# Apache Tomcat 7

Version 7.0.4, Oct 14 2010

Links

- Docs Home
- Config Ref. Home

Top Level Elements

- Server
- Service

Executors

- Executor

Connectors

- HTTP
- AJP

Containers

- Context
- Engine
- Host
- Cluster

Nested Components

- Filter
- Global Resources
- JarScanner
- Listeners
- Loader
- Manager
- Realm
- Resources
- Valve

Cluster Elements

- Cluster
- Manager
- Channel
- Channel/Membership
- Channel/Sender
- Channel/Receiver
- Channel/Interceptor
- Valve
- Deployer
- ClusterListener

Global Settings

- System properties

# Container Provided Filters

Table of Contents

> - Introduction
> - Add Default Character Set Filter
>   1. Introduction
>   2. Filter Class Name
>   3. Initialisation parameters
> - CSRF Prevention Filter
>   1. Introduction
>   2. Filter Class Name
>   3. Initialisation parameters
> - Expires Filter
>   1. Introduction
>   2. Basic configuration sample
>   3. Alternate Syntax
>   4. Expiration headers generation eligibility
>   5. Expiration configuration selection
>   6. Filter Class Name
>   7. Initialisation parameters
>   8. Troubleshooting
> - Remote Address Filter
>   1. Introduction
>   2. Filter Class Name
>   3. Initialisation parameters
> - Remote Host Filter
>   1. Introduction
>   2. Filter Class Name
>   3. Initialisation parameters
> - Remote IP Filter
>   1. Introduction
>   2. Filter Class Name
>   3. Basic configuration to handle 'x-forwarded-for'
>   4. Basic configuration to handle 'x-forwarded-for' and 'x-forwarded-proto'
>   5. Advanced configuration with internal proxies
>   6. Advanced configuration with trusted proxies
>   7. Advanced configuration with internal and trusted proxies
>   8. Advanced configuration with an untrusted proxy
>   9. Initialisation parameters
> - Request Dumper Filter
>   1. Introduction
>   2. Filter Class Name
>   3. Initialisation parameters
>   4. Sample Configuration
> - WebDAV Fix Filter
>   1. Introduction
>   2. Filter Class Name
>   3. Initialisation parameters

Introduction

> Tomcat provides a number of Filters which may be configured for use with all web applications using `$CATALINA_BASE/conf/web.xml` or may be configured for individual web applications by configuring them in the application's `WEB-INF/web.xml`. Each filter is described below.

> > This description uses the variable name $CATALINA_BASE to refer the base directory against which most relative paths are resolved. If you have not configured Tomcat for multiple instances by setting a CATALINA_BASE directory, then $CATALINA_BASE will be set to the value of $CATALINA_HOME, the directory into which you have installed Tomcat.

Add Default Character Set Filter

> Introduction

> > The HTTP specification is clear that if no character set is specified for media sub-types of the "text" media type, the ISO-8859-1 character set must be used. However, browsers may attempt to auto-detect the character set. This may be exploited by an attacker to perform an XSS attack. Internet Explorer has this behaviour by default. Other browsers have an option to enable it.

> > This filter prevents the attack by explicitly setting a character set. Unless the provided character set is explicitly overridden by the user the browser will adhere to the explicitly set character set, thus preventing the XSS attack.

> Filter Class Name

> > The filter class name for the Add Default Character Set Filter is `org.apache.catalina.filters.AddDefaultCharsetFilter` .

> Initialisation parameters

> > The Add Default Character Set Filter supports the following initialization parameters:

> > Attribute | Description
> > --- | ---
> > `encoding` | Name of the character set which should be set, if no other character set was set explicitly by a Servlet. This parameter has two special values `default` and `system`. A value of `system` uses the JVM wide default character set, which is usually set by locale. A value of `default` will use ISO-8859-1.

CSRF Prevention Filter

> Introduction

> > This filter provides basic CSRF protection for a web application. The filter assumes that it is mapped to `/*` and that all URLs returned to the client are encoded via a call to `HttpServletResponse#encodeRedirectURL(String)` or `HttpServletResponse#encodeURL(String)`.

> > This filter prevents CSRF by generating a nonce and storing it in the session. URLs are also encoded with the same nonce. When the next request is received the nonce in the request is compared to the nonce in the session and only if they are the same is the request allowed to continue.

