknowledged that they have received the + message, but have not necessarily processed that message. This option + will result in lower throughput on the sending node, because the message + must be transmitted and the acknowledgement received, but the + reliability is greater than the asynchronous model. + + + `channelSendOptions="6"` / `channelSendOptions="sync,use_ack"` + The sender will block the completion of the current request until + all of the receiving nodes have acknowledged that they have received + and processed the message. This option will have the lowest + throughput (of these three) but the greatest reliability. + + + You may also set these options as a comma separated string, e.g. "async, multicast", which + will be translated into `Channel.SEND_OPTIONS_ASYNCHRONOUS \| Channel.SEND_OPTIONS_MULTICAST` + + The valid option names are "asynchronous" (alias "async"), "byte_message" (alias "byte") + , "multicast", "secure", "synchronized_ack" (alias "sync"), "udp", "use_ack" + +
`channelStartOptions`	+ Sets the start and stop flags for the <Channel> object used by the cluster. + The default is `Channel.DEFAULT` which starts all the channel services, such as + sender, receiver, membership sender and membership receiver. + The following flags are available today: + `Channel.DEFAULT = Channel.SND_RX_SEQ (1) \| + Channel.SND_TX_SEQ (2) \| + Channel.MBR_RX_SEQ (4) \| + Channel.MBR_TX_SEQ (8);` + When using the static membership service + `org.apache.catalina.tribes.membership.StaticMembershipService` + you must ensure that this attribute is configured to use the default + value. +
`heartbeatBackgroundEnabled`	+ Flag whether invoke channel heartbeat at container background thread. Default value is false. + Enable this flag don't forget to disable the channel heartbeat thread. + +
`notifyLifecycleListenerOnFailure`	+ Flag whether notify LifecycleListeners if all ClusterListener couldn't accept channel message. + Default value is false. + +

Context Path	Context Version	Context Name	Base File Name	Example File Names (.xml, .war & directory)
/foo	None	/foo	foo	foo.xml, foo.war, foo
/foo/bar	None	/foo/bar	foo#bar	foo#bar.xml, foo#bar.war, foo#bar
Empty String	None	Empty String	ROOT	ROOT.xml, ROOT.war, ROOT
/foo	42	/foo##42	foo##42	foo##42.xml, foo##42.war, foo##42
/foo/bar	42	/foo/bar##42	foo#bar##42	foo#bar##42.xml, foo#bar##42.war, foo#bar##42
Empty String	42	##42	ROOT##42	ROOT##42.xml, ROOT##42.war, ROOT##42

