Search code examples
debuggingtomcattomcat7

Why does tomcat returns "400 Bad Request" while using url which are similar to "something.com-xyz"


Why does Tomcat version 7.0.88 gives "400 Bad Request" error code if the hostname ends with xyx.com-abc.

For testing purpose let's assume we have the following entry in the hosts file

127.0.0.1 hello.hello.hello-erq

And we try to access this url from curl

curl -v hello.hello.hello-er:8080

We get the following output

* Rebuilt URL to: hello.hello.hello-er:8080/
*   Trying 127.0.0.1...
* Connected to hello.hello.hello-er (127.0.0.1) port 8080 (#0)
> GET / HTTP/1.1
> Host: hello.hello.hello-er:8080
> User-Agent: curl/7.49.0
> Accept: */*
>
< HTTP/1.1 400 Bad Request
< Server: Apache-Coyote/1.1
< Transfer-Encoding: chunked
< Date: Thu, 20 Dec 2018 19:53:09 GMT
< Connection: close
<
* Closing connection 0

While using the localhost in the url we get

 C:\playground\apache-tomcat-7.0.88-windows-x64\apache-tomcat-7.0.88\bin>curl -v localhost:8080
* Rebuilt URL to: localhost:8080/
*   Trying ::1...
*   Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 8080 (#0)
> GET / HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/7.49.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Server: Apache-Coyote/1.1
< Content-Type: text/html;charset=ISO-8859-1
< Transfer-Encoding: chunked
< Date: Thu, 20 Dec 2018 20:00:07 GMT
<

<!DOCTYPE html>

All the tomcat configurations are the same for both the tests and the same issue is replicated on a vanilla out of the box tomcat server too.

I tried to replicate the same issue on tomcat-8 but both the url's worked fine there. How can i dig deeper and find out the root cause of this issue in 7.0.88 ?

Is there some additional logging which i can enable to get more on this issue ?

Or the only thing i have left is to pull my hairs and upgrade ?


Solution

  • Tomcat was attempting to enforce the domain name specification by refusing your hostname with a hyphen in the TLD. This was deemed a bug in Tomcat and fixed in 7.0.89 (and versions of Tomcat 8.0.x, 8.5.x and 9.0.x released around the same time).

    So it seems that all you need is a small version bump.