> Filter Class Name

> > The filter class name for the CSRF Prevention Filter is `org.apache.catalina.filters.CsrfPreventionFilter` .

> Initialisation parameters

> > The CSRF Prevention Filter supports the following initialisation parameters:

> > Attribute | Description
> > --- | ---
> > `entryPoints` | A comma separated list of URLs that will not be tested for the presence of a valid nonce. They are used to provide a way to navigate back to a protected application after having navigated away from it. Entry points will be limited to HTTP GET requests and should not trigger any security sensitive actions.
> > `nonceCacheSize` | The number of previously issued nonces that will be cached on a LRU basis to support parallel requests, limited use of the refresh and back in the browser and similar behaviors that may result in the submission of a previous nonce rather than the current one. If not set, the default value of 5 will be used.
> > `randomClass` | The name of the class to use to generate nonces. The class must be an instance of `java.util.Random`. If not set, the default value of `java.security.SecureRandom` will be used.

Expires Filter

> Introduction

> > ExpiresFilter is a Java Servlet API port of Apache mod_expires. This filter controls the setting of the `Expires` HTTP header and the `max-age` directive of the `Cache-Control` HTTP header in server responses. The expiration date can set to be relative to either the time the source file was last modified, or to the time of the client access.

> > These HTTP headers are an instruction to the client about the document's validity and persistence. If cached, the document may be fetched from the cache rather than from the source until this time has passed. After that, the cache copy is considered "expired" and invalid, and a new copy must be obtained from the source.

> > To modify `Cache-Control` directives other than `max-age` (see RFC 2616 section 14.9), you can use other servlet filters or Apache Httpd mod_headers module.

> Basic configuration sample

> > Basic configuration to add '`Expires`' and '`Cache-Control: max-age=`' headers to images, css and javascript.

> >     <filter>
> >      <filter-name>ExpiresFilter</filter-name>
> >      <filter-class>org.apache.catalina.filters.ExpiresFilter</filter-class>
> >      <init-param>
> >         <param-name>ExpiresByType image</param-name>
> >         <param-value>access plus 10 minutes</param-value>
> >      </init-param>
> >      <init-param>
> >         <param-name>ExpiresByType text/css</param-name>
> >         <param-value>access plus 10 minutes</param-value>
> >      </init-param>
> >      <init-param>
> >         <param-name>ExpiresByType text/javascript</param-name>
> >         <param-value>access plus 10 minutes</param-value>
> >      </init-param>
> >     </filter>
> >     ...
> >     <filter-mapping>
> >      <filter-name>ExpiresFilter</filter-name>
> >      <url-pattern>/*</url-pattern>
> >      <dispatcher>REQUEST</dispatcher>
> >     </filter-mapping>

> Alternate Syntax

> > The `ExpiresDefault` and `ExpiresByType` directives can also be defined in a more readable syntax of the form:

> >     <init-param>
> >      <param-name>ExpiresDefault</param-name>
> >      <param-value><base> [plus] {<num>   <type>}*</param-value>
> >     </init-param>

> >     <init-param>
> >      <param-name>ExpiresByType type</param-name>
> >      <param-value><base> [plus]   {<num> <type>}*</param-value>
> >     </init-param>

> >     <init-param>
> >      <param-name>ExpiresByType type;encoding</param-name>
> >      <param-value><base> [plus]   {<num> <type>}*</param-value>
> >     </init-param>

> > where `<base>` is one of:

> > - `access`
> > - `now` (equivalent to '`access`')
> > - `modification`

> > The `plus` keyword is optional. `<num>` should be an integer value (acceptable to `Integer.parseInt()`), and `<type>` is one of:

> > - `years`
> > - `months`
> > - `weeks`
> > - `days`
> > - `hours`
> > - `minutes`
> > - `seconds`
> > For example, any of the following directives can be used to make documents expire 1 month after being accessed, by default:

> >     <init-param>
> >      <param-name>ExpiresDefault</param-name>
> >      <param-value>access plus 1 month</param-value>
> >     </init-param>

> >     <init-param>
> >      <param-name>ExpiresDefault</param-name>
> >      <param-value>access plus 4 weeks</param-value>
> >     </init-param>

