Details | Last modification | View Log | RSS feed
| Rev | Author | Line No. | Line |
|---|---|---|---|
| 771 | blopes | 1 | <!DOCTYPE html SYSTEM "about:legacy-compat"> |
| 2 | <html lang="en"><head><META http-equiv="Content-Type" content="text/html; charset=UTF-8"><link href="./images/docs-stylesheet.css" rel="stylesheet" type="text/css"><title>Apache Tomcat 9 (9.0.112) - Security Considerations</title></head><body><div id="wrapper"><header><div id="header"><div><div><div class="logo noPrint"><a href="https://tomcat.apache.org/"><img alt="Tomcat Home" src="./images/tomcat.png"></a></div><div style="height: 1px;"></div><div class="asfLogo noPrint"><a href="https://www.apache.org/" target="_blank"><img src="./images/asf-logo.svg" alt="The Apache Software Foundation" style="width: 266px; height: 83px;"></a></div><h1>Apache Tomcat 9</h1><div class="versionInfo"> |
||
| 3 | Version 9.0.112, |
||
| 4 | <time datetime="2025-11-06">Nov 6 2025</time></div><div style="height: 1px;"></div><div style="clear: left;"></div></div></div></div></header><div id="middle"><div><div id="mainLeft" class="noprint"><div><nav><div><h2>Links</h2><ul><li><a href="index.html">Docs Home</a></li><li><a href="https://cwiki.apache.org/confluence/display/TOMCAT/FAQ">FAQ</a></li></ul></div><div><h2>User Guide</h2><ul><li><a href="introduction.html">1) Introduction</a></li><li><a href="setup.html">2) Setup</a></li><li><a href="appdev/index.html">3) First webapp</a></li><li><a href="deployer-howto.html">4) Deployer</a></li><li><a href="manager-howto.html">5) Manager</a></li><li><a href="host-manager-howto.html">6) Host Manager</a></li><li><a href="realm-howto.html">7) Realms and AAA</a></li><li><a href="security-manager-howto.html">8) Security Manager</a></li><li><a href="jndi-resources-howto.html">9) JNDI Resources</a></li><li><a href="jndi-datasource-examples-howto.html">10) JDBC DataSources</a></li><li><a href="class-loader-howto.html">11) Classloading</a></li><li><a href="jasper-howto.html">12) JSPs</a></li><li><a href="ssl-howto.html">13) SSL/TLS</a></li><li><a href="ssi-howto.html">14) SSI</a></li><li><a href="cgi-howto.html">15) CGI</a></li><li><a href="proxy-howto.html">16) Proxy Support</a></li><li><a href="mbeans-descriptors-howto.html">17) MBeans Descriptors</a></li><li><a href="default-servlet.html">18) Default Servlet</a></li><li><a href="cluster-howto.html">19) Clustering</a></li><li><a href="balancer-howto.html">20) Load Balancer</a></li><li><a href="connectors.html">21) Connectors</a></li><li><a href="monitoring.html">22) Monitoring and Management</a></li><li><a href="logging.html">23) Logging</a></li><li><a href="apr.html">24) APR/Native</a></li><li><a href="virtual-hosting-howto.html">25) Virtual Hosting</a></li><li><a href="aio.html">26) Advanced IO</a></li><li><a href="maven-jars.html">27) Mavenized</a></li><li><a href="security-howto.html">28) Security Considerations</a></li><li><a href="windows-service-howto.html">29) Windows Service</a></li><li><a href="windows-auth-howto.html">30) Windows Authentication</a></li><li><a href="jdbc-pool.html">31) Tomcat's JDBC Pool</a></li><li><a href="web-socket-howto.html">32) WebSocket</a></li><li><a href="rewrite.html">33) Rewrite</a></li><li><a href="cdi.html">34) CDI 2 and JAX-RS</a></li><li><a href="graal.html">35) AOT/GraalVM Support</a></li></ul></div><div><h2>Reference</h2><ul><li><a href="RELEASE-NOTES.txt">Release Notes</a></li><li><a href="config/index.html">Configuration</a></li><li><a href="api/index.html">Tomcat Javadocs</a></li><li><a href="servletapi/index.html">Servlet 4.0 Javadocs</a></li><li><a href="jspapi/index.html">JSP 2.3 Javadocs</a></li><li><a href="elapi/index.html">EL 3.0 Javadocs</a></li><li><a href="websocketapi/index.html">WebSocket 1.1 Javadocs</a></li><li><a href="jaspicapi/index.html">JASPIC 1.1 Javadocs</a></li><li><a href="annotationapi/index.html">Common Annotations 1.3 Javadocs</a></li><li><a href="https://tomcat.apache.org/connectors-doc/">JK 1.2 Documentation</a></li></ul></div><div><h2>Apache Tomcat Development</h2><ul><li><a href="building.html">Building</a></li><li><a href="changelog.html">Changelog</a></li><li><a href="https://cwiki.apache.org/confluence/display/TOMCAT/Tomcat+Versions">Status</a></li><li><a href="developers.html">Developers</a></li><li><a href="architecture/index.html">Architecture</a></li><li><a href="tribes/introduction.html">Tribes</a></li></ul></div></nav></div></div><div id="mainRight"><div id="content"><h2>Security Considerations</h2><h3 id="Table_of_Contents">Table of Contents</h3><div class="text"> |
||
| 5 | <ul><li><a href="#Introduction">Introduction</a></li><li><a href="#Non-Tomcat_settings">Non-Tomcat settings</a><ol><li><a href="#JMX">JMX</a></li></ol></li><li><a href="#Default_web_applications">Default web applications</a><ol><li><a href="#Default_web_applications/General">General</a></li><li><a href="#ROOT">ROOT</a></li><li><a href="#Documentation">Documentation</a></li><li><a href="#Examples">Examples</a></li><li><a href="#Default_web_applications/Manager">Manager</a></li><li><a href="#Host_Manager">Host Manager</a></li><li><a href="#Securing_Management_Applications">Securing Management Applications</a></li></ol></li><li><a href="#User_web_applications">User web applications</a></li><li><a href="#Security_manager">Security manager</a></li><li><a href="#server.xml">server.xml</a><ol><li><a href="#server.xml/General">General</a></li><li><a href="#Server">Server</a></li><li><a href="#Listeners">Listeners</a></li><li><a href="#Connectors">Connectors</a></li><li><a href="#Host">Host</a></li><li><a href="#Context">Context</a></li><li><a href="#Valves">Valves</a></li><li><a href="#Realms">Realms</a></li><li><a href="#server.xml/Manager">Manager</a></li><li><a href="#Cluster">Cluster</a></li></ol></li><li><a href="#System_Properties">System Properties</a></li><li><a href="#web.xml">web.xml</a></li><li><a href="#Embedded_Tomcat">Embedded Tomcat</a></li><li><a href="#Reverse_Proxies">Reverse Proxies</a></li><li><a href="#General">General</a></li></ul> |