+ Attribute +	+ Description +
`allowCasualMultipartParsing`	+ Set to `true` if Tomcat should automatically parse + multipart/form-data request bodies when HttpServletRequest.getPart* + or HttpServletRequest.getParameter* is called, even when the + target servlet isn't marked with the @MultipartConfig annotation + (See Servlet Specification 3.0, Section 3.2 for details). + Note that any setting other than `false` causes Tomcat + to behave in a way that is not technically spec-compliant. + The default is `false`. +
`allowMultipleLeadingForwardSlashInPath`	+ Tomcat normalises sequences of multiple `/` characters in + a URI to a single `/`. This is for consistency with the + behaviour of file systems as URIs are often translated to file system + paths. As a result, the return value of + `HttpServletRequest#getContextPath()` is expected to start + with multiple `/` characters for some URIs. This will cause + problems if this value is used directly with + `HttpServletResponse#sendRedirect()` as redirect paths that + start with `//` are treated as protocol relative redirects. + To avoid potential issues, Tomcat will collapse multiple leading + `/` characters at the start of the return value for + `HttpServletRequest#getContextPath()` to a single + `/`. This attribute has a default value of `false` + which enables the collapsing of multiple `/` characters. To + disable this behaviour, set this attribute to `true`. +
`altDDName`	+ The absolute path to the alternative deployment descriptor for this + context. This overrides the default deployment descriptor located at + `/WEB-INF/web.xml`. +
`backgroundProcessorDelay`	+ This value represents the delay in seconds between the + invocation of the backgroundProcess method on this context and + its child containers, including all wrappers. + Child containers will not be invoked if their delay value is not + negative (which would mean they are using their own processing + thread). Setting this to a positive value will cause + a thread to be spawn. After waiting the specified amount of time, + the thread will invoke the backgroundProcess method on this host + and all its child containers. A context will use background + processing to perform session expiration and class monitoring for + reloading. If not specified, the default value for this attribute is + -1, which means the context will rely on the background processing + thread of its parent host. +
`className`	+ Java class name of the implementation to use. This class must + implement the `org.apache.catalina.Context` interface. + If not specified, the standard value (defined below) will be used. +
`containerSciFilter`	+ The regular expression that specifies which container provided SCIs + should be filtered out and not used for this context. Matching uses + `java.util.regex.Matcher.find()` so the regular expression + only has to match a sub-string of the fully qualified class name of the + container provided SCI for it to be filtered out. If not specified, + no filtering will be applied. +
`cookies`	+ Set to `true` if you want cookies to be used for + session identifier communication if supported by the client (this + is the default). Set to `false` if you want to disable + the use of cookies for session identifier communication, and rely + only on URL rewriting by the application. +
`createUploadTargets`	+ Set to `true` if Tomcat should attempt to create the + temporary upload location specified in the `MultipartConfig` + for a Servlet if the location does not already exist. If not specified, + the default value of `false` will be used. +
`crossContext`	+ Set to `true` if you want calls within this application + to `ServletContext.getContext()` to successfully return a + request dispatcher for other web applications running on this virtual + host. Set to `false` (the default) in security + conscious environments, to make `getContext()` always + return `null`. +
`dispatchersUseEncodedPaths`	+ Controls whether paths used in calls to obtain a request dispatcher + ares expected to be encoded. This affects both how Tomcat handles calls + to obtain a request dispatcher as well as how Tomcat generates paths + used to obtain request dispatchers internally. If not specified, the + default value of `true` is used. When encoding/decoding paths + for a request dispatcher, UTF-8 is always used. +
`docBase`	+ The Document Base (also known as the Context + Root) directory for this web application, or the pathname + to the web application archive file (if this web application is + being executed directly from the WAR file). You may specify + an absolute pathname for this directory or WAR file, or a pathname + that is relative to the `appBase` directory of the + owning Host. + The value of this field must not be set unless the Context element is + defined in server.xml or the `docBase` is not located under + the Host's `appBase`. + If a symbolic link is used for `docBase` then changes to + the symbolic link will only be effective after a Tomcat restart or + by undeploying and redeploying the context. A context reload is not + sufficient. +
`encodedReverseSolidusHandling`	+ When set to `reject`, an attempt to obtain a + `RequestDispatcher` for a path containing a `%5c` + sequence will trigger an `IllegalArgumentException`. When set + to `decode`, any `%5c` sequence in the path used + to obtain a `RequestDispatcher` will have that sequence + decoded to `\` (and then normalized to `/`) before + the `RequestDispatcher` is created. When set to + `passthrough`, any `%5c` sequence in the path used + to obtain a `RequestDispatcher` will remain unchanged. + If `passthrough` is used then it is the application's + responsibility to perform any further `%nn` decoding required. + Any `%25` sequences (encoded `%`) in the path will + also be processed with the `%25` sequence unchanged + to avoid potential corruption and/or decoding failure when the path is + subsequently `%nn` decoded by the application. + If not specified, the default value is `decode`. +
`encodedSolidusHandling`	+ When set to `reject`, an attempt to obtain a + `RequestDispatcher` for a path containing a `%2f` + sequence will trigger an `IllegalArgumentException`. When set + to `decode`, any `%2f` sequence in the path used + to obtain a `RequestDispatcher` will have that sequence + decoded to `/` before the `RequestDispatcher` is + created. When set to `passthrough`, any `%2f` + sequence in the path used to obtain a `RequestDispatcher` + will remain unchanged. + If `passthrough` is used then it is the application's + responsibility to perform any further `%nn` decoding required. + Any `%25` sequences (encoded `%`) in the path will + also be processed with the `%25` sequence unchanged + to avoid potential corruption and/or decoding failure when the path is + subsequently `%nn` decoded by the application. + If not specified, the default value is `decode`. This + default will change to `reject` (to align with the + Connector) in Tomcat 12. +
`failCtxIfServletStartFails`	+ Set to `true` to have the context fail its startup if any + servlet that has load-on-startup >=0 fails its own startup. + If not specified, the attribute of the same name in the parent Host + configuration is used if specified. Otherwise the default value of + `false` is used. +
`fireRequestListenersOnForwards`	+ Set to `true` to fire any configured + ServletRequestListeners when Tomcat forwards a request. This is + primarily of use to users of CDI frameworks that use + ServletRequestListeners to configure the necessary environment for a + request. If not specified, the default value of `false` is + used. +
`logEffectiveWebXml`	+ Set to `true` if you want the effective web.xml used for a + web application to be logged (at INFO level) when the application + starts. The effective web.xml is the result of combining the + application's web.xml with any defaults configured by Tomcat and any + web-fragment.xml files and annotations discovered. If not specified, the + default value of `false` is used. +
`mapperContextRootRedirectEnabled`	+ If enabled, requests for a web application context root will be + redirected (adding a trailing slash) if necessary by the Mapper rather + than the default Servlet. This is more efficient but there are security + side effects. First, the existence of a web application or a directory + may be confirmed even though the user does not have access to that + directory. Secondly, any Valves and/or Filters - including those + providing security functionality - will not have an opportunity to + process the request. If not specified, the default value of + `true` is used. +
`mapperDirectoryRedirectEnabled`	+ If enabled, requests for a web application directory will be + redirected (adding a trailing slash) if necessary by the Mapper rather + than the default Servlet. This is more efficient but there are security + side effects. First, the existence of a web application or a directory + may be confirmed even though the user does not have access to that + directory. Secondly, any Valves and/or Filters - including those + providing security functionality - will not have an opportunity to + process the request. If not specified, the default value of + `false` is used. +
`override`	+ Set to `true` to ignore any settings in both the global + or Host default contexts. By default, settings + from a default context will be used but may be overridden by a setting + the same attribute explicitly for the Context. +
`parallelAnnotationScanning`	+ When set to `true` annotation scanning will be performed + using the utility executor. It will allow processing scanning in + parallel which may improve deployment type at the expense of higher + server load. If not specified, the default of `false` is + used. +
`path`	+ The context path of this web application, which is + matched against the beginning of each request URI to select the + appropriate web application for processing. All of the context paths + within a particular Host must be unique. + If you specify a context path of an empty string (""), you are + defining the default web application for this Host, which + will process all requests not assigned to other Contexts. + This attribute must only be used when statically defining a Context + in server.xml. In all other circumstances, the path will be inferred + from the filenames used for either the .xml context file or the + `docBase`. + + Even when statically defining a Context in server.xml, this attribute + must not be set unless either the `docBase` is not located + under the Host's `appBase` or + both `deployOnStartup` and `autoDeploy` are + `false`. If this rule is not followed, double deployment is + likely to result. +
`preemptiveAuthentication`	+ When set to `true` and the user presents credentials for a + resource that is not protected by a security constraint, if the + authenticator supports preemptive authentication (the standard + authenticators provided with Tomcat do) then the user' credentials + will be processed. If not specified, the default of `false` is + used. + +
`privileged`	+ Set to `true` to allow this context to use container + servlets, like the manager servlet. Use of the `privileged` + attribute will change the context's parent class loader to be the + Server class loader rather than the Shared class + loader. Note that in a default installation, the Common class + loader is used for both the Server and the Shared + class loaders. +
`reloadable`	+ Set to `true` if you want Catalina to monitor classes in + `/WEB-INF/classes/` and `/WEB-INF/lib` for + changes, and automatically reload the web application if a change + is detected. This feature is very useful during application + development, but it requires significant runtime overhead and is + not recommended for use on deployed production applications. That's + why the default setting for this attribute is false. You + can use the Manager web + application, however, to trigger reloads of deployed applications + on demand. +
`resourceOnlyServlets`	+ Comma separated list of Servlet names (as used in + `/WEB-INF/web.xml`) that expect a resource to be present. + Ensures that welcome files associated with Servlets that expect a + resource to be present (such as the JSP Servlet) are not used when there + is no resource present. This prevents issues caused by the clarification + of welcome file mapping in section 10.10 of the Servlet 3.0 + specification. If the + `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` + system property is set to + `true`, the default value of this attribute will be the empty + string, else the default value will be `jsp`. +
`sendRedirectBody`	+ If `true`, redirect responses will include a short + response body that includes details of the redirect as recommended by + RFC 2616. This is disabled by default since including a response body + may cause problems for some application component such as compression + filters. +
`sessionCookieDomain`	+ The domain to be used for all session cookies created for this + context. If set, this overrides any domain set by the web application. + If not set, the value specified by the web application, if any, will be + used. +
`sessionCookieName`	+ The name to be used for all session cookies created for this + context. If set, this overrides any name set by the web application. + If not set, the value specified by the web application, if any, will be + used, or the name `JSESSIONID` if the web application does + not explicitly set one. +
`sessionCookiePath`	+ The path to be used for all session cookies created for this + context. If set, this overrides any path set by the web application. + If not set, the value specified by the web application will be used, or + the context path used if the web application does not explicitly set + one. To configure all web application to use an empty path (this can be + useful for portlet specification implementations) set this attribute to + `/` in the global `CATALINA_BASE/conf/context.xml` + file. + Note: Once one web application using + `sessionCookiePath="/"` obtains a session, all + subsequent sessions for any other web application in the same host also + configured with `sessionCookiePath="/"` will always + use the same session ID. This holds even if the session is invalidated + and a new one created. This makes session fixation protection more + difficult and requires custom, Tomcat specific code to change the + session ID shared by the multiple applications. +
`sessionCookiePathUsesTrailingSlash`	+ Some browsers, such as Internet Explorer, Safari and Edge, will send + a session cookie for a context with a path of `/foo` with a + request to `/foobar` in violation of RFC6265. This could + expose a session ID from an application deployed at `/foo` to + an application deployed at `/foobar`. If the application + deployed at `/foobar` is untrusted, this could create a + security risk. However, it should be noted that RFC 6265, section 8.5 + makes clear that path alone should not be view as sufficient to prevent + untrusted applications accessing cookies from other applications. To + mitigate this risk, this attribute may be set to `true` and + Tomcat will add a trailing slash to the path associated with the session + cookie so, in the above example, the cookie path becomes /foo/. However, + with a cookie path of /foo/, browsers will no longer send the cookie + with a request to /foo. This should not be a problem unless there is a + servlet mapped to /*. In this case this attribute will need to be set to + `false` to disable this feature. The default value for this + attribute is `false`. +
`swallowAbortedUploads`	+ Set to `false` if Tomcat should not read any + additional request body data for aborted uploads and instead abort the + client connection. This setting is used in the following situations: + + + the size of the request body is larger than the + `maxPostSize` configured in the connector + the size limit of a MultiPart upload is reached + the servlet sets the response status to 413 (Request Entity Too + Large) + + + Not reading the additional data will free the request processing thread + more quickly. Unfortunately most HTTP clients will not read the response + if they cannot write the full request. + The default is `true`, so additional data will be + read. + Note if an error occurs during the request processing that triggers + a 5xx response, any unread request data will always be ignored and the + client connection will be closed once the error response has been + written. +
`swallowOutput`	+ If the value of this flag is `true`, the bytes output to + System.out and System.err by the web application will be redirected to + the web application logger. If not specified, the default value + of the flag is `false`. +
`tldValidation`	+ If the value of this flag is `true`, the TLD files + will be XML validated on context startup. If the + `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` + system property is set to + `true`, the default value of this attribute will be + `true`, else the default value will be `false`. + Setting this attribute to `true` will incur a performance + penalty. +
`useBloomFilterForArchives`	+ DEPRECATED: If this is `true` then a bloom filter will be + used to speed up archive lookups. This can be beneficial to the deployment + speed to web applications that contain very large amount of JARs. + If not specified, the default value of `false` will be + used. + This value can be overridden by archiveIndexStrategy in + Resources +
`useHttpOnly`	+ Should the HttpOnly flag be set on session cookies to prevent client + side script from accessing the session ID? Defaults to + `true`. +
`useRelativeRedirects`	+ Controls whether HTTP 1.1 and later location headers generated by a + call to + `javax.servlet.http.HttpServletResponse#sendRedirect(String)` + will use relative or absolute redirects. Relative redirects are more + efficient but may not work with reverse proxies that change the context + path. It should be noted that it is not recommended to use a reverse + proxy to change the context path because of the multiple issues it + creates. Absolute redirects should work with reverse proxies that change + the context path but may cause issues with the + `org.apache.catalina.filters.RemoteIpFilter` if the filter is + changing the scheme and/or port. If the + `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` + system property is set to + `true`, the default value of this attribute will be + `false`, else the default value will be `true`. + +
`validateClientProvidedNewSessionId`	+ When a client provides the ID for a new session, this attribute + controls whether that ID is validated. The only use case for using a + client provided session ID is to have a common session ID across + multiple web applications. Therefore, any client provided session ID + should already exist in another web application. If this check is + enabled, the client provided session ID will only be used if the session + ID exists in at least one other web application for the current host. + Note that the following additional tests are always applied, + irrespective of this setting: + + The session ID is provided by a cookie + The session cookie has a path of {@code /} + + If not specified, the default value of `true` will be + used. +
`wrapperClass`	+ Java class name of the `org.apache.catalina.Wrapper` + implementation class that will be used for servlets managed by this + Context. If not specified, a standard default value will be used. +
`xmlBlockExternal`	+ If the value of this flag is `true`, the parsing of + `web.xml`, `web-fragment.xml`, + `tomcat-web.xml`, `.tld`, `.jspx`, + `*.tagx` and `tagPlugins.xml` files for this web + application will not permit external entities to be loaded. If not + specified, the default value of `true` will be used. +
`xmlNamespaceAware`	+ If the value of this flag is `true`, the parsing of + `web.xml`, `web-fragment.xml` and + `tomcat-web.xml` files for this web application will be + namespace-aware. Note that `.tld`, `.jspx` and + `*.tagx` files are always parsed using a namespace-aware + parser and that the `tagPlugins.xml` file (if any) is never + parsed using a namespace-aware parser. Note also that if you turn this + flag on, you should probably also turn `xmlValidation` on. If + the `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` + system property is set to + `true`, the default value of this attribute will be + `true`, else the default value will be `false`. + Setting this attribute to `true` will incur a performance + penalty. +
`xmlValidation`	+ If the value of this flag is `true`, the parsing of + `web.xml`, `web-fragment.xml` and + `tomcat-web.xml` files for this web application will use a + validating parser. If the + `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` + system property is set to + `true`, the default value of this attribute will be + `true`, else the default value will be `false`. + Setting this attribute to `true` will incur a performance + penalty. +

+ Attribute +	+ Description +
`className`	+ Java class name of the implementation to use. This MUST be set to + org.apache.catalina.ha.authenticator.ClusterSingleSignOn. +
`cookieDomain`	+ Sets the host domain to be used for sso cookies. +
`mapSendOptions`	+ The Valve uses a replicated map. You can setup the flag for how this + map sends messages. The default value is `6` (synchronous). + Note that if you use asynchronous messaging it is possible for update + messages to be processed by the receiving node in a different order to + the order in which they were sent. +
`requireReauthentication`	+ Default false. Flag to determine whether each request needs to be + reauthenticated to the security Realm. If "true", this + Valve uses cached security credentials (username and password) to + reauthenticate to the Realm each request associated + with an SSO session. If "false", the Valve can itself authenticate + requests based on the presence of a valid SSO cookie, without + rechecking with the Realm. +
`rpcTimeout`	+ The Valve uses a replicated map. This is the timeout for messages + that transfer state to/from the other nodes in the cluster. If not + specified, a default value of `15000` milliseconds is used. + +
`terminateOnStartFailure`	+ Set to `true` if you wish this Valve to fail if the + underlying replication fails to start. If the Valve fails, then the + associated container will fail to start. If you set this attribute to + false, and the underlying replications fails to start, the Valve will + start and it will attempt to join the cluster and start replication as + part of the heartbeat process. If not specified, the default value of + `false` is used. +
`accessTimeout`	+ The timeout for a ping message. If a remote map does not respond within + this timeout period, its regarded as disappeared. + Default value is `5000` milliseconds. +

