Issues with context configuration of intrinsic web applications

[Carsten Klein]

All context configuration files at https://salsa.debian.org/java-team/tomcat9/-/tree/master/debian/context for Apache Tomcat's built-in admin applications (as well as for /docs and /examples) contain a `path` attribute, which shall specify the webapp's URL context path. However, according to Apache Tomcat's documentation, this attribute must only be used when statically defining a context in server.xml. In all other circumstances, the path will be inferred from the filenames used for either the .xml context file or the docBase (https://tomcat.apache.org/tomcat-9.0-doc/config/context.html#Common_Attributes).

As of Apache Tomcat 9.0 (since 2018-02-27) a warning message is logged, stating that the path specified in context.xml has been ignored:

The path attribute with value [/manager] in deployment descriptor [/etc/tomcat9/Catalina/localhost/manager.xml] has been ignored

In order to get rid of that warning log messages (one for each application), the superfluous path attribute should be removed.

The context configuration files of the admin applications (manager.xml and host-manager.xml) that are actually installed in /etc/tomcat9/Catalina/localhost/ are significantly different to the corresponding original context.xml files. The latter limit access to 127.0.0.1 and also setup a sessionAttributeValueClassNameFilter suitable for use with CSRF Prevention Filter, which is added to these two apps in web.xml.

Not limiting access to localhost may be intentional for Debian/Ubuntu, but setting the Manager's sessionAttributeValueClassNameFilter accordingly may be a good idea in order to make session persistence work correctly with CSRF Prevention Filter (which must store complex values (like (Linked)?HashMaps) in the session's attributes).

Source package: tomcat9 (9.0.31-1)

[Julian Sarnago (sarnagin)]

Hiii;

this is happening to me, when trying to install tomcat together with guacamole I have everything installed correctly but it gives me an error in the path, how can I do it?

best regards

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.