> >     <init-param>
> >      <param-name>ExpiresDefault</param-name>
> >      <param-value>access plus 30 days</param-value>
> >     </init-param>

> > The expiry time can be fine-tuned by adding several ' `<num> <type>`' clauses:

> >     <init-param>
> >      <param-name>ExpiresByType text/html</param-name>
> >      <param-value>access plus 1 month 15   days 2 hours</param-value>
> >     </init-param>

> >     <init-param>
> >      <param-name>ExpiresByType image/gif</param-name>
> >      <param-value>modification plus 5 hours 3   minutes</param-value>
> >     </init-param>

> > Note that if you use a modification date based setting, the `Expires` header will not be added to content that does not come from a file on disk. This is due to the fact that there is no modification time for such content.

> Expiration headers generation eligibility

> > A response is eligible to be enriched by `ExpiresFilter` if :

> > 1. no expiration header is defined (`Expires` header or the `max-age` directive of the `Cache-Control` header),
> > 2. the response status code is not excluded by the directive `ExpiresExcludedResponseStatusCodes`,
> > 3. the `Content-Type` of the response matches one of the types defined the in `ExpiresByType` directives or the `ExpiresDefault` directive is defined.

> > Note : If `Cache-Control` header contains other directives than `max-age`, they are concatenated with the `max-age` directive that is added by the `ExpiresFilter`.

> Expiration configuration selection

> > The expiration configuration if elected according to the following algorithm:

> > 1. `ExpiresByType` matching the exact content-type returned by `HttpServletResponse.getContentType()` possibly including the charset (e.g. '`text/xml;charset=UTF-8`'),
> > 2. `ExpiresByType` matching the content-type without the charset if `HttpServletResponse.getContentType()` contains a charset (e.g. ' `text/xml;charset=UTF-8`' -> '`text/xml`'),
> > 3. `ExpiresByType` matching the major type (e.g. substring before '`/`') of `HttpServletResponse.getContentType()` (e.g. '`text/xml;charset=UTF-8`' -> '`text` '),
> > 4. `ExpiresDefault`

> Filter Class Name

> > The filter class name for the Expires Filter is `org.apache.catalina.filters.ExpiresFilter` .

> Initialisation parameters

> > The Expires Filter supports the following initialisation parameters:

> > Attribute | Description
> > --- | ---

> > `ExpiresExcludedResponseStatusCodes`

> > This directive defines the http response status codes for which the `ExpiresFilter` will not generate expiration headers. By default, the `304` status code ("`Not modified`") is skipped. The value is a comma separated list of http status codes.

> > This directive is useful to ease usage of `ExpiresDefault` directive. Indeed, the behavior of `304 Not modified` (which does specify a `Content-Type` header) combined with `Expires` and `Cache-Control:max-age=` headers can be unnecessarily tricky to understand.

> > Sample : exclude response status codes 302, 500 and 503

> >     <init-param>
> >      <param-name>ExpiresExcludedResponseStatusCodes</param-name>
> >      <param-value>302, 500, 503</param-value>
> >     </init-param>

> > `ExpiresByType <content-type>`

> > This directive defines the value of the `Expires` header and the `max-age` directive of the `Cache-Control` header generated for documents of the specified type (e.g., `text/html`). The second argument sets the number of seconds that will be added to a base time to construct the expiration date. The `Cache-Control: max-age` is calculated by subtracting the request time from the expiration date and expressing the result in seconds.

> > The base time is either the last modification time of the file, or the time of the client's access to the document. Which should be used is specified by the `<code>` field; `M` means that the file's last modification time should be used as the base time, and `A` means the client's access time should be used. The duration is expressed in seconds. `A2592000` stands for `access plus 30 days` in alternate syntax.

> > The difference in effect is subtle. If `M` (`modification` in alternate syntax) is used, all current copies of the document in all caches will expire at the same time, which can be good for something like a weekly notice that's always found at the same URL. If `A` ( `access` or `now` in alternate syntax) is used, the date of expiration is different for each client; this can be good for image files that don't change very often, particularly for a set of related documents that all refer to the same images (i.e., the images will be accessed repeatedly within a relatively short timespan).