+ Attribute +	+ Description +
`addWebinfClassesResources`	+ This attribute controls if, in addition to static resources being + served from `META-INF/resources` inside web application JAR + files, static resources are also served from + `WEB-INF/classes/META-INF/resources`. This only applies to + web applications with a major version of 3 or higher. Since this is a + proprietary extension to the Servlet 3 specification, it is disabled by + default. To enable this feature, set the attribute to `true`. + +
`antiResourceLocking`	+ If `true`, Tomcat will prevent any file locking. + This will significantly impact startup time of applications, + but allows full webapp hot deploy and undeploy on platforms + or configurations where file locking can occur. + If not specified, the default value is `false`. + + Please note that setting this to `true` has some side + effects, including the disabling of JSP reloading in a running server: + see + Bugzilla 37668. + + Please note that setting this flag to `true` in + applications that are outside the `appBase` for the Host (the + `webapps` directory by default) will cause the application to + be deleted on Tomcat shutdown. You probably don't want + to do this, so think twice before setting antiResourceLocking=true on a + webapp that's outside the `appBase` for its Host. +
`clearReferencesHttpClientKeepAliveThread`	+ If `true` and an `sun.net.www.http.HttpClient` + keep-alive timer thread has been started by this web application and is + still running, Tomcat will change the context class loader for that + thread from the web application class loader to the parent of the web + application class loader to prevent a memory leak. Note that the + keep-alive timer thread will stop on its own once the keep-alives all + expire however, on a busy system that might not happen for some time. If + not specified, the default value of `true` will be used. +
`clearReferencesObjectStreamClassCaches`	+ If `true`, when the web application is stopped Tomcat + looks for `SoftReference`s to classes loaded by the web + application in the `ObjectStreamClass` class used for + serialization and clears any `SoftReference`s it finds. This + feature uses reflection to identify the `SoftReference`s and + therefore requires that the command line option + `-XaddExports:java.base/java.io=ALL-UNNAMED` is set + when running on Java 9 and above. If not specified, the default value of + `true` will be used. + The memory leak associated with `ObjectStreamClass` has + been fixed in Java 19 onwards, Java 17.0.4 onwards and Java 11.0.16 + onwards. The check will be disabled when running on a version + of Java that contains the fix. +
`clearReferencesRmiTargets`	+ If `true`, Tomcat looks for memory leaks associated with + RMI Targets and clears any it finds. This feature uses reflection to + identify the leaks and therefore requires that the command line option + `-XaddExports:java.rmi/sun.rmi.transport=ALL-UNNAMED` is set + when running on Java 9 and above. Applications without memory leaks + should operate correctly with this attribute set to `false`. + If not specified, the default value of `true` will be used. +
`clearReferencesStopThreads`	+ If `true`, Tomcat attempts to terminate threads that have + been started by the web application. Stopping threads is performed via + the deprecated (for good reason) `Thread.stop()` method and + is likely to result in instability. As such, enabling this should be + viewed as an option of last resort in a development environment and is + not recommended in a production environment. If not specified, the + default value of `false` will be used. If this feature is + enabled, web applications may take up to two seconds longer to stop as + executor threads are given up to two seconds to stop gracefully before + `Thread.stop()` is called on any remaining threads. +
`clearReferencesStopTimerThreads`	+ If `true`, Tomcat attempts to terminate + `java.util.Timer` threads that have been started by the web + application. Unlike standard threads, timer threads can be stopped + safely although there may still be side-effects for the application. If + not specified, the default value of `false` will be used. +
`clearReferencesThreadLocals`	+ If `true`, Tomcat attempts to clear + `java.lang.ThreadLocal` variables that have been populated + with classes loaded by the web application. If not specified, the + default value of `true` will be used. +
`copyXML`	+ Set to `true` if you want a context XML descriptor + embedded inside the application (located at + `/META-INF/context.xml`) to be copied to the owning + Host's `xmlBase` when the application + is deployed. On subsequent starts, the copied context XML descriptor + will be used in preference to any context XML descriptor embedded inside + the application even if the descriptor embedded inside the application + is more recent. The default is `false`. Note if + the deployXML attribute of the owning + Host is `false` or if the + copyXML attribute of the owning + Host is `true`, this attribute will + have no effect. +
`jndiExceptionOnFailedWrite`	+ If `true`, any attempt by an application to modify the + provided JNDI context with a call to bind(), unbind(), + createSubContext(), destroySubContext() or close() will trigger a + `javax.naming.OperationNotSupportedException` as required by + section EE.5.3.4 of the Java EE specification. This exception can be + disabled by setting this attribute to `false` in which case + any calls to modify the JNDI context will return without making + any changes and methods that return values will return + `null`. If not specified, the specification compliant default + of `true` will be used. +
`notFoundClassResourceCacheSize`	+ Class resources are not cached by the standard resources + implementation since they are loaded on first use and then the resource + is then no longer required. It does help, however, to cache classes that + are not found as in some scenarios the same class will be searched for + many times and the greater the number of JARs/classes, the longer that + search will take. An LRU cache is used and this attribute controls the + size of that cache. A value of less than 1 disables the cache. If not + specified, the default value of 1000 will be used. +
`renewThreadsWhenStoppingContext`	+ If `true`, when this context is stopped, Tomcat renews all + the threads from the thread pool that was used to serve this context. + This also requires that the + `ThreadLocalLeakPreventionListener` be configured in + `server.xml` and that the `threadRenewalDelay` + property of the `Executor` be >=0. If not specified, the + default value of `true` will be used. +
`skipMemoryLeakChecksOnJvmShutdown`	+ If `true`, Tomcat will not perform the usual memory leak + checks when the web application is stopped if that web application is + stopped as part of a JVM shutdown. If not specified, the default value + of `false` will be used. +
`unloadDelay`	+ Number of ms that the container will wait for servlets to unload. + If not specified, the default value is `2000` ms. +
`unpackWAR`	+ If `false`, the unpackWARs attribute of + the owning Host will be overridden and the WAR + file will not be unpacked. If `true`, the value of the owning + Host's unpackWARs + attribute will determine if the WAR is unpacked. If not specified, the + default value is `true`. +
`useNaming`	+ Set to `true` (the default) to have Catalina enable a + JNDI `InitialContext` for this web application that is + compatible with Java2 Enterprise Edition (J2EE) platform + conventions. +
`workDir`	+ Pathname to a scratch directory to be provided by this Context + for temporary read-write use by servlets within the associated web + application. This directory will be made visible to servlets in the + web application by a servlet context attribute (of type + `java.io.File`) named + `javax.servlet.context.tempdir` as described in the + Servlet Specification. If not specified, a suitable directory + underneath `$CATALINA_BASE/work` will be provided. +

+ Attribute +	+ Description +
`description`	+ Optional, human-readable description of this context + initialization parameter. +
`name`	+ The name of the context initialization parameter to be created. +
`override`	+ Set this to `false` if you do not want + a `<context-param>` for the same parameter name, + found in the web application deployment descriptor, to override the + value specified here. By default, overrides are allowed. +
`value`	+ The parameter value that will be presented to the application + when requested by calling + `ServletContext.getInitParameter()`. +

+ Attribute +	+ Description +
`auth`	+ Specify whether the web Application code signs on to the + corresponding resource manager programmatically, or whether the + Container will sign on to the resource manager on behalf of the + application. The value of this attribute must be + `Application` or `Container`. This + attribute is required if the web application + will use a `<resource-ref>` element in the web + application deployment descriptor, but is optional if the + application uses a `<resource-env-ref>` instead. +
`closeMethod`	+ Name of the zero-argument method to call on a singleton resource when + it is no longer required. This is intended to speed up clean-up of + resources that would otherwise happen as part of garbage collection. + This attribute is ignored if the `singleton` attribute is + `false`. + For `javax.sql.DataSource` and + `javax.sql.XADataSource` resources that implement + `AutoCloseable` such as Apache Commons DBCP 2 and the default + Apache Tomcat connection pool, this attribute is defaults to + `close`. This may be disabled by setting the attribute to the + empty string. For all other resource types no default is defined and no + close method will be called by default. +
`description`	+ Optional, human-readable description of this resource. +
`name`	+ The name of the resource to be created, relative to the + `java:comp/env` context. +
`scope`	+ Specify whether connections obtained through this resource + manager can be shared. The value of this attribute must be + `Shareable` or `Unshareable`. By default, + connections are assumed to be shareable. +
`singleton`	+ Specify whether this resource definition is for a singleton resource, + i.e. one where there is only a single instance of the resource. If this + attribute is `true`, multiple JNDI lookups for this resource + will return the same object. If this attribute is `false`, + multiple JNDI lookups for this resource will return different objects. + This attribute must be `true` for + `javax.sql.DataSource` resources to enable JMX registration + of the DataSource. The value of this attribute must be `true` + or `false`. By default, this attribute is `true`. + +
`type`	+ The fully qualified Java class name expected by the web + application when it performs a lookup for this resource. +

+ Attribute +	+ Description +
`global`	+ The name of the linked global resource in the + global JNDI context. +
`name`	+ The name of the resource link to be created, relative to the + `java:comp/env` context. +
`type`	+ The fully qualified Java class name expected by the web + application when it performs a lookup for this resource link. +
`factory`	+ The fully qualified Java class name for the class creating these objects. + This class should implement the `javax.naming.spi.ObjectFactory` interface. +

+ Attribute +	+ Description +
`username`	+ `username` value for the `getConnection(username, password)` + call on the linked global DataSource. + +
`password`	+ `password` value for the `getConnection(username, password)` + call on the linked global DataSource. + +

