403在Tomcat 7.0.52中拒绝访问指定的URL

Question

I have recently migrated the tomcat server from 7.0.49 to 7.0.52 . In tomcat it contains 2 web apps which was working earlier, after migrating to this version I am facing 403 Access denied to specified url .

On this whenever we try it out for first time on a browser or a tab facing the 403 error but when we refresh the page, it is redirecting to login page.

One more thing I would like to add here is only one application is resulting with this 403 error. So I tried to compare with Tomcat config files on both versions and verified there is no change exception version specific changes.

Adding more debugging points on this issue, On web.xml there the role is been defined, so tried Commenting it out. it's getting redirected to Login Page.

Can any one please share ideas on this issues.

Answer 1

Try clearing browser cache before doing first request. Maybe application which gives 403 uses some authoriztion cookie (like sso cookie or possibbly jsessionid). This cookie can be significant. If this is the case than after clearing cookies you should be directed to login page directly.

This would explain why one application works and another not (some state on client browser can be held)

Answer 2

Maybe the strategy how sessions are passivated has been changed between 7.0.49 and 7.0.52.

Try to delete all passivated sessions.

Answer 3

I faced similar problems in the past when I started to use same Tomcat version.

If I recall correctly, there was some misconception between Tomcat and Servlet spec leading to some servlets starting twice. You can read a little more here .

Anyway, what I always worked for me is add metadata-complete="true" in web-app element in web.xml . This is a pity, in my opinion, as I use Java only configuration, and I must keep this file only for this.