||
| 6 | </div><h3 id="Introduction">Introduction</h3><div class="text"> |
||
| 7 | <p>Tomcat is configured to be reasonably secure for most use cases by |
||
| 8 | default. Some environments may require more, or less, secure configurations. |
||
| 9 | This page is to provide a single point of reference for configuration |
||
| 10 | options that may impact security and to offer some commentary on the |
||
| 11 | expected impact of changing those options. The intention is to provide a |
||
| 12 | list of configuration options that should be considered when assessing the |
||
| 13 | security of a Tomcat installation.</p> |
||
| 14 | |||
| 15 | <p><strong>Note</strong>: Reading this page is not a substitute for reading |
||
| 16 | and understanding the detailed configuration documentation. Fuller |
||
| 17 | descriptions of these attributes may be found in the relevant documentation |
||
| 18 | pages.</p> |
||
| 19 | </div><h3 id="Non-Tomcat_settings">Non-Tomcat settings</h3><div class="text"> |
||
| 20 | <p>Tomcat configuration should not be the only line of defense. The other |
||
| 21 | components in the system (operating system, network, database, etc.) should |
||
| 22 | also be secured.</p> |
||
| 23 | <p>Tomcat should not be run under the root user. Create a dedicated user for |
||
| 24 | the Tomcat process and provide that user with the minimum necessary |
||
| 25 | permissions for the operating system. For example, it should not be possible |
||
| 26 | to log on remotely using the Tomcat user.</p> |
||
| 27 | <p>File permissions should also be suitably restricted. In the |
||
| 28 | <code>.tar.gz</code> distribution, files and directories are not world |
||
| 29 | readable and the group does not have write access. On Unix like operating |
||
| 30 | systems, Tomcat runs with a default umask of <code>0027</code> to maintain |
||
| 31 | these permissions for files created while Tomcat is running (e.g. log files, |
||
| 32 | expanded WARs, etc.).</p> |
||
| 33 | <p>Taking the Tomcat instances at the ASF as an example (where |
||
| 34 | auto-deployment is disabled and web applications are deployed as exploded |
||
| 35 | directories), the standard configuration is to have all Tomcat files owned |
||
| 36 | by root with group Tomcat and whilst owner has read/write privileges, group |
||
| 37 | only has read and world has no permissions. The exceptions are the logs, |
||
| 38 | temp and work directory that are owned by the Tomcat user rather than root. |
||
| 39 | This means that even if an attacker compromises the Tomcat process, they |
||
| 40 | can't change the Tomcat configuration, deploy new web applications or |
||
| 41 | modify existing web applications. The Tomcat process runs with a umask of |
||
| 42 | 007 to maintain these permissions.</p> |
||
| 43 | <p>At the network level, consider using a firewall to limit both incoming |
||
| 44 | and outgoing connections to only those connections you expect to be |
||
| 45 | present.</p> |
||
| 46 | |||
| 47 | <div class="subsection"><h4 id="JMX">JMX</h4><div class="text"> |
||
| 48 | <p>The security of the JMX connection is dependent on the implementation |
||
| 49 | provided by the JRE and therefore falls outside the control of Tomcat.</p> |
||
| 50 | |||
| 51 | <p>Typically, access control is very limited (either read-only to |
||
| 52 | everything or read-write to everything). Tomcat exposes a large amount |
||
| 53 | of internal information and control via JMX to aid debugging, monitoring |
||
| 54 | and management. Given the limited access control available, JMX access |
||
| 55 | should be treated as equivalent to local root/admin access and restricted |
||
| 56 | accordingly.</p> |
||
| 57 | |||
| 58 | <p>The JMX access control provided by most (all?) JRE vendors does not |
||
| 59 | log failed authentication attempts, nor does it provide an account |
||
| 60 | lock-out feature after repeated failed authentications. This makes a |
||
| 61 | brute force attack easy to mount and difficult to detect.</p> |
||
| 62 | |||
| 63 | <p>Given all of the above, care should be taken to ensure that, if used, |
||
| 64 | the JMX interface is appropriately secured. Options you may wish to |
||
| 65 | consider to secure the JMX interface include:</p> |
||
| 66 | |||
| 67 | <ul> |
||
| 68 | <li>configuring a strong password for all JMX users;</li> |
||
| 69 | <li>binding the JMX listener only to an internal network;</li> |
||
| 70 | <li>limiting network access to the JMX port to trusted clients; and</li> |
||
| 71 | <li>providing an application specific health page for use by external |
||
| 72 | monitoring systems.</li> |
||
| 73 | </ul> |
||
| 74 | </div></div> |
||
| 75 | |||
| 76 | </div><h3 id="Default_web_applications">Default web applications</h3><div class="text"> |
||
| 77 | |||
| 78 | <div class="subsection"><h4 id="Default_web_applications/General">General</h4><div class="text"> |
||
| 79 | <p>Tomcat ships with a number of web applications that are enabled by |
||
| 80 | default. Vulnerabilities have been discovered in these applications in the |
||
| 81 | past. Applications that are not required should be removed so the system |
||
| 82 | will not be at risk if another vulnerability is discovered.</p> |
||
| 83 | </div></div> |
||
| 84 | |||
| 85 | <div class="subsection"><h4 id="ROOT">ROOT</h4><div class="text"> |
||
| 86 | <p>The ROOT web application presents a very low security risk but it does |
||
| 87 | include the version of Tomcat that is being used. The ROOT web application |
||
| 88 | should normally be removed from a publicly accessible Tomcat instance, not |
||
| 89 | for security reasons, but so that a more appropriate default page is shown |
||
| 90 | to users.</p> |
||
| 91 | </div></div> |
||
| 92 | |||
| 93 | <div class="subsection"><h4 id="Documentation">Documentation</h4><div class="text"> |
||
| 94 | <p>The documentation web application presents a very low security risk but |