+ Attribute +	+ Description +
`allowEqualsInValue`	+ If this is `true` Tomcat will allow '`=`' + characters when parsing unquoted cookie values. If `false`, + cookie values containing '`=`' will be terminated when the + '`=`' is encountered and the remainder of the cookie value + will be dropped. + If not set the specification compliant default value of + `false` will be used. +
`allowHttpSepsInV0`	+ If this is `true` Tomcat will allow HTTP separators in + cookie names and values. + If not specified, the default specification compliant value of + `false` will be used. +
`allowNameOnly`	+ If this is `true` Tomcat will allow name only cookies + (with or without trailing '`=`') when parsing cookie headers. + If `false`, name only cookies will be dropped. + If not set the specification compliant default value of + `false` will be used. +
`alwaysAddExpires`	+ If this is `true` Tomcat will always add an expires + parameter to a SetCookie header even for cookies with version greater + than zero. This is to work around a known IE6 and IE7 bug that causes I + to ignore the Max-Age parameter in a SetCookie header. + If `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` is set + to `true`, the default of this setting will be + `false`, else the default value will be `true`. + +
`forwardSlashIsSeparator`	+ If this is `true` Tomcat will treat the forward slash + character ('`/`') as an HTTP separator when processing cookie + headers. If `org.apache.catalina.STRICT_SERVLET_COMPLIANCE` + is set to `true`, the default of this setting will be + `true`, else the default value will be `false`. + +
`sameSiteCookies`	+ Enables setting same-site cookie attribute. + + If value is `unset` then the same-site cookie attribute + won't be set. This is the default value. + + If value is `none` then the same-site cookie attribute + will be set and the cookie will always be sent in cross-site requests. + + If value is `lax` then the browser only sends the cookie + in same-site requests and cross-site top level GET requests. + + If value is `strict` then the browser prevents sending the + cookie in any cross-site request. +

+ Attribute +	+ Description +
`algorithm`	+ The name of the `java.security.MessageDigest` algorithm + used to encode user passwords stored in the database. If not specified, + user passwords are assumed to be stored in clear-text. +
`encoding`	+ Digesting the password requires that it is converted to bytes. This + attribute determines the character encoding to use for conversions + between characters and bytes. If not specified, UTF-8 will be used. +
`iterations`	+ The number of iterations to use when creating a new stored credential + from a clear text credential. +
`saltLength`	+ The length of the randomly generated salt to use when creating a + new stored credential from a clear text credential. +

+ Attribute +	+ Description +
`algorithm`	+ The name of the secret key algorithm used to encode user passwords + stored in the database. If not specified, a default of + `PBKDF2WithHmacSHA1` is used. +
`keyLength`	+ The length of key to generate for the stored credential. If not + specified, a default of `160` is used. +
`iterations`	+ The number of iterations to use when creating a new stored credential + from a clear text credential. +
`saltLength`	+ The length of the randomly generated salt to use when creating a + new stored credential from a clear text credential. +

+ Attribute +	+ Description +
`className`	+ The class of the implementation. The implementation has to implement the + `org.apache.catalina.Executor` interface. + This interface ensures that the object can be referenced through its `name` attribute + and that implements Lifecycle, so that it can be started and stopped with the container. + The default value for the className is `org.apache.catalina.core.StandardThreadExecutor` +
`name`	+ The name used to reference this pool in other places in server.xml. + The name is required and must be unique. +

+ Attribute +	+ Description +
`threadPriority`	+ (int) The thread priority for threads in the executor, the default is + `5` (the value of the `Thread.NORM_PRIORITY` constant) +
`daemon`	+ (boolean) Whether the threads should be daemon threads or not, the default is `true` +
`namePrefix`	+ (String) The name prefix for each thread created by the executor. + The thread name for an individual thread will be `namePrefix+threadNumber`. The default value is + `tomcat-exec-`. +
`maxThreads`	+ (int) The max number of active threads in this pool, default is `200` +
`minSpareThreads`	+ (int) The minimum number of threads (idle and active) always kept alive, default is `25` +
`maxIdleTime`	+ (int) The number of milliseconds before an idle thread shutsdown, unless the number of active threads are less + or equal to minSpareThreads. Default value is `60000`(1 minute) +
`maxQueueSize`	+ (int) The maximum number of runnable tasks that can queue up awaiting + execution before we reject them. Default value is `Integer.MAX_VALUE` +
`threadRenewalDelay`	+ (long) If a ThreadLocalLeakPreventionListener is configured, + it will notify this executor about stopped contexts. + After a context is stopped, threads in the pool are renewed. To avoid renewing all threads at the same time, + this option sets a delay between renewal of any 2 threads. The value is in ms, + default value is `1000` ms. If value is negative, threads are not renewed. +

+ Attribute +	+ Description +
`cors.allowed.origins`	+ A list of origins + that are allowed to access the resource. A `` can be + specified to enable access to resource from any origin. Otherwise, an + allow list of comma separated origins can be provided. Eg: `+ https://www.w3.org, https://www.apache.org`. + Defaults:* The empty String. (No origin is allowed to + access the resource). +
`cors.allowed.methods`	+ A comma separated list of HTTP methods that can be used to access the + resource, using cross-origin requests. These are the methods which will + also be included as part of `Access-Control-Allow-Methods` + header in pre-flight response. Eg: `GET, POST`. + Defaults: `GET, POST, HEAD, OPTIONS` +
`cors.allowed.headers`	+ A comma separated list of request headers that can be used when + making an actual request. These headers will also be returned as part + of `Access-Control-Allow-Headers` header in a pre-flight + response. Eg: `Origin,Accept`. Defaults: + `Origin, Accept, X-Requested-With, Content-Type, + Access-Control-Request-Method, Access-Control-Request-Headers` +
`cors.exposed.headers`	+ A comma separated list of headers other than simple response headers + that browsers are allowed to access. These are the headers which will + also be included as part of `Access-Control-Expose-Headers` + header in the pre-flight response. Eg: + `X-CUSTOM-HEADER-PING,X-CUSTOM-HEADER-PONG`. + Default: None. Non-simple headers are not exposed by + default. +
`cors.preflight.maxage`	+ The amount of seconds, browser is allowed to cache the result of the + pre-flight request. This will be included as part of + `Access-Control-Max-Age` header in the pre-flight response. + A negative value will prevent CORS Filter from adding this response + header to pre-flight response. Defaults: + `1800` +
`cors.support.credentials`	+ A flag that indicates whether the resource supports user credentials. + This flag is exposed as part of + `Access-Control-Allow-Credentials` header in a pre-flight + response. It helps browser determine whether or not an actual request + can be made using credentials. Defaults: + `false` +
`cors.request.decorate`	+ A flag to control if CORS specific attributes should be added to + HttpServletRequest object or not. Defaults: + `true` +

+ Attribute +	+ Description +
`denyStatus`	+ HTTP response status code that is used when rejecting denied + request. The default value is `403`. +
`enforce`	+ A flag to enable or disable enforcement. When enforcement is + disabled, the CsrfPreventionFilter will allow all requests and + log CSRF failures as DEBUG messages. The default is true, + enabling the enforcement of CSRF protection. +
`entryPoints`	+ A comma separated list of URLs that will not be tested for the + presence of a valid nonce. They are used to provide a way to navigate + back to a protected application after having navigated away from it. + Entry points will be limited to HTTP GET requests and should not trigger + any security sensitive actions. +
`nonceCacheSize`	+ The number of previously issued nonces that will be cached on a LRU + basis to support parallel requests, limited use of the refresh and back + in the browser and similar behaviors that may result in the submission + of a previous nonce rather than the current one. If not set, the default + value of 5 will be used. +
`nonceRequestParameterName`	+ The name of the request parameter used for the nonce. If not set, the + default value of `org.apache.catalina.filters.CSRF_NONCE` + will be used. +
`randomClass`	+ The name of the class to use to generate nonces. The class must be an + instance of `java.util.Random`. If not set, the default value + of `java.security.SecureRandom` will be used. +
`noNonceURLPatterns`	+ A list of URL patterns that will not have CSRF nonces added + to them. You may not want to add nonces to certain URLs to avoid + creating unique URLs which may defeat resource caching, etc. + + There are several types of patterns supported: + + + Prefix matches using a pattern that ends with a ``. + For example, `/images/`. + + Suffix matches using a pattern that begins with a ``. + For example, `.css`. + + Mime-type matches which begin with `mime:` and specify + one of the above matches which will be checked against the MIME type + of the URL filename. For example, `mime:image/`. + Note that the MIME-type will be determined using + `ServletContext.getMimeType`. + + A single complete regular expression pattern which begins and + ends with `/` (slash / solidus) symbols. For example + `//images/.\|/scripts/./`. The leading and trailing + `/` characters will be removed from the pattern before + being compiled. Note that there can be only a single pattern, + but that pattern can of course have as many alternatives as desired + by using the regular expression `\|` (`OR`) + operator. The regular expression will be matched against the entire + URL (i.e. match* not find semantics), and the regex + dialect is Java (`java.util.regex.Pattern`). + + + + The default is `.css, .js, .gif, .png, .jpg, .svg, .ico, .jpeg, *.mjs`. +

+ Attribute +	+ Description +
`denyStatus`	+ HTTP response status code that is used when rejecting denied + request. The default value is `403`. +
`pathsAcceptingParams`	+ A comma separated list of URLs that can accept nonces via request + parameter `X-CSRF-Token`. For use cases when a nonce information cannot + be provided via header, one can provide it via request parameters. If + there is a `X-CSRF-Token` header, it will be taken with preference over + any parameter with the same name in the request. Request parameters + cannot be used to fetch new nonce, only header can be used to request a + new nonce. +
`randomClass`	+ The name of the class to use to generate nonces. The class must be an + instance of `java.util.Random`. If not set, the default value + of `java.security.SecureRandom` will be used. +

