Spring Boot unconditionally set useRelativeRedirects on the Tomcat
Context, defaulting it to false. That overrode Tomcat's own default and
forced absolute Location headers on every sendRedirect.
Keep server.tomcat.use-relative-redirects a simple boolean, but default
it to true so that relative Location headers are used out of the box.
The property can still be set to false to opt back into absolute
redirects.
Smoke tests that asserted a port-qualified absolute Location are updated
to the relative form, and the proxy tip in the reference documentation is
qualified since the context root redirect no longer carries a scheme.
Signed-off-by: Tiziano Basile <tiz.basile@gmail.com>
See gh-51173
Applying an SSL bundle to a Tomcat server replaced any `SSLHostConfig`
already registered on the connector for a host name, so an
`SSLHostConfig` could not be configured before Spring Boot applied a
bundle to it.
Reuse any existing `SSLHostConfig` during initial configuration, so an
`SSLHostConfig` registered on the connector before the bundle is
applied retains settings such as `trustManagerClassName`,
`truststoreProvider`, or `truststoreAlgorithm`.
Client authentication settings are only applied when creating a new
`SSLHostConfig`, so the `certificateVerification` of an existing
`SSLHostConfig` is retained rather than being overwritten with the
value derived from the `server.ssl.client-auth` property.
See gh-51466
Signed-off-by: Scott Frederick <scottyfred@gmail.com>
Tomcat's SSL configuration is applied to an `SSLHostConfig` for each
host name. When an SSL bundle was updated, a new `SSLHostConfig` was
created and used to replace the existing one for that host name,
discarding any customizations that had been applied to it (for example
by a `TomcatConnectorCustomizer`).
Reuse the existing `SSLHostConfig` for the host name when one is
present, applying the updated bundle to it rather than replacing it. The
existing `SSLHostConfigCertificate` is also reused, as adding a second
certificate with an undefined type to an `SSLHostConfig` is rejected by
Tomcat.
See gh-51290
Signed-off-by: Scott Frederick <scottyfred@gmail.com>
Prior to this commit, Spring Boot would auto-configure the
`ForwardedHeaderFilter`/`ForwardedHeaderTransformer` when the "NATIVE"
strategy is chosen.
Spring Framework now requires an explicit choice between the supported
HTTP header variants as of spring-projects/spring-framework#37072.
This commit adapts to this new behavior with the following:
* the "FRAMEWORK" strategy now only applies to Spring MVC and Spring
WebFlux applications, since "NATIVE" strategies are now a good choice
for most deployments.
* the format of HTTP headers is now configured with
`spring.mvc.forwarded-headers.header-format` and
`spring.webflux.forwarded-headers.header-format`, with additional
options.
The default header format is now "X-Forwarded-*" for both NATIVE and
FRAMEWORK strategies. The reference documentation also reflects those
changes.
Closes gh-51030
Remove NoSuchMethodError catch blocks and reflective fallbacks for
dependency versions that are no longer supported
See gh-50383
Signed-off-by: Sebastien Tardif <sebtardif@ncf.ca>
Tomcat 9.0.115, 10.1.52, and 11.0.18 include a breaking change [1] to
how ciphers are configured when using HTTPS. Previously, a single
setting was used but this has now been split in two; the existing
ciphers setting for TLSv1.2 ciphers and a new ciperSuites setting for
TLSv1.3. As part of this split, the behavior of the ciphers setting
has been changed such that any TLSv1.3 ciphers are ignored and a
warning is logged.
This change in Tomcat is problematic without also making some changes
in Boot. If we had done nothing, a user that had configured only
TLSv1.3 cipers would have them all ignored, leaving their SSL
connection unexpectedly using all of the default ciphers which may be
less secure.
This commit adapts to the breaking change in Tomcat by taking the
user's list of ciphers and splitting into into TLSv1.2 and TLSv1.3
ciphers before passing them into Tomcat's two settings (ciphers and
cipherSuites respectively). This is done defensively for backwards
compatibility. If the methods to identify and configure the TLSv1.3
ciphers are not present, we assume that we're running with an earlier
version of Tomcat and fall back to passing them all into the ciphers
setting as we did previously.
Closes gh-49143
[1] https://github.com/apache/tomcat/commit/9abf6bddb2e84ecf1668780bb3150b799f832ccf
Tomcat 9.0.115, 10.1.52, and 11.0.18 include a breaking change [1] to
how ciphers are configured when using HTTPS. Previously, a single
setting was used but this has now been split in two; the existing
ciphers setting for TLSv1.2 ciphers and a new ciperSuites setting for
TLSv1.3. As part of this split, the behavior of the ciphers setting
has been changed such that any TLSv1.3 ciphers are ignored and a
warning is logged.
This change in Tomcat is problematic without also making some changes
in Boot. If we had done nothing, a user that had configured only
TLSv1.3 cipers would have them all ignored, leaving their SSL
connection unexpectedly using all of the default ciphers which may be
less secure.
This commit adapts to the breaking change in Tomcat by taking the
user's list of ciphers and splitting into into TLSv1.2 and TLSv1.3
ciphers before passing them into Tomcat's two settings (ciphers and
cipherSuites respectively). This is done defensively for backwards
compatibility. If the methods to identify and configure the TLSv1.3
ciphers are not present, we assume that we're running with an earlier
version of Tomcat and fall back to passing them all into the ciphers
setting as we did previously.
Closes gh-49108
[1] https://github.com/apache/tomcat/commit/9abf6bddb2e84ecf1668780bb3150b799f832ccf
Change `spring-boot-tomcat-runtime` and `spring-boot-jetty-runtime`
into starter POMs and reduce the number of dependencies needed for
`spring-boot-tomcat` and `spring-boot-jetty`.
The runtime starters provide only the jars required to run the
embedded server along with the module jar itself (excluding transitive
dependencies) and `spring-boot-webserver` (excluding transitive
dependencies).
The build setup required for an executable jar is slightly different
between Maven and Gradle. For Maven, the regular module is put in the
`provided` scope. For Gradle, the regular module remains in main
configuration and the runtime jar is put in the `providedRuntime`
configuration. The reference documentation has been updated to
show how to configure things if starters are being used.
Manual testing has been performed to ensure that wars build with Maven
and Gradle work with both Tomcat and Jetty in both deployed and
`java -jar` modes.
Closes gh-48175
Andy Wilkinson
Hyunwoo Jung
Stéphane Nicoll
Tiziano Basile
Manu Sridharan
Scott Frederick
Phillip Webb
Brian Clozel
Yanming Zhou
Sebastien Tardif
jdsalasca
Moritz Halbritter
Kevin Zittritsch