||
| 95 | it does identify the version of Tomcat that is being used. It should |
||
| 96 | normally be removed from a publicly accessible Tomcat instance.</p> |
||
| 97 | </div></div> |
||
| 98 | |||
| 99 | <div class="subsection"><h4 id="Examples">Examples</h4><div class="text"> |
||
| 100 | <p>The examples web application should always be removed from any security |
||
| 101 | sensitive installation. While the examples web application does not |
||
| 102 | contain any known vulnerabilities, it is known to contain features |
||
| 103 | (particularly the cookie examples that display the contents of all cookies |
||
| 104 | received and allow new cookies to be set) that may be used by an attacker |
||
| 105 | in conjunction with a vulnerability in another application deployed on the |
||
| 106 | Tomcat instance to obtain additional information that would otherwise be |
||
| 107 | unavailable.</p> |
||
| 108 | </div></div> |
||
| 109 | |||
| 110 | <div class="subsection"><h4 id="Default_web_applications/Manager">Manager</h4><div class="text"> |
||
| 111 | <p>The Manager application allows the remote deployment of web |
||
| 112 | applications and is frequently targeted by attackers due to the widespread |
||
| 113 | use of weak passwords and publicly accessible Tomcat instances with the |
||
| 114 | Manager application enabled. The Manager application is not accessible by |
||
| 115 | default as no users are configured with the necessary access. If the |
||
| 116 | Manager application is enabled then guidance in the section |
||
| 117 | <strong>Securing Management Applications</strong> section should be |
||
| 118 | followed.</p> |
||
| 119 | </div></div> |
||
| 120 | |||
| 121 | <div class="subsection"><h4 id="Host_Manager">Host Manager</h4><div class="text"> |
||
| 122 | <p>The Host Manager application allows the creation and management of |
||
| 123 | virtual hosts - including the enabling of the Manager application for a |
||
| 124 | virtual host. The Host Manager application is not accessible by default |
||
| 125 | as no users are configured with the necessary access. If the Host Manager |
||
| 126 | application is enabled then guidance in the section <strong>Securing |
||
| 127 | Management Applications</strong> section should be followed.</p> |
||
| 128 | </div></div> |
||
| 129 | |||
| 130 | <div class="subsection"><h4 id="Securing_Management_Applications">Securing Management Applications</h4><div class="text"> |
||
| 131 | <p>When deploying a web application that provides management functions for |
||
| 132 | the Tomcat instance, the following guidelines should be followed:</p> |
||
| 133 | <ul> |
||
| 134 | <li>Ensure that any users permitted to access the management application |
||
| 135 | have strong passwords.</li> |
||
| 136 | <li>Do not remove the use of the <a href="config/realm.html#LockOut_Realm_-_org.apache.catalina.realm.LockOutRealm">LockOutRealm</a> |
||
| 137 | which prevents brute force attacks against user passwords.</li> |
||
| 138 | <li>Configure the <a href="config/valve.html#Remote_CIDR_Valve">RemoteCIDRValve</a> |
||
| 139 | in the <a href="config/context.html">context.xml</a> file for the |
||
| 140 | management application which limits access to localhost by default. |
||
| 141 | If remote access is required, limit it to specific IP addresses using |
||
| 142 | this valve.</li> |
||
| 143 | </ul> |
||
| 144 | </div></div> |
||
| 145 | </div><h3 id="User_web_applications">User web applications</h3><div class="text"> |
||
| 146 | <p>Web applications are assumed to be trusted. It is not safe to deploy web |
||
| 147 | applications from untrusted sources.</p> |
||
| 148 | |||
| 149 | <p>Any application functionality that permits the modification of a web |
||
| 150 | application (WebDAV, HTTP PUT requests etc.) may impact the security of |
||
| 151 | either the web application or the Tomcat instance on which it is running. |
||
| 152 | Such functionality should either be restricted to trusted users or |
||
| 153 | limited in scope (e.g. via security constraints) such that users with access |
||
| 154 | to the functionality are unable to imapct the security of either the web |
||
| 155 | application or the Tomcat instance on which it is running.</p> |
||
| 156 | |||
| 157 | <p>Consider using the |
||
| 158 | <a href="config/filter.html#CORS_Filter">CORS filter</a> and/or the |
||
| 159 | <a href="config/filter.html#CSRF_Prevention_Filter">CSRF prevention |
||
| 160 | filter</a> with deployed web applications.</p> |
||
| 161 | </div><h3 id="Security_manager">Security manager</h3><div class="text"> |
||
| 162 | <p>Enabling the security manager causes web applications to be run in a |
||
| 163 | sandbox, significantly limiting a web application's ability to perform |
||
| 164 | malicious actions such as calling System.exit(), establishing network |
||
| 165 | connections or accessing the file system outside of the web application's |
||
| 166 | root and temporary directories. However, it should be noted that there are |
||
| 167 | some malicious actions, such as triggering high CPU consumption via an |
||
| 168 | infinite loop, that the security manager cannot prevent.</p> |
||
| 169 | |||
| 170 | <p>Enabling the security manager is usually done to limit the potential |
||
| 171 | impact, should an attacker find a way to compromise a trusted web |
||
| 172 | application . A security manager may also be used to reduce the risks of |
||
| 173 | running untrusted web applications (e.g. in hosting environments) but it |
||
| 174 | should be noted that the security manager only reduces the risks of |
||
| 175 | running untrusted web applications, it does not eliminate them. If running |
||
| 176 | multiple untrusted web applications, it is recommended that each web |
||
| 177 | application is deployed to a separate Tomcat instance (and ideally separate |
||
| 178 | hosts) to reduce the ability of a malicious web application impacting the |
||