+ Attribute +	+ Description +
`hstsEnabled`	+ Will an HTTP Strict Transport Security (HSTS) header + (`Strict-Transport-Security`) be set on the response for + secure requests. Any HSTS header already present will be replaced. See + RFC 6797 for further + details of HSTS. If not specified, the default value of + `true` will be used. +
`hstsMaxAgeSeconds`	+ The max age value that should be used in the HSTS header. Negative + values will be treated as zero. If not specified, the default value of + `0` will be used. +
`hstsIncludeSubDomains`	+ Should the includeSubDomains parameter be included in the HSTS + header. If not specified, the default value of `false` will + be used. +
`hstsPreload`	+ Should the preload parameter be included in the HSTS header. If not + specified, the default value of `false` will be used. See + https://hstspreload.org for + important information about this parameter. +
`antiClickJackingEnabled`	+ Should the anti click-jacking header (`X-Frame-Options`) + be set on the response. Any anti click-jacking header already present + will be replaced. If not specified, the default value of + `true` will be used. +
`antiClickJackingOption`	+ What value should be used for the anticlick-jacking header? Must be + one of `DENY`, `SAMEORIGIN`, + `ALLOW-FROM` (case-insensitive). If not specified, the + default value of `DENY` will be used. +
`antiClickJackingUri`	+ If ALLOW-FROM is used for antiClickJackingOption, + what URI should be allowed? If not specified, the default value of an + empty string will be used. +
`blockContentTypeSniffingEnabled`	+ Should the header that blocks content type sniffing + (`X-Content-Type-Options`) be set on every response. If + already present, the header will be replaced. If not specified, the + default value of `true` will be used. +
`xssProtectionEnabled`	+ Note: This setting is deprecated as support for the HTTP + header has been removed from all major browsers. The setting has been + removed in Tomcat 11.0.x onwards. + Should the header that enables the browser's cross-site scripting + filter protection (`X-XSS-Protection: 1; mode=block`) + be set on every response. If already present, the header + will be replaced. If not specified, the default value of + `false` will be used. +

+ Attribute +	+ Description +
`bucketDuration`	+ The number of seconds in a time bucket. Default is `60`. +
`bucketRequests`	+ The number of requests that are allowed in a time bucket. + Default is `300`. +
`enforce`	+ Set to false to allow requests through even when they exceed + the maximum allowed per time window. Your application code can + still inspect the Request Attribute + org.apache.catalina.filters.RateLimitFilter.Count to retrieve + the number of Requests made from that IP within the time window. + Default is `true`. +
`exposeHeaders`	+ Set to true to expose the configuration and state of the rate limiter + via an HTTP response header as per RateLimit + header fields for HTTP (draft). Default is `false`. +
`rateLimitClassName`	+ The full class name of an implementation of the RateLimiter + interface. Default is + "org.apache.catalina.util.FastRateLimiter", which is optimized + for efficiency. If you need exact rate limiting and can accept a small + decrease in efficiency, you can use + "org.apache.catalina.util.ExactRateLimiter" instead. +
`statusCode`	+ The status code to return when a request is dropped. + Default is `429`. +
`statusMessage`	+ The status message to return when a request is dropped. + Default is "Too many requests". +

+ Attribute +	+ Description +
`allow`	+ A regular expression (using `java.util.regex`) that the + remote client's IP address is compared to. If this attribute + is specified, the remote address MUST match for this request to be + accepted. If this attribute is not specified, all requests will be + accepted UNLESS the remote address matches a `deny` + pattern. +
`deny`	+ A regular expression (using `java.util.regex`) that the + remote client's IP address is compared to. If this attribute + is specified, the remote address MUST NOT match for this request to be + accepted. If this attribute is not specified, request acceptance is + governed solely by the `accept` attribute. +
`denyStatus`	+ HTTP response status code that is used when rejecting denied + request. The default value is `403`. For example, + it can be set to the value `404`. +

+ Attribute +	+ Description +
`allow`	+ A comma-separated list of IPv4 or IPv6 netmasks or addresses + that the remote client's IP address is matched against. + If this attribute is specified, the remote address MUST match + for this request to be accepted. If this attribute is not specified, + all requests will be accepted UNLESS the remote IP is matched by a + netmask in the `deny` attribute. + +
`deny`	+ A comma-separated list of IPv4 or IPv6 netmasks or addresses + that the remote client's IP address is matched against. + If this attribute is specified, the remote address MUST NOT match + for this request to be accepted. If this attribute is not specified, + request acceptance is governed solely by the `accept` + attribute. + +

Property	Value Before RemoteIpFilter	Value After RemoteIpFilter
request.remoteAddr	192.168.0.10	140.211.11.130
request.header`[`'x-forwarded-for'`]`	140.211.11.130, 192.168.0.10	null
request.header`[`'x-forwarded-by'`]`	null	null
request.header`[`'x-forwarded-proto'`]`	https	https
request.scheme	http	https
request.secure	false	true
request.serverPort	80	443

Property	Value Before RemoteIpFilter	Value After RemoteIpFilter
request.remoteAddr	192.168.0.10	untrusted-proxy
request.header`[`'x-forwarded-for'`]`	140.211.11.130, untrusted-proxy, proxy1	140.211.11.130
request.header`[`'x-forwarded-by'`]`	null	proxy1

Keyboard Shortcuts

${1}

${2}

${2}

${1}

${2}

${2}

${1}

${2}

${2}

${1}

${2}

${2}

${1}

${2}

${2}

${1}

${2}

${2}

欢迎使用mcg-helper研发助手

+ 拖拽控件 +

QQ交流群

csdn博客

视频教程

开源地址

版本信息

打赏支持

微信

支付宝

403 Access Denied

Advanced IO and Tomcat

Table of Contents

Introduction

Asynchronous writes

Deployment

Table of Contents

Background

Standard Directory Layout

Shared Library Files

Web Application Deployment Descriptor

Tomcat Context Descriptor

Deployment With Tomcat

Sample Application

Installation

Installation

JDK

Tomcat

Ant

Source Code Control

Introduction

Overview

Links

Development Processes

Table of Contents

Development Processes

One-Time Setup of Ant and Tomcat for Development

Create Project Source Code Directory

Edit Source Code and Pages

Build the Web Application

Test Your Web Application

Creating a Release

Sample Application

Sample Application Servlet

Sample Application JSP Page

Sample "Hello, World" Application

Source Organization

Table of Contents

Directory Structure

External Dependencies

Source Code Control

BUILD.XML Configuration File

Apache Portable Runtime (APR) based Native library for Tomcat

Table of Contents

Introduction

Installation

Windows

Linux

APR Components

APR Lifecycle Listener Configuration

APR Connectors Configuration

+ Attribute +	+ Description +
`enableLookups`	+ Should a DNS lookup be performed to provide a host name when calling + `ServletRequest#getRemoteHost()`. If not specified, the + default of `false` is used. +
`remoteIpHeader`	+ Name of the HTTP Header read by this valve that holds the list of + traversed IP addresses starting from the requesting client. If not + specified, the default of `x-forwarded-for` is used. +
`internalProxies`	+ Regular expression (using `java.util.regex`) that a + proxy's IP address must match to be considered an internal proxy. + Internal proxies that appear in the remoteIpHeader will + be trusted and will not appear in the proxiesHeader + value. If not specified the default value of `+ 10\.\d{1,3}\.\d{1,3}\.\d{1,3}\|192\.168\.\d{1,3}\.\d{1,3}\|169\.254\.\d{1,3}\.\d{1,3}\|127\.\d{1,3}\.\d{1,3}\.\d{1,3}\|100\.6[4-9]{1}\.\d{1,3}\.\d{1,3}\|100\.[7-9]{1}\d{1}\.\d{1,3}\.\d{1,3}\|100\.1[0-1]{1}\d{1}\.\d{1,3}\.\d{1,3}\|100\.12[0-7]{1}\.\d{1,3}\.\d{1,3}\|172\.1[6-9]{1}\.\d{1,3}\.\d{1,3}\|172\.2[0-9]{1}\.\d{1,3}\.\d{1,3}\|172\.3[0-1]{1}\.\d{1,3}\.\d{1,3}\|0:0:0:0:0:0:0:1\|::1\|fe[89ab]\p{XDigit}:.\|"f[cd]\p{XDigit}{2}+:. +` will be used. +
`proxiesHeader`	+ Name of the HTTP header created by this valve to hold the list of + proxies that have been processed in the incoming + remoteIpHeader. If not specified, the default of + `x-forwarded-by` is used. +
`requestAttributesEnabled`	+ Set to `true` to set the request attributes used by + AccessLog implementations to override the values returned by the + request for remote address, remote host, server port and protocol. + Request attributes are also used to enable the forwarded remote address + to be displayed on the status page of the Manager web application. + If not set, the default value of `true` will be used. +
`trustedProxies`	+ Regular expression (using `java.util.regex`) that a + proxy's IP address must match to be considered an trusted proxy. + Trusted proxies that appear in the remoteIpHeader will + be trusted and will appear in the proxiesHeader value. + If not specified, no proxies will be trusted. +
`protocolHeader`	+ Name of the HTTP Header read by this valve that holds the protocol + used by the client to connect to the proxy. If not specified, the + default of `X-Forwarded-Proto` is used. +
`hostHeader`	+ Name of the HTTP Header read by this valve that holds the host + used by the client to connect to the proxy. If not specified, the + default of `null` is used. +
`portHeader`	+ Name of the HTTP Header read by this valve that holds the port + used by the client to connect to the proxy. If not specified, the + default of `null` is used. +
`protocolHeaderHttpsValue`	+ Value of the protocolHeader to indicate that it is + an HTTPS request. If not specified, the default of `https` is + used. +
`httpServerPort`	+ Value returned by `ServletRequest.getServerPort()` + when the protocolHeader indicates `http` + protocol and no portHeader is present. If not + specified, the default of `80` is used. +
`httpsServerPort`	+ Value returned by `ServletRequest.getServerPort()` + when the protocolHeader indicates `https` + protocol and no portHeader is present. If not + specified, the default of `443` is used. +
`changeLocalName`	+ If `true`, the value returned by + `ServletRequest.getLocalName()` and + `ServletRequest.getServerName()` is modified by the this + filter. If not specified, the default of `false` is used. +
`changeLocalPort`	+ If `true`, the value returned by + `ServletRequest.getLocalPort()` and + `ServletRequest.getServerPort()` is modified by the this + filter. If not specified, the default of `false` is used. +

