Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Tomcat Error 403 the request body was too large to be cashed during authentication process
Its related to maxSavePostSize setting its currently default which is 4096 (4KB). In googling people suggest -1 (unrestricted). Does that means it could be subject of DOS attack? What you suggest?
Setting maxSavePostSize to -1 on a Tomcat instance that is accessible by untrusted users would be a monumentally stupid thing to do because – as you correctly suspect – it would open up the server to a DoS attack.
This setting is only used when POST’d content needs to be saved during authentication. i.e. when an unauthenticated user POST’s a request to a resource protected by FORM or CLIENT-CERT authentication.
There are a couple of solutions:
a) Structure your application in such a way that users are always authenticated before they are able to access pages that trigger POSTs
b) Increase the maxSavePostSize to the largest POST you expect you application to have to handle. If that is much larger than 4k then you may still be vulnerable to a DoS.
BTW, make sure you aren’t confusing this setting with maxPostSize.