| 179 | availability of other applications.</p> |
||
| 180 | |||
| 181 | <p>Tomcat is tested with the security manager enabled; but the majority of |
||
| 182 | Tomcat users do not run with a security manager, so Tomcat is not as well |
||
| 183 | user-tested in this configuration. There have been, and continue to be, |
||
| 184 | bugs reported that are triggered by running under a security manager.</p> |
||
| 185 | |||
| 186 | <p>The restrictions imposed by a security manager are likely to break most |
||
| 187 | applications if the security manager is enabled. The security manager should |
||
| 188 | not be used without extensive testing. Ideally, the use of a security |
||
| 189 | manager should be introduced at the start of the development cycle as it can |
||
| 190 | be time-consuming to track down and fix issues caused by enabling a security |
||
| 191 | manager for a mature application.</p> |
||
| 192 | |||
| 193 | <p>Enabling the security manager changes the defaults for the following |
||
| 194 | settings:</p> |
||
| 195 | <ul> |
||
| 196 | <li>The default value for the <strong>deployXML</strong> attribute of the |
||
| 197 | <strong>Host</strong> element is changed to <code>false</code>.</li> |
||
| 198 | </ul> |
||
| 199 | </div><h3 id="server.xml">server.xml</h3><div class="text"> |
||
| 200 | <div class="subsection"><h4 id="server.xml/General">General</h4><div class="text"> |
||
| 201 | <p>The default server.xml contains a large number of comments, including |
||
| 202 | some example component definitions that are commented out. Removing these |
||
| 203 | comments makes it considerably easier to read and comprehend |
||
| 204 | server.xml.</p> |
||
| 205 | <p>If a component type is not listed, then there are no settings for that |
||
| 206 | type that directly impact security.</p> |
||
| 207 | </div></div> |
||
| 208 | |||
| 209 | <div class="subsection"><h4 id="Server">Server</h4><div class="text"> |
||
| 210 | <p>Setting the <strong>port</strong> attribute to <code>-1</code> disables |
||
| 211 | the shutdown port.</p> |
||
| 212 | <p>If the shutdown port is not disabled, a strong password should be |
||
| 213 | configured for <strong>shutdown</strong>.</p> |
||
| 214 | </div></div> |
||
| 215 | |||
| 216 | <div class="subsection"><h4 id="Listeners">Listeners</h4><div class="text"> |
||
| 217 | <p>The APR Lifecycle Listener is not stable if compiled on Solaris using |
||
| 218 | gcc. If using the APR/native connector on Solaris, compile it with the |
||
| 219 | Sun Studio compiler.</p> |
||
| 220 | <p>The JNI Library Loading Listener may be used to load native code. It should |
||
| 221 | only be used to load trusted libraries.</p> |
||
| 222 | <p>The Security Lifecycle Listener should be enabled and configured as appropriate. |
||
| 223 | </p> |
||
| 224 | </div></div> |
||
| 225 | |||
| 226 | <div class="subsection"><h4 id="Connectors">Connectors</h4><div class="text"> |
||
| 227 | <p>By default, a non-TLS, HTTP/1.1 connector is configured on port 8080. |
||
| 228 | Connectors that will not be used should be removed from server.xml.</p> |
||
| 229 | |||
| 230 | <p>AJP is a clear text protocol. AJP Connectors should normally only be |
||
| 231 | used on trusted networks. If used on an untrusted network, use of the |
||
| 232 | <code>secret</code> attribute will limit access to authorised clients but |
||
| 233 | the <code>secret</code> attribute will be visible to anyone who can |
||
| 234 | observe network traffic.</p> |
||
| 235 | |||
| 236 | <p>AJP Connectors block forwarded requests with unknown request |
||
| 237 | attributes. Known safe and/or expected attributes may be allowed by |
||
| 238 | configuration an appropriate regular expression for the |
||
| 239 | <code>allowedRequestAttributesPattern</code> attribute.</p> |
||
| 240 | |||
| 241 | <p>The <strong>address</strong> attribute may be used to control which IP |
||
| 242 | address a connector listens on for connections. By default, a connector |
||
| 243 | listens on all configured IP addresses.</p> |
||
| 244 | |||
| 245 | <p>The <strong>allowTrace</strong> attribute may be used to enable TRACE |
||
| 246 | requests which can be useful for debugging. Due to the way some browsers |
||
| 247 | handle the response from a TRACE request (which exposes the browser to an |
||
| 248 | XSS attack), support for TRACE requests is disabled by default.</p> |
||
| 249 | |||
| 250 | <p>The <strong>discardFacades</strong> attribute set to <code>true</code> |
||
| 251 | will cause a new facade object to be created for each request. This |
||
| 252 | reduces the chances of a bug in an application exposing data from one |
||
| 253 | request to another.</p> |
||
| 254 | |||
| 255 | <p>The <strong>encodedSolidusHandling</strong> attribute allows |
||
| 256 | non-standard parsing of the request URI. Setting this attribute to a |
||
| 257 | non-default value when behind a reverse proxy may enable an attacker to |
||
| 258 | bypass any security constraints enforced by the proxy.</p> |
||
| 259 | |||
| 260 | <p>The <strong>maxParameterCount</strong> attribute controls the maximum |
||
| 261 | total number of request parameters (including uploaded files) obtained |
||
| 262 | from the query string and, for POST requests, the request body if the |
||
| 263 | content type is <code>application/x-www-form-urlencoded</code> or |
||
| 264 | <code>multipart/form-data</code>. Excessive parameters are ignored. If you |
||
| 265 | want to reject such requests, configure a |
||
| 266 | <a href="config/filter.html">FailedRequestFilter</a>.</p> |
||
| 267 | |||
| 268 | <p>The <strong>maxPartCount</strong> attribute controls the maximum number |
||
| 269 | of parts supported for a multipart request. This is limited to 50 by |
||
| 270 | default to reduce exposure to a DoS attack. The documentation for |
||
| 271 | <strong>maxPartCount</strong> provides more details on the memory |
||
| 272 | requirements for processing multipart requests. Excessive parts may be |