+ Attribute +	+ Description +
`encoding`	+ Name of the character encoding which should be set. +
`ignore`	+ Determines if any character encoding specified by the user agent is + ignored. If this attribute is `true`, any value provided by + the user agent is ignored. If `false`, the encoding is only + set if the user agent did not specify an encoding. The default value + is `false`. +

+ Attribute +	+ Description +
`appBase`	+ The Application Base directory for this virtual host. + This is the pathname of a directory that may contain web applications + to be deployed on this virtual host. You may specify an + absolute pathname, or a pathname that is relative to the + `$CATALINA_BASE` directory. See + Automatic Application + Deployment for more information on automatic recognition and + deployment of web applications. If not specified, the default of + `webapps` will be used. +
`xmlBase`	+ The XML Base directory for this virtual host. + This is the pathname of a directory that may contain context XML + descriptors to be deployed on this virtual host. You may specify an + absolute pathname for this directory, or a pathname that is relative + to the `$CATALINA_BASE` directory. See + Automatic Application + Deployment for more information on automatic recognition and + deployment of web applications. If not specified the default of + `conf/<engine_name>/<host_name>` will be used. +
`createDirs`	+ If set to `true`, Tomcat will attempt to create the + directories defined by the attributes `appBase` and + `xmlBase` during the startup phase. The default value is + `true`. If set to `true`, and directory creation + fails, an error message will be printed out but will not halt the + startup sequence. +
`autoDeploy`	+ This flag value indicates if Tomcat should check periodically for new + or updated web applications while Tomcat is running. If + `true`, Tomcat periodically checks the `appBase` + and `xmlBase` directories and deploys any new web + applications or context XML descriptors found. Updated web applications + or context XML descriptors will trigger a reload of the web application. + The default is `true`. See + Automatic Application + Deployment for more information. +
`backgroundProcessorDelay`	+ This value represents the delay in seconds between the + invocation of the backgroundProcess method on this host and + its child containers, including all contexts. + Child containers will not be invoked if their delay value is not + negative (which would mean they are using their own processing + thread). Setting this to a positive value will cause + a thread to be spawn. After waiting the specified amount of time, + the thread will invoke the backgroundProcess method on this host + and all its child containers. A host will use background processing to + perform live web application deployment related tasks. If not + specified, the default value for this attribute is -1, which means + the host will rely on the background processing setting of its parent + engine. +
`className`	+ Java class name of the implementation to use. This class must + implement the `org.apache.catalina.Host` interface. + If not specified, the standard value (defined below) will be used. +
`deployIgnore`	+ A regular expression defining paths to ignore when + `autoDeploy` and `deployOnStartup` are set. This + allows you to keep your configuration in a version control system, for + example, and not deploy a `.svn`, `.git` or other + configuration control system folder that happens to be in the + `appBase`. + This regular expression is relative to `appBase`. It is + also anchored, meaning the match is performed against the + entire file/directory name. So, `foo` matches only a file or + directory named `foo` but not `foo.war`, + `foobar`, or `myfooapp`. To match anything with + "foo", you could use `.foo.`. + See Automatic Application + Deployment for more information. +
`deployOnStartup`	+ This flag value indicates if web applications from this host should + be automatically deployed when Tomcat starts. The default is + `true`. See + Automatic Application + Deployment for more information. +
`failCtxIfServletStartFails`	+ Set to `true` to have each child contexts fail its startup + if any of its servlet that has load-on-startup >=0 fails its own + startup. + Each child context may override this attribute. + If not specified, the default value of `false` is + used. +
`name`	+ Usually the network name of this virtual host, as registered in your + Domain Name Service server. Regardless of the case used to + specify the host name, Tomcat will convert it to lower case internally. + One of the Hosts nested within an Engine MUST + have a name that matches the `defaultHost` setting for that + Engine. See Host Name Aliases for + information on how to assign more than one network name to the same + virtual host. The name can not contain a wildcard, this is only + valid in an Alias. +
`startStopThreads`	+ The number of threads this Host will use to start + child Context elements in parallel. The same + thread pool will be used to deploy new + Contexts if automatic deployment is being + used. + As the thread pool is shared at the Server level, if more than one + Host specifies this setting, only the maximum value will apply and will + be used for all except for the special value 1. If + not specified, the default value of 1 will be used. If 1 thread is + used then rather than using an `ExecutorService` the current + thread will be used. +
`undeployOldVersions`	+ This flag determines if Tomcat, as part of the auto deployment + process, will check for old, unused versions of web applications + deployed using parallel deployment and, if any are found, remove them. + This flag only applies if `autoDeploy` is `true`. + If not specified the default value of `false` will be used. + +

+ Attribute +	+ Description +
`copyXML`	+ Set to `true` if you want a context XML descriptor + embedded inside the application (located at + `/META-INF/context.xml`) to be copied to `xmlBase` + when the application is deployed. On subsequent starts, the copied + context XML descriptor will be used in preference to any context XML + descriptor embedded inside the application even if the descriptor + embedded inside the application is more recent. The default is + `false`. Note if deployXML is + `false`, this attribute will have no effect. +
`deployXML`	+ Set to `false` if you want to disable parsing the context + XML descriptor embedded inside the application (located at + `/META-INF/context.xml`). Security conscious environments + should set this to `false` to prevent applications from + interacting with the container's configuration. The administrator will + then be responsible for providing an external context configuration + file, and putting it in the location defined by the + xmlBase attribute. If this flag is `false`, + a descriptor is located at `/META-INF/context.xml` and no + descriptor is present in xmlBase then the context will + fail to start in case the descriptor contains necessary configuration + for secure deployment (such as a RemoteAddrValve) which should not be + ignored. The default is `true` unless a security manager is + enabled when the default is `false`. When running under a + security manager this may be enabled on a per web application basis by + granting the + `org.apache.catalina.security.DeployXmlPermission` to the web + application. The Manager and Host Manager applications are granted this + permission by default so that they continue to work when running under a + security manager. +
`errorReportValveClass`	+ Java class name of the error reporting valve which will be used + by this Host. The responsibility of this valve is to output error + reports. Setting this property allows to customize the look of the + error pages which will be generated by Tomcat. This class must + implement the + `org.apache.catalina.Valve` interface. If none is specified, + the value `org.apache.catalina.valves.ErrorReportValve` + will be used by default. if set to an empty string, the error report + will be disabled. +
`unpackWARs`	+ Set to `true` if you want web applications that are + placed in the `appBase` directory as web application + archive (WAR) files to be unpacked into a corresponding disk directory + structure, `false` to run such web applications directly + from a WAR file. The default is `true`. See + Automatic Application + Deployment for more information. + Note: If Tomcat expands the WAR file then it will add a file + (`/META-INF/war-tracking`) to the unpacked directory + structure which it uses to detect changes in the WAR file while Tomcat + is not running. Any such change will trigger the deletion of the + expanded directory and the deployment of the updated WAR file when + Tomcat next starts. + Note: Running with this option set to `false` will incur + a performance penalty. To avoid a significant performance penalty, the + web application should be configured such that class scanning for + Servlet 3.0+ pluggability features is not required. Users may also wish + to consider the ExtractingRoot + Resources implementation. +
`workDir`	+ Pathname to a scratch directory to be used by applications for + this Host. Each application will have its own sub directory with + temporary read-write use. Configuring a Context workDir will override + use of the Host workDir configuration. This directory will be made + visible to servlets in the web application by a servlet context + attribute (of type `java.io.File`) named + `javax.servlet.context.tempdir` as described in the + Servlet Specification. If not specified, a suitable directory + underneath `$CATALINA_BASE/work` will be provided. +

+ Attribute +	+ Description +
`pollerThreadPriority`	+ (int)The priority of the poller threads. + The default value is `5` (the value of the + `java.lang.Thread.NORM_PRIORITY` constant). See the JavaDoc + for the `java.lang.Thread` class for more details on what + this priority means. +
`selectorTimeout`	+ (int)The time in milliseconds to timeout on a select() for the + poller. This value is important, since connection clean up is done on + the same thread, so do not set this value to an extremely high one. The + default value is `1000` milliseconds. +
`useSendfile`	+ (bool)Use this attribute to enable or disable sendfile capability. + The default value is `true`. Note that the use of sendfile + will disable any compression that Tomcat may otherwise have performed on + the response. +
`socket.directBuffer`	+ (bool)Boolean value, whether to use direct ByteBuffers or java mapped + ByteBuffers. If `true` then + `java.nio.ByteBuffer.allocateDirect()` is used to allocate + the buffers, if `false` then + `java.nio.ByteBuffer.allocate()` is used. The default value + is `false`. + When you are using direct buffers, make sure you allocate the + appropriate amount of memory for the direct memory space. On Sun's JDK + that would be something like `-XX:MaxDirectMemorySize=256m`. + +
`socket.directSslBuffer`	+ (bool)Boolean value, whether to use direct ByteBuffers or java mapped + ByteBuffers for the SSL buffers. If `true` then + `java.nio.ByteBuffer.allocateDirect()` is used to allocate + the buffers, if `false` then + `java.nio.ByteBuffer.allocate()` is used. The default value + is `false`. + When you are using direct buffers, make sure you allocate the + appropriate amount of memory for the direct memory space. On Oracle's JDK + that would be something like `-XX:MaxDirectMemorySize=256m`. + +
`socket.appReadBufSize`	+ (int)Each connection that is opened up in Tomcat get associated with + a read ByteBuffer. This attribute controls the size of this buffer. By + default this read buffer is sized at `8192` bytes. For lower + concurrency, you can increase this to buffer more data. For an extreme + amount of keep alive connections, decrease this number or increase your + heap size. +
`socket.appWriteBufSize`	+ (int)Each connection that is opened up in Tomcat get associated with + a write ByteBuffer. This attribute controls the size of this buffer. By + default this write buffer is sized at `8192` bytes. For low + concurrency you can increase this to buffer more response data. For an + extreme amount of keep alive connections, decrease this number or + increase your heap size. + The default value here is pretty low, you should up it if you are not + dealing with tens of thousands concurrent connections. +
`socket.bufferPool`	+ (int)The NIO connector uses a class called NioChannel that holds + elements linked to a socket. To reduce garbage collection, the NIO + connector caches these channel objects. This value specifies the size of + this cache. The default value is `500`, and represents that + the cache will hold 500 NioChannel objects. Other values are + `-1` for unlimited cache and `0` for no cache. +
`socket.bufferPoolSize`	+ (int)The NioChannel pool can also be size based, not used object + based. The size is calculated as follows: + NioChannel + `buffer size = read buffer size + write buffer size` + SecureNioChannel `buffer size = application read buffer size + + application write buffer size + network read buffer size + + network write buffer size` + The value is in bytes, the default value is `10241024100` + (100MB). +
`socket.processorCache`	+ (int)Tomcat will cache SocketProcessor objects to reduce garbage + collection. The integer value specifies how many objects to keep in the + cache at most. The default is `500`. Other values are + `-1` for unlimited cache and `0` for no cache. +
`socket.keyCache`	+ (int)Tomcat will cache KeyAttachment objects to reduce garbage + collection. The integer value specifies how many objects to keep in the + cache at most. The default is `500`. Other values are + `-1` for unlimited cache and `0` for no cache. +
`socket.eventCache`	+ (int)Tomcat will cache PollerEvent objects to reduce garbage + collection. The integer value specifies how many objects to keep in the + cache at most. The default is `500`. Other values are + `-1` for unlimited cache and `0` for no cache. +
`unixDomainSocketPath`	+ Where supported, the path to a Unix Domain Socket that this + Connector will create and await incoming connections. + When this is specified, the otherwise mandatory `port` + attribute may be omitted. +
`unixDomainSocketPathPermissions`	+ Where supported, the posix permissions that will be applied to the + to the Unix Domain Socket specified with + `unixDomainSocketPath` above. The + permissions are specified as a string of nine characters, in three sets + of three: (r)ead, (w)rite and e(x)ecute for owner, group and others + respectively. If a permission is not granted, a hyphen is used. If + unspecified, the permissions default to `rw-rw-rw-`. +
`useInheritedChannel`	+ (bool)Defines if this connector should inherit an inetd/systemd network socket. + Only one connector can inherit a network socket. This can option can be + used to automatically start Tomcat once a connection request is made to + the systemd super daemon's port. + The default value is `false`. See the JavaDoc + for the `java.nio.channels.spi.SelectorProvider` class for + more details. +

