How do I configure tomcat to handle bad HTTP clients?

Question

We're running jBoss 5.1, which in turn uses the Tomcat servlet container.

We've been seeing some cases where bad HTTP clients will open a socket, make an HTTP request, fail to read all data and fail to close the connection.

The outcome is that the tomcat threads block indefinitely trying to write to the output stream:

SocketOutputStream.socketWrite0(FileDescriptor, byte[], int, int) 
SocketOutputStream.socketWrite(byte[], int, int) 
SocketOutputStream.write(byte[], int, int)  
InternalOutputBuffer.realWriteBytes(byte[], int, int) 
ByteChunk.flushBuffer()
ByteChunk.append(byte[], int, int)
InternalOutputBuffer$OutputStreamOutputBuffer.doWrite(ByteChunk, Response)
IdentityOutputFilter.doWrite(ByteChunk, Response)
InternalOutputBuffer.doWrite(ByteChunk, Response) 
Response.doWrite(ByteChunk)
OutputBuffer.realWriteBytes(byte[], int, int) 
ByteChunk.append(byte[], int, int) 
OutputBuffer.writeBytes(byte[], int, int) 
OutputBuffer.write(byte[], int, int)    
CoyoteOutputStream.write(byte[], int, int)

How can I configure these connections to timeout?

Answer 1

You can put Apache in front of it. Seriously.

Answer 2

There doesn't seem to be any timeout when using the default connector. The NioConnector does seem to have write timeouts (though there's some TODO comments in the source surrounding this).

So, if you feel like doing some testing, use the NioConnector, and set the undocumented 'timout' option - the sourcecode might imply that disableUploadTimeout have to be 'false' for that to take effect.

Basically, in your server.xml change the http Connector element to something like this:

<Connector port="8080" protocol="org.apache.coyote.http11.Http11NioProtocol" 
  timeout="60000"
  disableUploadTimeout="false"        
  connectionTimeout="20000" 
  redirectPort="8443" />

(From a default tomcat 6.0.20 server.xml file, the timeout and disableUploadTimeout attributes is added, and the protocol attribute is changed to "org.apache.coyote.http11.Http11NioProtocol")

mod_jk does seem to have a handful of timeout setings and ought to work more closely with apache than mod_proxy does.

Answer 3

Is there anything on this page that helps regarding timeouts? http://tomcat.apache.org/connectors-doc/generic_howto/timeouts.html