> > Note: When the content type includes a charset (e.g. `'ExpiresByType text/xml;charset=utf-8'`), Tomcat removes blank chars between the '`;`' and the '`charset`' keyword. Due to this, configuration of an expiration with a charset must not include such a space character.

> > Sample:

> >     <init-param>
> >        <param-name>ExpiresByType text/html</param-name>
> >        <param-value>access plus 1 month 15   days 2 hours</param-value>
> >     </init-param>

> >     <init-param>
> >        <!-- 2592000 seconds = 30 days -->
> >        <param-name>ExpiresByType image/gif</param-name>
> >        <param-value>A2592000</param-value>
> >     </init-param>

> > It overrides, for the specified MIME type only, any expiration date set by the `ExpiresDefault` directive.

> > You can also specify the expiration time calculation using an alternate syntax, described earlier in this document.

> > `ExpiresDefault` | This directive sets the default algorithm for calculating the expiration time for all documents in the affected realm. It can be overridden on a type-by-type basis by the `ExpiresByType` directive. See the description of that directive for details about the syntax of the argument, and the "alternate syntax" description as well.

> Troubleshooting

> > To troubleshoot, enable logging on the `org.apache.catalina.filters.ExpiresFilter`.

> > Extract of logging.properties

> >     org.apache.catalina.filters.ExpiresFilter.level = FINE

> > Sample of initialization log message:

> >     Mar 26, 2010 2:01:41 PM org.apache.catalina.filters.ExpiresFilter init
> >     FINE: Filter initialized with configuration ExpiresFilter[
> >      excludedResponseStatusCode=[304],
> >      default=null,
> >      byType={
> >         image=ExpiresConfiguration[startingPoint=ACCESS_TIME, duration=[10 MINUTE]],
> >         text/css=ExpiresConfiguration[startingPoint=ACCESS_TIME, duration=[10 MINUTE]],
> >         text/javascript=ExpiresConfiguration[startingPoint=ACCESS_TIME, duration=[10 MINUTE]]}]

> > Sample of per-request log message where `ExpiresFilter` adds an expiration date:

> >     Mar 26, 2010 2:09:47 PM org.apache.catalina.filters.ExpiresFilter onBeforeWriteResponseBody
> >     FINE: Request "/tomcat.gif" with response status "200" content-type "image/gif", set expiration date 3/26/10 2:19 PM

> > Sample of per-request log message where `ExpiresFilter` does not add an expiration date:

> >     Mar 26, 2010 2:10:27 PM org.apache.catalina.filters.ExpiresFilter onBeforeWriteResponseBody
> >     FINE: Request "/docs/config/manager.html" with response status "200" content-type "text/html", no expiration configured

Remote Address Filter

> Introduction

> > The Remote Address Filter allows you to compare the IP address of the client that submitted this request against one or more regular expressions, and either allow the request to continue or refuse to process the request from this client.

> > The syntax for regular expressions is different than that for 'standard' wildcard matching. Tomcat uses the `java.util.regex` package. Please consult the Java documentation for details of the expressions supported.

> Filter Class Name

> > The filter class name for the Remote Address Filter is `org.apache.catalina.filters.RemoteAddrFilter` .

> Initialisation parameters

> > The Remote Address Filter supports the following initialisation parameters:

> > Attribute | Description
> > --- | ---
> > `allow` | A comma-separated list of regular expression patterns that the remote client's IP address is compared to. If this attribute is specified, the remote address MUST match for this request to be accepted. If this attribute is not specified, all requests will be accepted UNLESS the remote address matches a `deny` pattern.
> > `deny` | A comma-separated list of regular expression patterns that the remote client's IP address is compared to. If this attribute is specified, the remote address MUST NOT match for this request to be accepted. If this attribute is not specified, request acceptance is governed solely by the `accept` attribute.

Remote Host Filter

> Introduction

> > The Remote Host Filter allows you to compare the hostname of the client that submitted this request against one or more regular expressions, and either allow the request to continue or refuse to process the request from this client.

> > The syntax for regular expressions is different than that for 'standard' wildcard matching. Tomcat uses the `java.util.regex` package. Please consult the Java documentation for details of the expressions supported.

> Filter Class Name

> > The filter class name for the Remote Address Filter is `org.apache.catalina.filters.RemoteHostFilter` .