+ Attribute +	+ Description +
`deferAccept`	+ Sets the `TCP_DEFER_ACCEPT` flag on the listening socket + for this connector. The default value is `true` where + `TCP_DEFER_ACCEPT` is supported by the operating system, + otherwise it is `false`. +
`ipv6v6only`	+ If listening on an IPv6 address on a dual stack system, should the + connector only listen on the IPv6 address? If not specified the default + is `false` and the connector will listen on the IPv6 address + and the equivalent IPv4 address if present. +
`pollerThreadCount`	+ Number of threads used to poll kept alive connections. On Windows the + default is chosen so that the sockets managed by each thread is + less than 1024. For Linux the default is 1. Changing the default on + Windows is likely to have a negative performance impact. +
`pollTime`	+ Duration of a poll call in microseconds. Lowering this value will + slightly decrease latency of connections being kept alive in some cases, + but will use more CPU as more poll calls are being made. The default + value is 2000 (2ms). +
`sendfileSize`	+ Amount of sockets that the poller responsible for sending static + files asynchronously can hold at a given time. Extra connections will be + closed right away without any data being sent (resulting in a zero + length file on the client side). Note that in most cases, sendfile is a + call that will return right away (being taken care of "synchronously" by + the kernel), and the sendfile poller will not be used, so the amount of + static files which can be sent concurrently is much larger than the + specified amount. The default value is 1024. +
`threadPriority`	+ (int)The priority of the acceptor and poller threads. + The default value is `5` (the value of the + `java.lang.Thread.NORM_PRIORITY` constant). See the JavaDoc + for the `java.lang.Thread` class for more details on what + this priority means. +
`useSendfile`	+ (bool)Use this attribute to enable or disable sendfile capability. + The default value is `true`. Note that the use of sendfile + will disable any compression that Tomcat may otherwise have performed on + the response. +

+ Attribute +	+ Description +
`certificateRevocationListFile`	+ Name of the file that contains the concatenated certificate revocation + lists for the certificate authorities. The format is PEM-encoded. If not + defined, client certificates will not be checked against a certificate + revocation list (unless an OpenSSL based connector is used and + certificateRevocationListPath is defined). Relative paths + will be resolved against `$CATALINA_BASE`. JSSE based + connectors may also specify a URL for this attribute. +
`certificateRevocationListPath`	+ OpenSSL only. + Name of the directory that contains the certificate revocation lists + for the certificate authorities. The format is PEM-encoded. Relative paths + will be resolved against `$CATALINA_BASE`. +
`certificateVerification`	+ Set to `required` if you want the SSL stack to require a + valid certificate chain from the client before accepting a connection. + Set to `optional` if you want the SSL stack to request a client + Certificate, but not fail if one isn't presented. Set to + `optionalNoCA` if you want client certificates to be optional + and you don't want Tomcat to check them against the list of trusted CAs. + If the TLS provider doesn't support this option (OpenSSL does, JSSE does + not) it is treated as if `optional` was specified. If + `optionalNoCA` is configured then OCSP will also be disabled. + `none` value (which is the default) will not require a + certificate chain unless the client requests a resource protected by a + security constraint that uses `CLIENT-CERT` authentication. +
`certificateVerificationDepth`	+ The maximum number of intermediate certificates that will be allowed + when validating client certificates. If not specified, the default value + of 10 will be used. +
`caCertificateFile`	+ OpenSSL only. + Name of the file that contains the concatenated certificates for the + trusted certificate authorities. The format is PEM-encoded. +
`caCertificatePath`	+ OpenSSL only. + Name of the directory that contains the certificates for the trusted + certificate authorities. The format is PEM-encoded. +
`ciphers`	+ The ciphers to enable using the OpenSSL syntax. (See the OpenSSL + documentation for the list of ciphers supported and the syntax). + Alternatively, a comma separated list of ciphers using the standard + OpenSSL cipher names or the standard JSSE cipher names may be used. + Different versions of OpenSSL may interpret the same cipher string + differently. For example, the `CCM8` ciphers were moved from + `HIGH` to `MEDIUM` in OpenSSL 3.2. Regardless of + the OpenSSL or JSSE version used, Tomcat converts the provided cipher + value to a list of ciphers in a manner consistent with the latest OpenSSL + development branch. This list of ciphers is then passed to the SSL + implementation. + Only the ciphers that are supported by the SSL implementation will be + used. Any ciphers in the list derived from a non-default cipher string + that are not supported by the SSL implementation will be logged in a + `WARNING` message when the Connector starts. The warning can be + avoided by providing an explicit list of ciphers that are supported by the + configured SSL implementation. + If not specified, a default (using the OpenSSL notation) of + `HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!kRSA` will be + used. + Note that, by default, the order in which ciphers are defined is + treated as an order of preference. See `honorCipherOrder`. +
`disableCompression`	+ OpenSSL only. + Configures if compression is disabled. The default is + `true`. If the OpenSSL version used does not support disabling + compression then the default for that OpenSSL version will be used. +
`disableSessionTickets`	+ OpenSSL only. + Disables use of TLS session tickets (RFC 5077) if set to + `true`. Default is `false`. Note that when TLS + session tickets are in use, the full peer certificate chain will only be + available on the first connection. Subsequent connections (that use a + ticket to estrablish the TLS session) will only have the peer certificate, + not the full chain. +
`honorCipherOrder`	+ Set to `true` to enforce the server's cipher order + (from the `ciphers` setting) instead of allowing + the client to choose the cipher. The default is `false`. +
`hostName`	+ The name of the SSL Host. This should either be the fully qualified + domain name (e.g. `tomcat.apache.org`) or a wild card domain + name (e.g. `*.apache.org`). If not specified, the default value + of `_default_` will be used. Provided values are always + converted to lower case. +
`insecureRenegotiation`	+ OpenSSL only. + Configures if insecure renegotiation is allowed. The default is + `false`. If the OpenSSL version used does not support + configuring if insecure renegotiation is allowed then the default for that + OpenSSL version will be used. +
`keyManagerAlgorithm`	+ JSSE only. + The `KeyManager` algorithm to be used. This defaults to + `KeyManagerFactory.getDefaultAlgorithm()` which returns + `SunX509` for Sun JVMs. IBM JVMs return + `IbmX509`. For other vendors, consult the JVM + documentation for the default value. +
`protocols`	+ The names of the protocols to support when communicating with clients. + This should be a list of any combination of the following: + + SSLv2Hello SSLv3 TLSv1 TLSv1.1 + TLSv1.2 TLSv1.3 all + Each token in the list can be prefixed with a plus sign ("+") + or a minus sign ("-"). A plus sign adds the protocol, a minus sign + removes it form the current list. The list is built starting from + an empty list. + The token `all` is an alias for + `SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2,TLSv1.3`. + Note that `TLSv1.3` is only supported for JSSE when using a + JVM that implements `TLSv1.3`. + Note that `SSLv2Hello` will be ignored for OpenSSL based + secure connectors. If more than one protocol is specified for an OpenSSL + based secure connector it will always support `SSLv2Hello`. If a + single protocol is specified it will not support + `SSLv2Hello`. + Note that `SSLv2` and `SSLv3` are inherently + unsafe. + If not specified, the default value of `all` will be + used. +
`revocationEnabled`	+ JSSE only. + Should the JSSE provider enable certificate revocation checks? If + certificateRevocationListFile is set then this attribute + is ignored and revocation checks are always enabled. This attribute is + intended to enable revocation checks that have been configured for the + current JSSE provider via other means. If not specified, a default of + `false` is used. +
`sessionCacheSize`	+ The number of SSL sessions to maintain in the session cache. Specify + `-1` to use the implementation default. Values of zero and + above are passed to the implementation. Zero is used to specify an + unlimited cache size and is not recommended. If not specified, a default + of `-1` is used. +
`sessionTimeout`	+ The time, in seconds, after the creation of an SSL session that it will + timeout. Specify `-1` to use the implementation default. Values + of zero and above are passed to the implementation. Zero is used to + specify an unlimited timeout and is not recommended. If not specified, a + default of 86400 (24 hours) is used. +
`sslProtocol`	+ JSSE only. + The SSL protocol(s) to use (a single value may enable multiple + protocols - see the JVM documentation for details). If not specified, the + default is `TLS`. The permitted values may be obtained from the + JVM documentation for the allowed values for algorithm when creating an + `SSLContext` instance e.g. + + Oracle Java 7. Note: There is overlap between this attribute and + `protocols`. +
`trustManagerClassName`	+ JSSE only. + The name of a custom trust manager class to use to validate client + certificates. The class must have a zero argument constructor and must + also implement `javax.net.ssl.X509TrustManager`. If this + attribute is set, the trust store attributes may be ignored. +
`truststoreAlgorithm`	+ JSSE only. + The algorithm to use for truststore. If not specified, the default + value returned by + `javax.net.ssl.TrustManagerFactory.getDefaultAlgorithm()` is + used. +
`truststoreFile`	+ JSSE only. + The trust store file to use to validate client certificates. The + default is the value of the `javax.net.ssl.trustStore` system + property. If neither this attribute nor the default system property is + set, no trust store will be configured. Relative paths + will be resolved against `$CATALINA_BASE`. A URL may also be + used for this attribute. +
`truststorePassword`	+ JSSE only. + The password to access the trust store. The default is the value of the + `javax.net.ssl.trustStorePassword` system property. If that + property is null, no trust store password will be configured. If an + invalid trust store password is specified, a warning will be logged and an + attempt will be made to access the trust store without a password which + will skip validation of the trust store contents. +
`truststoreProvider`	+ JSSE only. + The name of the truststore provider to be used for the server + certificate. The default is the value of the + `javax.net.ssl.trustStoreProvider` system property. If + that property is null and a single certificate has been configured for + this TLS virtual host then default will be the value of + `keystoreProvider` of the single certificate. If none of these + identify a default, the list of registered providers is traversed in + preference order and the first provider that supports the + `truststoreType` is used. + +
`truststoreType`	+ JSSE only. + The type of key store used for the trust store. The default is the + value of the `javax.net.ssl.trustStoreType` system property. If + that property is null, a single certificate has been configured for this + TLS virtual host and that certificate has a `keystoreType` that + is not `PKCS12` then the default will be the + `keystoreType` of the single certificate. If none of these + identify a default, the default will be `JKS`. See the notes on + key store types below. +

