This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Talk:Securing tomcat"
| Line 25: | Line 25: | ||
... | ... | ||
</Context> | </Context> | ||
| + | |||
| + | [[User:Simon Bennetts|Simon Bennetts]] 14:40, 18 June 2010 (UTC) | ||
Revision as of 13:40, 18 June 2010
InvokerServlet
There needs to be an addendum in here about disabling the InvokerServlet. See my blog entry at [yet-another-dev.blogspot.com] for details about why this is a bad idea. --Chris Schmidt 22:03, 17 December 2009 (UTC)
File permissions
Hmm, what does "Make sure tomcat user has read/write access to /tmp" mean?
Tomcat creates a directory "temp", not "tmp", and read/write on a directory doesn't actually allow reading or writing. I assume the intention is "chmod 700 temp"... would love if anyone can clarify. Douglasheld 18:06, 3 April 2009 (UTC)
Newer Tomcat branches
This page is hopelessly outdated for anyone working with the Tomcat 6 branch. We need to figure out the best way to document security measures for the different supported branches. Ken 10:25, 20 March 2009 (UTC)
I've not had call to use Tomcat 6, but in a few months I plan to start experimenting with the embedded version. I don't mind expanding the article to have a section on 6 (and keep the section on 5.5), but I can't contribute anything just yet. My preference would be a single article as it will cut down on duplication. In the meantime, any differences, areas to cover, new features, etc. that others could note down will help speed things up. Darren 09:11, 26 March 2009 (UTC)
HttpOnly configuration
Tomcat versions from 5.5.28 and 6.0.19 support the HttpOnly [1] cookie option.
This is configured in the conf/context.xml file:
<Context useHttpOnly="true"> ... </Context>
Simon Bennetts 14:40, 18 June 2010 (UTC)