> Initialisation parameters

> > The Remote Host Filter supports the following initialisation parameters:

> > Attribute | Description
> > --- | ---
> > `allow` | A comma-separated list of regular expression patterns that the remote client's hostname is compared to. If this attribute is specified, the remote hostname MUST match for this request to be accepted. If this attribute is not specified, all requests will be accepted UNLESS the remote hostname matches a `deny` pattern.
> > `deny` | A comma-separated list of regular expression patterns that the remote client's hostname is compared to. If this attribute is specified, the remote hostname MUST NOT match for this request to be accepted. If this attribute is not specified, request acceptance is governed solely by the `accept` attribute.

Remote IP Filter

> Introduction

> > Tomcat port of mod_remoteip, this filter replaces the apparent client remote IP address and hostname for the request with the IP address list presented by a proxy or a load balancer via a request headers (e.g. "X-Forwarded-For").

> > Another feature of this filter is to replace the apparent scheme (http/https), server port and `request.secure` with the scheme presented by a proxy or a load balancer via a request header (e.g. "X-Forwarded-Proto").

> > If used in conjunction with Remote Address/Host filters then this filter should be defined first to ensure that the correct client IP address is presented to the Remote Address/Host filters.

> Filter Class Name

> > The filter class name for the Remote IP Filter is `org.apache.catalina.filters.RemoteIpFilter` .

> Basic configuration to handle 'x-forwarded-for'

> > The filter will process the `x-forwarded-for` http header.

> >           <filter>
> >             <filter-name>RemoteIpFilter</filter-name>
> >             <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class>
> >           </filter>

> >           <filter-mapping>
> >             <filter-name>RemoteIpFilter</filter-name>
> >             <url-pattern>/*</url-pattern>
> >             <dispatcher>REQUEST</dispatcher>
> >           </filter-mapping>

> Basic configuration to handle 'x-forwarded-for' and 'x-forwarded-proto'

> > The filter will process `x-forwarded-for` and `x-forwarded-proto` http headers. Expected value for the `x-forwarded-proto` header in case of SSL connections is `https` (case insensitive).

> >           <filter>
> >             <filter-name>RemoteIpFilter</filter-name>
> >             <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class>
> >             <init-param>
> >               <param-name>protocolHeader</param-name>
> >               <param-value>x-forwarded-proto</param-value>
> >             </init-param>
> >           </filter>

> >           <filter-mapping>
> >             <filter-name>RemoteIpFilter</filter-name>
> >             <url-pattern>/*</url-pattern>
> >             <dispatcher>REQUEST</dispatcher>
> >           </filter-mapping>

> Advanced configuration with internal proxies

> > RemoteIpFilter configuration:

> >          <filter>
> >            <filter-name>RemoteIpFilter</filter-name>
> >            <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class>
> >            <init-param>
> >              <param-name>allowedInternalProxies</param-name>
> >              <param-value>192\.168\.0\.10, 192\.168\.0\.11</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>remoteIpHeader</param-name>
> >              <param-value>x-forwarded-for</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>remoteIpProxiesHeader</param-name>
> >              <param-value>x-forwarded-by</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>protocolHeader</param-name>
> >              <param-value>x-forwarded-proto</param-value>
> >            </init-param>
> >          </filter>

> > Request values:

> > Property | Value Before RemoteIpFilter | Value After RemoteIpFilter
> > --- | --- | ---
> > request.remoteAddr | 192.168.0.10 | 140.211.11.130
> > request.header`[`'x-forwarded-for'`]` | 140.211.11.130, 192.168.0.10 | null
> > request.header`[`'x-forwarded-by'`]` | null | null
> > request.header`[`'x-forwarded-proto'`]` | https | https
> > request.scheme | http | https
> > request.secure | false | true
> > request.serverPort | 80 | 443

> > Note : `x-forwarded-by` header is `null` because only internal proxies has been traversed by the request. `x-forwarded-for` is `null` because all the proxies are trusted or internal.