+ Attribute +	+ Description +
`certificateFile`	+ Name of the file that contains the server certificate. The format is + PEM-encoded. Relative paths will be resolved against + `$CATALINA_BASE`. + In addition to the certificate, the file can also contain as optional + elements DH parameters and/or an EC curve name for ephemeral keys, as + generated by `openssl dhparam` and `openssl ecparam`, + respectively. The output of the respective OpenSSL command can simply + be concatenated to the certificate file. + This attribute is required unless + certificateKeystoreFile is specified. +
`certificateChainFile`	+ Name of the file that contains the certificate chain associated with + the server certificate used. The format is + PEM-encoded. Relative paths will be resolved against + `$CATALINA_BASE`. + The certificate chain used for Tomcat should not include the server + certificate as its first element. + Note that when using more than one certificate for different types, + they all must use the same certificate chain. +
`certificateKeyAlias`	+ JSSE only. + The alias used for the server key and certificate in the keystore. If + not specified, the first key read from the keystore will be used. The + order in which keys are read from the keystore is implementation + dependent. It may not be the case that keys are read from the keystore in + the same order as they were added. If more than one key is present in the + keystore it is strongly recommended that a keyAlias is configured to + ensure that the correct key is used. +
`certificateKeyFile`	+ Name of the file that contains the server private key. The format is + PEM-encoded. The default value is the value of + certificateFile and in this case both certificate and + private key have to be in this file (NOT RECOMMENDED). Relative paths will + be resolved against `$CATALINA_BASE`. +
`certificateKeyPassword`	+ The password used to access the private key associated with the server + certificate from the specified file. + If not specified, the default behaviour for JSSE is to use the + certificateKeystorePassword. For OpenSSL the default + behaviour is not to use a password, but OpenSSL will prompt for one, + if required. +
`certificateKeyPasswordFile`	+ The password file used to access the private key associated with the server + certificate from the specified file. This attribute takes precedence over + certificateKeyPassword. + If not specified, the default behaviour for JSSE is to use the + certificateKeystorePasswordFile. For OpenSSL the default + behaviour is not to use a password (file), but OpenSSL will prompt for one, + if required. +
`certificateKeystoreFile`	+ JSSE only. + The pathname of the keystore file where you have stored the server + certificate and key to be loaded. By default, the pathname is the file + `.keystore` in the operating system home directory of the user + that is running Tomcat. If your `keystoreType` doesn't need a + file use `""` (empty string) or `NONE` for this + parameter. Relative paths will be resolved against + `$CATALINA_BASE`. A URI may also be used for this attribute. + When using a domain keystore (`keystoreType` of + `DKS`), this parameter should be the URI to the domain + keystore. + This attribute is required unless + certificateFile is specified. +
`certificateKeystorePassword`	+ JSSE only. + The password to use to access the keystore containing the server's + private key and certificate. If not specified, a default of + `changeit` will be used. +
`certificateKeystorePasswordFile`	+ JSSE only. + The password file to use to access the keystore containing the server's + private key and certificate. This attribute takes precedence over + certificateKeystorePassword. +
`certificateKeystoreProvider`	+ JSSE only. + The name of the keystore provider to be used for the server + certificate. If not specified, the value of the system property + `javax.net.ssl.keyStoreProvider` is used. If neither this + attribute nor the system property are set, the list of registered + providers is traversed in preference order and the first provider that + supports the `keystoreType` is used. + +
`certificateKeystoreType`	+ JSSE only. + The type of keystore file to be used for the server certificate. + If not specified, the value of the system property + `javax.net.ssl.keyStoreType` is used. If neither this attribute + nor the system property are set, a default value of "`JKS`". is + used. See the notes on key store types + below. +
`type`	+ The type of certificate. This is used to identify the ciphers that are + compatible with the certificate. It must be one of `UNDEFINED`, + `RSA`, `DSA` or `EC`. If only one + Certificate is nested within a `SSLHostConfig` + then this attribute is not required and will default to + `UNDEFINED`. If multiple Certificates are + nested within a `SSLHostConfig` then this attribute is required + and each Certificate must have a unique type. +

+ Attribute +	+ Description +
`name`	+ The name of the configuration file command. +
`value`	+ The value to use for the configuration file command. +

+ Attribute +	+ Description +
`algorithm`	+ This is an alias for the `keyManagerAlgorithm` attribute of + the SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`ciphers`	+ This is an alias for the `ciphers` attribute of the + SSLHostConfig element with the + `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`clientAuth`	+ This is an alias for the `certificateVerification` attribute + of the SSLHostConfig element + with the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`crlFile`	+ This is an alias for the `certificateRevocationListFile` + attribute of the SSLHostConfig + element with the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`keyAlias`	+ This is an alias for the `certificateKeyAlias` attribute of + the first Certificate element + nested in the SSLHostConfig + element with the `hostName` of `_default_`. If this + Certificate and/or + SSLHostConfig element is not + explicitly defined, they will be created. +
`keyPass`	+ This is an alias for the `certificateKeyPassword` attribute + of the first Certificate element + nested in the SSLHostConfig + element with the `hostName` of `_default_`. If this + Certificate and/or + SSLHostConfig element is not + explicitly defined, they will be created. +
`keystoreFile`	+ This is an alias for the `certificateKeystoreFile` attribute + of the first Certificate element + nested in the SSLHostConfig + element with the `hostName` of `_default_`. If this + Certificate and/or + SSLHostConfig element is not + explicitly defined, they will be created. +
`keystorePass`	+ This is an alias for the `certificateKeystorePassword` + attribute of the first + Certificate element nested in the + SSLHostConfig + element with the `hostName` of `_default_`. If this + Certificate and/or + SSLHostConfig element is not + explicitly defined, they will be created. +
`keystoreProvider`	+ This is an alias for the `certificateKeystoreProvider` + attribute of the first + Certificate element nested in the + SSLHostConfig + element with the `hostName` of `_default_`. If this + Certificate and/or + SSLHostConfig element is not + explicitly defined, they will be created. +
`keystoreType`	+ This is an alias for the `certificateKeystoreType` attribute + of the first Certificate element + nested in the SSLHostConfig + element with the `hostName` of `_default_`. If this + Certificate and/or + SSLHostConfig element is not + explicitly defined, they will be created. +
`sessionCacheSize`	+ This is an alias for the `sessionCacheSize` attribute of the + SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`sessionTimeout`	+ This is an alias for the `sessionTimeout` attribute of the + SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`sslEnabledProtocols`	+ This is an alias for the `protocols` attribute of the + SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`sslProtocol`	+ This is an alias for the `sslProtocol` attribute of the + SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`trustManagerClassName`	+ This is an alias for the `trustManagerClassName` attribute + of the SSLHostConfig element + with the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`trustMaxCertLength`	+ This is an alias for the `certificateVerificationDepth` + attribute of the SSLHostConfig + element with the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`truststoreAlgorithm`	+ This is an alias for the `truststoreAlgorithm` attribute of + SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`truststoreFile`	+ This is an alias for the `truststoreFile` attribute of + SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`truststorePass`	+ This is an alias for the `truststorePassword` attribute of + SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`truststoreProvider`	+ This is an alias for the `truststoreProvider` attribute of + SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`truststoreType`	+ This is an alias for the `truststoreType` attribute of + SSLHostConfig element with + the `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +
`useServerCipherSuitesOrder`	+ This is an alias for the `honorCipherOrder` attribute of the + SSLHostConfig element with + `hostName` of `_default_`. If this + SSLHostConfig element is not + explicitly defined, it will be created. +