||
| 273 | ignored depending on how the application processes the request. If you |
||
| 274 | want to always reject such requests, configure a |
||
| 275 | <a href="config/filter.html">FailedRequestFilter</a>.</p> |
||
| 276 | |||
| 277 | <p>The <strong>maxPostSize</strong> attribute controls the maximum size |
||
| 278 | of data from a POST request that will be parsed for request parameters. |
||
| 279 | The parameters are cached for the duration of the request so this is |
||
| 280 | limited to 2 MiB by default to reduce exposure to a DoS attack.</p> |
||
| 281 | |||
| 282 | <p>The <strong>maxSavePostSize</strong> attribute controls the saving of |
||
| 283 | the request body during FORM and CLIENT-CERT authentication and HTTP/1.1 |
||
| 284 | upgrade. For FORM authentication, the request body is cached in the HTTP |
||
| 285 | session for the duration of the authentication so the cached request body |
||
| 286 | is limited to 4 KiB by default to reduce exposure to a DOS attack. To |
||
| 287 | further reduce exposure to a DoS attack by limiting the permitted duration |
||
| 288 | of the FORM authentication, a reduced session timeout is used if the |
||
| 289 | session is created by the FORM authentication. This reduced timeout is |
||
| 290 | controlled by the <code>authenticationSessionTimeout</code> attribute of |
||
| 291 | the <a href="config/valve.html#Form_Authenticator_Valve">FORM |
||
| 292 | authenticator</a>.</p> |
||
| 293 | |||
| 294 | <p>The <strong>requiredSecret</strong> attribute in AJP connectors |
||
| 295 | configures shared secret between Tomcat and reverse proxy in front of |
||
| 296 | Tomcat. It is used to prevent unauthorized connections over AJP protocol.</p> |
||
| 297 | |||
| 298 | <p>The <strong>server</strong> attribute controls the value of the Server |
||
| 299 | HTTP header. The default value of this header for Tomcat 4.1.x to |
||
| 300 | 8.0.x is Apache-Coyote/1.1. From 8.5.x onwards this header is not set by |
||
| 301 | default. This header can provide limited information to both legitimate |
||
| 302 | clients and attackers.</p> |
||
| 303 | |||
| 304 | <p>The <strong>SSLEnabled</strong>, <strong>scheme</strong> and |
||
| 305 | <strong>secure</strong> attributes may all be independently set. These are |
||
| 306 | normally used when Tomcat is located behind a reverse proxy and the proxy |
||
| 307 | is connecting to Tomcat via HTTP or HTTPS. They allow Tomcat to see the |
||
| 308 | SSL attributes of the connections between the client and the proxy rather |
||
| 309 | than the proxy and Tomcat. For example, the client may connect to the |
||
| 310 | proxy over HTTPS but the proxy connects to Tomcat using HTTP. If it is |
||
| 311 | necessary for Tomcat to be able to distinguish between secure and |
||
| 312 | non-secure connections received by a proxy, the proxy must use separate |
||
| 313 | connectors to pass secure and non-secure requests to Tomcat. If the |
||
| 314 | proxy uses AJP then the SSL attributes of the client connection are |
||
| 315 | passed via the AJP protocol and separate connectors are not needed.</p> |
||
| 316 | |||
| 317 | <p>The <strong>tomcatAuthentication</strong> and |
||
| 318 | <strong>tomcatAuthorization</strong> attributes are used with the |
||
| 319 | AJP connectors to determine if Tomcat should handle all authentication and |
||
| 320 | authorisation or if authentication should be delegated to the reverse |
||
| 321 | proxy (the authenticated user name is passed to Tomcat as part of the AJP |
||
| 322 | protocol) with the option for Tomcat to still perform authorization.</p> |
||
| 323 | |||
| 324 | <p>The <strong>xpoweredBy</strong> attribute controls whether or not the |
||
| 325 | X-Powered-By HTTP header is sent with each request. If sent, the value of |
||
| 326 | the header contains the Servlet and JSP specification versions, the full |
||
| 327 | Tomcat version (e.g. Apache Tomcat/9.0), the name of |
||
| 328 | the JVM vendor and |
||
| 329 | the version of the JVM. This header is disabled by default. This header |
||
| 330 | can provide useful information to both legitimate clients and attackers. |
||
| 331 | </p> |
||
| 332 | </div></div> |
||
| 333 | |||
| 334 | <div class="subsection"><h4 id="Host">Host</h4><div class="text"> |
||
| 335 | <p>The host element controls deployment. Automatic deployment allows for |
||
| 336 | simpler management but also makes it easier for an attacker to deploy a |
||
| 337 | malicious application. Automatic deployment is controlled by the |
||
| 338 | <strong>autoDeploy</strong> and <strong>deployOnStartup</strong> |
||
| 339 | attributes. If both are <code>false</code>, only Contexts defined in |
||
| 340 | server.xml will be deployed and any changes will require a Tomcat restart. |
||
| 341 | </p> |
||
| 342 | |||
| 343 | <p>In a hosted environment where web applications may not be trusted, set |
||
| 344 | the <strong>deployXML</strong> attribute to <code>false</code> to ignore |
||
| 345 | any context.xml packaged with the web application that may try to assign |
||
| 346 | increased privileges to the web application. Note that if the security |
||
| 347 | manager is enabled that the <strong>deployXML</strong> attribute will |
||
| 348 | default to <code>false</code>.</p> |
||
| 349 | </div></div> |
||
| 350 | |||
| 351 | <div class="subsection"><h4 id="Context">Context</h4><div class="text"> |
||
| 352 | <p>This applies to <a href="config/context.html">Context</a> |
||
| 353 | elements in all places where they can be defined: |
||
| 354 | <code>server.xml</code> file, |
||
| 355 | default <code>context.xml</code> file, |
||
| 356 | per-host <code>context.xml.default</code> file, |
||
| 357 | web application context file in per-host configuration directory |
||
| 358 | or inside the web application.</p> |
||
| 359 | |||
| 360 | <p>The <strong>crossContext</strong> attribute controls if a context is |
||
| 361 | allowed to access the resources of another context. It is |