> Advanced configuration with trusted proxies

> > RemoteIpFilter configuration:

> >          <filter>
> >            <filter-name>RemoteIpFilter</filter-name>
> >            <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class>
> >            <init-param>
> >              <param-name>allowedInternalProxies</param-name>
> >              <param-value>192\.168\.0\.10, 192\.168\.0\.11</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>remoteIpHeader</param-name>
> >              <param-value>x-forwarded-for</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>remoteIpProxiesHeader</param-name>
> >              <param-value>x-forwarded-by</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>trustedProxies</param-name>
> >              <param-value>proxy1, proxy2</param-value>
> >            </init-param>
> >          </filter>

> > Request values:

> > Property | Value Before RemoteIpFilter | Value After RemoteIpFilter
> > --- | --- | ---
> > request.remoteAddr | 192.168.0.10 | 140.211.11.130
> > request.header`[`'x-forwarded-for'`]` | 140.211.11.130, proxy1, proxy2 | null
> > request.header`[`'x-forwarded-by'`]` | null | proxy1, proxy2

> > Note : `proxy1` and `proxy2` are both trusted proxies that come in `x-forwarded-for` header, they both are migrated in `x-forwarded-by` header. `x-forwarded-for` is `null` because all the proxies are trusted or internal.

> Advanced configuration with internal and trusted proxies

> > RemoteIpFilter configuration:

> >          <filter>
> >            <filter-name>RemoteIpFilter</filter-name>
> >            <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class>
> >            <init-param>
> >              <param-name>allowedInternalProxies</param-name>
> >              <param-value>192\.168\.0\.10, 192\.168\.0\.11</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>remoteIpHeader</param-name>
> >              <param-value>x-forwarded-for</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>remoteIpProxiesHeader</param-name>
> >              <param-value>x-forwarded-by</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>trustedProxies</param-name>
> >              <param-value>proxy1, proxy2</param-value>
> >            </init-param>
> >          </filter>

> > Request values:

> > Property | Value Before RemoteIpFilter | Value After RemoteIpFilter
> > --- | --- | ---
> > request.remoteAddr | 192.168.0.10 | 140.211.11.130
> > request.header`[`'x-forwarded-for'`]` | 140.211.11.130, proxy1, proxy2, 192.168.0.10 | null
> > request.header`[`'x-forwarded-by'`]` | null | proxy1, proxy2

> > Note : `proxy1` and `proxy2` are both trusted proxies that come in `x-forwarded-for` header, they both are migrated in `x-forwarded-by` header. As `192.168.0.10` is an internal proxy, it does not appear in `x-forwarded-by`. `x-forwarded-for` is `null` because all the proxies are trusted or internal.

> Advanced configuration with an untrusted proxy

> > RemoteIpFilter configuration:

> >          <filter>
> >            <filter-name>RemoteIpFilter</filter-name>
> >            <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class>
> >            <init-param>
> >              <param-name>allowedInternalProxies</param-name>
> >              <param-value>192\.168\.0\.10, 192\.168\.0\.11</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>remoteIpHeader</param-name>
> >              <param-value>x-forwarded-for</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>remoteIpProxiesHeader</param-name>
> >              <param-value>x-forwarded-by</param-value>
> >            </init-param>
> >            <init-param>
> >              <param-name>trustedProxies</param-name>
> >              <param-value>proxy1, proxy2</param-value>
> >            </init-param>
> >          </filter>

> > Request values:

> > Property | Value Before RemoteIpFilter | Value After RemoteIpFilter
> > --- | --- | ---
> > request.remoteAddr | 192.168.0.10 | untrusted-proxy
> > request.header`[`'x-forwarded-for'`]` | 140.211.11.130, untrusted-proxy, proxy1 | 140.211.11.130
> > request.header`[`'x-forwarded-by'`]` | null | proxy1

> > Note : `x-forwarded-by` holds the trusted proxy `proxy1`. `x-forwarded-by` holds `140.211.11.130` because `untrusted-proxy` is not trusted and thus, we can not trust that `untrusted-proxy` is the actual remote ip. `request.remoteAddr` is `untrusted-proxy` that is an IP verified by `proxy1`.

