将 Apache/Tomcat 升级到最新版本后的新 CORS 策略和 AJP 连接器问题

Question

Here's what we're running:

• Windows Server 2016 64-bit
• Apache: 2.4.46 (upgraded from 2.4.43) --> "frontend"
• Tomcat: 9.0.44 (upgraded from 9.0.8) --> "backend"
• Java: 12.0.2

We've got Apache and Tomcat all running on the same Windows server. It's the frontend & backend. I'm trying to get all of our stuff upgraded to the latest versions for security. Of course, I've broken everything.

After reviewing the Tomcat/Java logs, I found that the two of our AJP connectors would not start. I was required to add the following attributes to those connectors for them to fire up:

    <Connector
          ...
          ...
          address="0.0.0.0"
          secretRequired="false"
        />

That seemed to resolve most of our issues; however, now I'm experiencing problems with CORS for one of my web apps. Our other developers report no issues.

Access to XMLHttpRequest at 'https://SERVER/endpoint' from origin 'https://SERVER.DOMAIN.LOCAL' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

Now that I'm typing this, I notice that the 1st indicator is just the server's name, and the 2nd indicator is the server's FQDN. I wonder if that's the problem?

Why am I having all these issues after upgrading Tomcat/Apache?

If my AJP Connectors and Workers are all on the same box, do I need to set a secret?

Why am I now having an issue with CORS when I did not before? How do I setup the CORS Filter so that it knows that communication between Apache <--> Tomcat (from this server TO THIS server) is safe??!?

Is this setting below safe? We've never had this setting enabled prior to the upgrade.

<filter>
    <filter-name>CorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>CorsFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Answer 1

Now that I'm typing this, I notice that the 1st indicator is just the server's name, and the 2nd indicator is the server's FQDN. I wonder if that's the problem?

That was the problem. The page was at http://server.domain.local , but my app was making an AJAX call to http://server . Both should be the same, ie: BOTH as the FQDN server.domain.local , or BOTH as just the hostname server . There was not an issue with the Tomcat upgrade at all, and I was not required to create a CORS filter.

Why am I having all these issues after upgrading Tomcat/Apache?

In the last week, I have attempted to upgrade beyond 9.0.8 to versions 9.0.44 and 10.0.4 . In every attempt, I've discovered a 'breaking change'. I am growing weary.

Best I can tell, the requiredSecret started around version 9.0.31 :

• When secretRequired is true the AJP/1.3 Connector will not start unless the secret attribute is configured to a non-null, non-zero length String. (markt)
• https://tomcat.apache.org/tomcat-9.0-doc/changelog.html

A second 'breaking change' is related to the migration from 9.0.x to 10.0.x . Here's what Tomcat says:

• There is a significant breaking change between Tomcat 9.0.x and Tomcat 10.0.x. The Java package used by the specification APIs has changed from javax... to jakarta.... It will be necessary to recompile web applications against the new APIs. Alternatively, users can convert an existing WAR file from Java EE 8 to Jakarta EE 9 using the Apache Tomcat migration tool for Jakarta EE.
• http://tomcat.apache.org/migration-10.html

If my AJP Connectors and Workers are all on the same box, do I need to set a secret?

My boss told me to set it, so I did. I used the following set of instructions, which where fantastic: https://community.microstrategy.com/s/article/Setting-up-the-AJP-port-on-Tomcat-and-Apache-Servers?language=en_US

Why am I now having an issue with CORS when I did not before? How do I setup the CORS Filter so that it knows that communication between Apache <--> Tomcat (from this server TO THIS server) is safe??!?

Is this setting below safe? We've never had this setting enabled prior to the upgrade.

A CORS filter was ultimately unnecessary; however, if you were to implement one, this article describes how to create a more secure CORS filter:

https://newsroom.bedefended.com/implement-secure-cors-tomcat