||
| 362 | <code>false</code> by default and should only be changed for trusted web |
||
| 363 | applications.</p> |
||
| 364 | |||
| 365 | <p>The <strong>privileged</strong> attribute controls if a context is |
||
| 366 | allowed to use container provided servlets like the Manager servlet. It is |
||
| 367 | <code>false</code> by default and should only be changed for trusted web |
||
| 368 | applications.</p> |
||
| 369 | |||
| 370 | <p>The <strong>allowLinking</strong> attribute of a nested |
||
| 371 | <a href="config/resources.html">Resources</a> element controls if a context |
||
| 372 | is allowed to use linked files. If enabled and the context is undeployed, |
||
| 373 | the links will be followed when deleting the context resources. Changing |
||
| 374 | this setting from the default of <code>false</code> on case insensitive |
||
| 375 | operating systems (this includes Windows) will disable a number of |
||
| 376 | security measures and allow, among other things, direct access to the |
||
| 377 | WEB-INF directory.</p> |
||
| 378 | |||
| 379 | <p>The <strong>sessionCookiePathUsesTrailingSlash</strong> can be used to |
||
| 380 | work around a bug in a number of browsers (Internet Explorer, Safari and |
||
| 381 | Edge) to prevent session cookies being exposed across applications when |
||
| 382 | applications share a common path prefix. However, enabling this option |
||
| 383 | can create problems for applications with Servlets mapped to |
||
| 384 | <code>/*</code>. It should also be noted the RFC6265 section 8.5 makes it |
||
| 385 | clear that different paths should not be considered sufficient to isolate |
||
| 386 | cookies from other applications.</p> |
||
| 387 | |||
| 388 | <p>When <strong>antiResourceLocking</strong> is enabled, Tomcat will copy |
||
| 389 | the unpacked web application to the directory defined by the |
||
| 390 | <code>java.io.tmpdir</code> system property |
||
| 391 | (<code>$CATALINA_BASE/temp</code> by default). This location should be |
||
| 392 | secured with appropriate file permissions - typically read/write for the |
||
| 393 | Tomcat user and no access for other users.</p> |
||
| 394 | |||
| 395 | <p>When <strong>mapperContextRootRedirectEnabled</strong> and/or |
||
| 396 | <strong>mapperDirectoryRedirectEnabled</strong> are enabled, request |
||
| 397 | processing will be more efficient but there are security side effects. |
||
| 398 | First, the existence of a web application or a directory may be confirmed |
||
| 399 | even though the user does not have access to that directory. Secondly, any |
||
| 400 | Valves and/or Filters - including those providing security functionality - |
||
| 401 | will not have an opportunity to process the request.</p> |
||
| 402 | |||
| 403 | </div></div> |
||
| 404 | |||
| 405 | <div class="subsection"><h4 id="Valves">Valves</h4><div class="text"> |
||
| 406 | <p>It is strongly recommended that an AccessLogValve is configured. The |
||
| 407 | default Tomcat configuration includes an AccessLogValve. These are |
||
| 408 | normally configured per host but may also be configured per engine or per |
||
| 409 | context as required.</p> |
||
| 410 | |||
| 411 | <p>Any administrative application should be protected by a |
||
| 412 | RemoteCIDRValve (this Valve is also available as a Filter). |
||
| 413 | The <strong>allow</strong> attribute should be used to limit access to a |
||
| 414 | set of known trusted hosts.</p> |
||
| 415 | |||
| 416 | <p>The default ErrorReportValve includes the Tomcat version number in the |
||
| 417 | response sent to clients. To avoid this, custom error handling can be |
||
| 418 | configured within each web application. Alternatively, you can explicitly |
||
| 419 | configure an <a href="config/valve.html">ErrorReportValve</a> and set its |
||
| 420 | <strong>showServerInfo</strong> attribute to <code>false</code>. |
||
| 421 | Alternatively, the version number can be changed by creating the file |
||
| 422 | CATALINA_BASE/lib/org/apache/catalina/util/ServerInfo.properties with |
||
| 423 | content as follows:</p> |
||
| 424 | <div class="codeBox"><pre><code>server.info=Apache Tomcat/9.0.x</code></pre></div> |
||
| 425 | <p>Modify the values as required. Note that this will also change the version |
||
| 426 | number reported in some of the management tools and may make it harder to |
||
| 427 | determine the real version installed. The CATALINA_HOME/bin/version.bat|sh |
||
| 428 | script will still report the correct version number.</p> |
||
| 429 | |||
| 430 | <p>The default ErrorReportValve can display stack traces and/or JSP |
||
| 431 | source code to clients when an error occurs. To avoid this, custom error |
||
| 432 | handling can be configured within each web application. Alternatively, you |
||
| 433 | can explicitly configure an <a href="config/valve.html">ErrorReportValve</a> |
||
| 434 | and set its <strong>showReport</strong> attribute to <code>false</code>.</p> |
||
| 435 | |||
| 436 | <p>The RewriteValve uses regular expressions and poorly formed regex |
||
| 437 | patterns may be vulnerable to "catastrophic backtracking" or "ReDoS". See |
||
| 438 | <a href="rewrite.html">Rewrite docs</a> for more details.</p> |
||
| 439 | </div></div> |
||
| 440 | |||
| 441 | <div class="subsection"><h4 id="Realms">Realms</h4><div class="text"> |
||
| 442 | <p>The MemoryRealm is not intended for production use as any changes to |
||
| 443 | tomcat-users.xml require a restart of Tomcat to take effect.</p> |
||
| 444 | |||
| 445 | <p>The JDBCRealm is not recommended for production use as it is single |
||
| 446 | threaded for all authentication and authorization options. Use the |
||
| 447 | DataSourceRealm instead.</p> |
||
| 448 | |||
| 449 | <p>The UserDatabaseRealm is not intended for large-scale installations. It |
||
| 450 | is intended for small-scale, relatively static environments.</p> |
||
| 451 | |||
| 452 | <p>The JAASRealm is not widely used and therefore the code is not as |