> Initialisation parameters

> > The Remote IP Filter supports the following initialisation parameters:

> > Attribute | Description
> > --- | ---
> > `remoteIpHeader` | Name of the HTTP Header read by this valve that holds the list of traversed IP addresses starting from the requesting client. If not specified, the default of `x-forwarded-for` is used.
> > `internalProxies` | List of internal proxies' IP addresses as comma separated regular expressions. If they appear in the remoteIpHeader value, they will be trusted and will not appear in the proxiesHeader value. If not specified the default value of `10\.\d{1,3}\.\d{1,3}\.\d{1,3}, 192\.168\.\d{1,3}\.\d{1,3}, 169\.254\.\d{1,3}\.\d{1,3}, 127\.\d{1,3}\.\d{1,3}\.\d{1,3}` will be used.
> > `proxiesHeader` | Name of the HTTP header created by this valve to hold the list of proxies that have been processed in the incoming remoteIpHeader. If not specified, the default of `x-forwarded-by` is used.
> > `trustedProxies` | List of trusted proxies' IP addresses as comma separated regular expressions. If they appear in the remoteIpHeader value, they will be trusted and will appear in the proxiesHeader value. If not specified, no proxies will be trusted.
> > `protocolHeader` | Name of the HTTP Header read by this valve that holds the protocol used by the client to connect to the proxy. If not specified, the default of `null` is used.
> > `protocolHeaderHttpsValue` | Value of the protocolHeader to indicate that it is an HTTPS request. If not specified, the default of `https` is used.
> > `httpServerPort` | Value returned by `ServletRequest.getServerPort()` when the protocolHeader indicates `http` protocol. If not specified, the default of `80` is used.
> > `httpsServerPort` | Value returned by `ServletRequest.getServerPort()` when the protocolHeader indicates `https` protocol. If not specified, the default of `443` is used.

Request Dumper Filter

> Introduction

> > The Request Dumper Filter logs information from the request and response objects and is intended to be used for debugging purposes. When using this Filter, it is recommended that the `org.apache.catalina.filter.RequestDumperFilter` logger is directed to a dedicated file and that the `org.apache.juli.VerbatimFormmater` is used.

> > WARNING: Using this filter has side-effects. The output from this filter includes any parameters included with the request. The parameters will be decoded using the default platform encoding. Any subsequent calls to `request.setCharacterEncoding()` within the web application will have no effect.

> Filter Class Name

> > The filter class name for the Request Dumper Filter is `org.apache.catalina.filters.RequestDumperFilter` .

> Initialisation parameters

> > The Request Dumper Filter does not support any initialization parameters.

> Sample Configuration

> > The following entries in a web application's web.xml would enable the Request Dumper filter for all requests for that web application. If the entries were added to `CATALINA_BASE/conf/web.xml`, the Request Dumper Filter would be enabled for all web applications.

> >     <filter>
> >         <filter-name>requestdumper</filter-name>
> >         <filter-class>
> >             org.apache.catalina.filters.RequestDumperFilter
> >         </filter-class>
> >     </filter>
> >     <filter-mapping>
> >         <filter-name>requestdumper</filter-name>
> >         <url-pattern>*</url-pattern>
> >     </filter-mapping>

> > The following entries in CATALINA_BASE/conf/logging.properties would create a separate log file for the Request Dumper Filter output.

> >     # To this configuration below, 1request-dumper.org.apache.juli.FileHandler
> >     # also needs to be added to the handlers property near the top of the file
> >     1request-dumper.org.apache.juli.FileHandler.level = INFO
> >     1request-dumper.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
> >     1request-dumper.org.apache.juli.FileHandler.prefix = request-dumper.
> >     1request-dumper.org.apache.juli.FileHandler.formatter = org.apache.juli.VerbatimFormatter
> >     org.apache.catalina.filters.RequestDumperFilter.level = INFO
> >     org.apache.catalina.filters.RequestDumperFilter.handlers = 1request-dumper.org.apache.juli.FileHandler

WebDAV Fix Filter

> Introduction

> > Microsoft operating systems have two WebDAV clients. One is used with port 80, the other is used for all other ports. The implementation used with port 80 does not adhere to the WebDAV specification and fails when trying to communicate with the Tomcat WebDAV Servlet. This Filter provides a fix for this by forcing the use of the WebDAV implementation that works, even when connecting via port 80.

> Filter Class Name

> > The filter class name for the WebDAV Fix Filter is `org.apache.catalina.filters.WebdavFixFilter` .

> Initialisation parameters

> > The WebDAV Fix Filter does not support any initialization parameters.

Copyright © 1999-2010, Apache Software Foundation