||
| 453 | mature as the other realms. Additional testing is recommended before using |
||
| 454 | this realm.</p> |
||
| 455 | |||
| 456 | <p>By default, the realms do not implement any form of account lock-out. |
||
| 457 | This means that brute force attacks can be successful. To prevent a brute |
||
| 458 | force attack, the chosen realm should be wrapped in a LockOutRealm.</p> |
||
| 459 | </div></div> |
||
| 460 | |||
| 461 | <div class="subsection"><h4 id="server.xml/Manager">Manager</h4><div class="text"> |
||
| 462 | <p>The manager component is used to generate session IDs.</p> |
||
| 463 | |||
| 464 | <p>The class used to generate random session IDs may be changed with |
||
| 465 | the <strong>randomClass</strong> attribute.</p> |
||
| 466 | |||
| 467 | <p>The length of the session ID may be changed with the |
||
| 468 | <strong>sessionIdLength</strong> attribute.</p> |
||
| 469 | |||
| 470 | <p>The <strong>persistAuthentication</strong> controls whether the |
||
| 471 | authenticated Principal associated with the session (if any) is included |
||
| 472 | when the session is persisted during a restart or to a Store.</p> |
||
| 473 | |||
| 474 | <p>When using the <strong>JDBCStore</strong>, the session store should be |
||
| 475 | secured (dedicated credentials, appropriate permissions) such that only |
||
| 476 | the <strong>JDBCStore</strong> is able to access the persisted session |
||
| 477 | data. In particular, the <strong>JDBCStore</strong> should not be |
||
| 478 | accessible via any credentials available to a web application.</p> |
||
| 479 | </div></div> |
||
| 480 | |||
| 481 | <div class="subsection"><h4 id="Cluster">Cluster</h4><div class="text"> |
||
| 482 | <p>The cluster implementation is written on the basis that a secure, |
||
| 483 | trusted network is used for all of the cluster related network traffic. It |
||
| 484 | is not safe to run a cluster on a insecure, untrusted network.</p> |
||
| 485 | |||
| 486 | <p>If you require confidentiality and/or integrity protection then you can |
||
| 487 | use the |
||
| 488 | <a href="config/cluster-interceptor.html#org.apache.catalina.tribes.group.interceptors.EncryptInterceptor_Attributes">EncryptInterceptor</a> |
||
| 489 | to encrypt traffic between nodes. This interceptor does not protect |
||
| 490 | against all the risks of running on an untrusted network, particularly |
||
| 491 | DoS attacks.</p> |
||
| 492 | </div></div> |
||
| 493 | </div><h3 id="System_Properties">System Properties</h3><div class="text"> |
||
| 494 | <p>The <strong> |
||
| 495 | org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH</strong> and |
||
| 496 | <strong>org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH</strong> |
||
| 497 | system properties allow non-standard parsing of the request URI. Using |
||
| 498 | these options when behind a reverse proxy may enable an attacker to bypass |
||
| 499 | any security constraints enforced by the proxy.</p> |
||
| 500 | |||
| 501 | <p>The <strong> |
||
| 502 | org.apache.catalina.connector.Response.ENFORCE_ENCODING_IN_GET_WRITER |
||
| 503 | </strong> system property has security implications if disabled. Many user |
||
| 504 | agents, in breach of RFC2616, try to guess the character encoding of text |
||
| 505 | media types when the specification-mandated default of ISO-8859-1 should be |
||
| 506 | used. Some browsers will interpret as UTF-7 a response containing characters |
||
| 507 | that are safe for ISO-8859-1 but trigger an XSS vulnerability if interpreted |
||
| 508 | as UTF-7.</p> |
||
| 509 | </div><h3 id="web.xml">web.xml</h3><div class="text"> |
||
| 510 | <p>This applies to the default <code>conf/web.xml</code> file, the |
||
| 511 | <code>/WEB-INF/tomcat-web.xml</code> and the <code>/WEB-INF/web.xml</code> |
||
| 512 | files in web applications if they define the components mentioned here.</p> |
||
| 513 | |||
| 514 | <p>The <a href="default-servlet.html">DefaultServlet</a> is configured |
||
| 515 | with <strong>readonly</strong> set to |
||
| 516 | <code>true</code>. Changing this to <code>false</code> allows clients to |
||
| 517 | delete or modify static resources on the server and to upload new |
||
| 518 | resources. This should not normally be changed without requiring |
||
| 519 | authentication.</p> |
||
| 520 | |||
| 521 | <p>The DefaultServlet is configured with <strong>listings</strong> set to |
||
| 522 | <code>false</code>. This isn't because allowing directory listings is |
||
| 523 | considered unsafe but because generating listings of directories with |
||
| 524 | thousands of files can consume significant CPU leading to a DOS attack. |
||
| 525 | </p> |
||
| 526 | |||
| 527 | <p>The DefaultServlet is configured with <strong>showServerInfo</strong> |
||
| 528 | set to <code>true</code>. When the directory listings is enabled the Tomcat |
||
| 529 | version number is included in the response sent to clients. To avoid this, |
||
| 530 | you can explicitly configure a DefaultServlet and set its |
||
| 531 | <strong>showServerInfo</strong> attribute to false. |
||
| 532 | Alternatively, the version number can be changed by creating the file |
||
| 533 | CATALINA_BASE/lib/org/apache/catalina/util/ServerInfo.properties with |
||
| 534 | content as follows:</p> |
||
| 535 | <div class="codeBox"><pre><code>server.info=Apache Tomcat/9.0.x</code></pre></div> |
||
| 536 | <p>Modify the values as required. Note that this will also change the version |
||
| 537 | number reported in some of the management tools and may make it harder to |
||
| 538 | determine the real version installed. The CATALINA_HOME/bin/version.bat|sh |
||
| 539 | script will still report the correct version number. |
||
| 540 | </p> |
||
| 541 | |||
| 542 | <p>The CGI Servlet is disabled by default. If enabled, the debug |
||
| 543 | initialisation parameter should not be set to <code>10</code> or higher on a |
||
| 544 | production system because the debug page is not secure.</p> |
||
| 545 | |||
| 546 | <p>When using the CGI Servlet on Windows with |
||
| 547 | <code>enableCmdLineArguments</code> enabled, review the setting of |
||
| 548 | <code>cmdLineArgumentsDecoded</code> carefully and ensure that it is |
||
| 549 | appropriate for your environment. The default value is secure. Insecure |
||
| 550 | configurations may expose the server to remote code execution. Further |
||
| 551 | information on the potential risks and mitigations may be found by |
||
| 552 | following the links in the <a href="cgi-howto.html">CGI How To</a>.</p> |
||
| 553 | |||
| 554 | <p><a href="config/filter.html">FailedRequestFilter</a> |
||
| 555 | can be configured and used to reject requests that had errors during |
||
| 556 | request parameter parsing. Without the filter the default behaviour is |
||
| 557 | to ignore invalid or excessive parameters.</p> |
||
| 558 | |||
| 559 | <p><a href="config/filter.html">HttpHeaderSecurityFilter</a> can be |
||
| 560 | used to add headers to responses to improve security. If clients access |
||
| 561 | Tomcat directly, then you probably want to enable this filter and all the |
||
| 562 | headers it sets unless your application is already setting them. If Tomcat |
||
| 563 | is accessed via a reverse proxy, then the configuration of this filter needs |
||
| 564 | to be co-ordinated with any headers that the reverse proxy sets.</p> |
||
| 565 | |||
| 566 | <p>The WebDAV servlet enables edit functionality for web application |
||
| 567 | content. If the WebDAV servlet is enabled, the WebDAV functionality should |
||
| 568 | be appropriately secured. This should include CORS protection if it is |
||
| 569 | expected that any legitimate users will access the web application via a |
||
| 570 | browser.</p> |
||
| 571 | |||
| 572 | <p>When configuring security constraints, care should be taken if the URL |
||
| 573 | pattern for one or more constraints covers any segment of the URL that |
||
| 574 | becomes part of the pathInfo for a servlet and the servlet uses the pathInfo |
||
| 575 | to identify some other resource (like the default servlet does). In those |
||
| 576 | circumstances, correct application of the security constraint depends on the |
||
| 577 | implementation of the Servlet. All servlets included with Tomcat will behave |
||
| 578 | correctly in this scenario.</p> |
||
| 579 | </div><h3 id="Embedded_Tomcat">Embedded Tomcat</h3><div class="text"> |
||
| 580 | <p>When using embedded Tomcat, the typical defaults provided by the scripts, |
||
| 581 | server.xml and other configuration are not set. Users of embedded Tomcat may |
||
| 582 | wish to consider the following:</p> |
||
| 583 | <ul> |
||
| 584 | <li>The listeners normally configured in server.xml, including |
||
| 585 | <code>org.apache.catalina.security.SecurityListener</code>, will not be |
||
| 586 | configured by default. They must be explicitly enabled if required.</li> |
||
| 587 | <li>The <code>java.io.tmpdir</code> will not be set (it is normally set to |
||
| 588 | <code>$CATALINA_BASE/temp</code>). This directory is used for various |
||
| 589 | temporary files that may be security sensitive including file uploads and |
||
| 590 | a copy of the web application if anti-resource locking is enabled. |
||
| 591 | Consider setting the <code>java.io.tmpdir</code> system property to an |
||
| 592 | appropriately secured directory.</li> |
||
| 593 | </ul> |
||
| 594 | </div><h3 id="Reverse_Proxies">Reverse Proxies</h3><div class="text"> |
||
| 595 | <p>All clients, including reverse proxies, are responsible for the |
||
| 596 | consequences of the data they present to Tomcat.</p> |
||
| 597 | |||
| 598 | <p>The servlet specification removes path parameters when normalizing |
||
| 599 | requests. HTTP servers do not normally do this. This creates the possibility |
||
| 600 | of a client using a <code>/..;a=b/</code> type sequence in a URI to bypass a |
||
| 601 | security constraint implemented in the reverse proxy. This possibility can |
||
| 602 | be avoided with appropriate configuration such as using the setting |
||
| 603 | <code>mapping=servlet</code> with httpd's mod_proxy.</p> |
||
| 604 | |||
| 605 | <p>If Tomcat is deployed behind a reverse proxy and that reverse proxy |
||
| 606 | implements one or more security constraints, it is recommended a defense in |
||
| 607 | depth approach is taken and Tomcat is secured as if the reverse proxy was |
||
| 608 | not in use.</p> |
||
| 609 | </div><h3 id="General">General</h3><div class="text"> |
||
| 610 | <p>BASIC and FORM authentication pass user names and passwords in clear |
||
| 611 | text. Web applications using these authentication mechanisms with clients |
||
| 612 | connecting over untrusted networks should use SSL.</p> |
||
| 613 | |||
| 614 | <p>The session cookie for a session with an authenticated user is nearly as |
||
| 615 | useful as the user's password to an attacker and should be afforded the same |
||
| 616 | level of protection as the password itself. This usually means |
||
| 617 | authenticating over SSL and continuing to use SSL until the session |
||
| 618 | ends.</p> |
||
| 619 | |||
| 620 | <p>Tomcat's implementation of the Servlet API's file upload support may use |
||
| 621 | the directory defined by the <code>java.io.tmpdir</code> system property |
||
| 622 | (<code>$CATALINA_BASE/temp</code> by default) to store temporary files. This |
||
| 623 | location should be secured with appropriate file permissions - typically |
||
| 624 | read/write for the Tomcat user and no access for other users.</p> |
||
| 625 | </div></div></div></div></div><footer><div id="footer"> |
||
| 626 | Copyright © 1999-2025, The Apache Software Foundation |
||
| 627 | <br> |
||
| 628 | Apache Tomcat, Tomcat, Apache, the Apache Tomcat logo and the Apache logo |
||
| 629 | are either registered trademarks or trademarks of the Apache Software |
||
| 630 | Foundation. |
||
| 631 | </div></footer></div></body></html> |