Tomcat repeated 401 and the client nonce cache

Posted by PaulNBN on Server Fault See other posts from Server Fault or by PaulNBN
Published on 2012-03-27T12:22:03Z Indexed on 2012/10/31 5:07 UTC
Read the original article Hit count: 406

Filed under:

tomcat

I've got a Tomcat 6.0.35 service with a SOAP based webapp protected by Digest Authentication. We are seeing issues with various users getting repeated 401 responses since we upgraded to 6.0.35. Additionally we are getting the following entries in Catalina log:

WARNING: A valid entry has been removed from client nonce cache to make room for 
new entries. A replay attack is now possible. To prevent the possibility of 
replay attacks, reduce nonceValidity or increase cnonceCacheSize. Further 
warnings of this type will be suppressed for 5 minutes.

Any idea what is going on?

Related posts about tomcat

SSL in tomcat with apr and Centos 6

as seen on Super User - Search for 'Super User'
I'm facing a problem setting up my tomcat with apr native lib, I have the following: Tomcat: 7.0.42 Java: 1.7.0_40-b43 OS: Centos 6.4 (2.6.32-358.18.1.el6.i686) APR: 1.3.9 Native lib: 1.1.27 OpenSSL: openssl-1.0.0-27.el6_4.2.i686 My server.xml looks like: ... <Listener className="org.apache… >>> More
Apache+Tomcat VS Stand Alone Tomcat or GlassFish

as seen on Server Fault - Search for 'Server Fault'
Hi, I am setting up a Debian server to serve Java web applications. I have done quite a bit of research for several weeks now. Tomcat's web site says it is better to use stand alone Tomcat for speed if you are not clustering. However, I have seen many people suggest that using Apache + Tomcat… >>> More
Tomcat - How to limit the maximum memory Tomcat will use

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi Guys, I am running Tomcat on a small VPS (256MB/512MB) and I want to explicitly limit the amount of memory Tomcat uses. I understand that I can configure this somehow by passing in the java maximum heap and initial heap size arguments; -Xmx256m -Xms128m But I can't find where to put this… >>> More
Tomcat 4.1.X and Tomcat 5.0.X

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a problem about tomcat, Our application designed on Tomcat 4.1.X and When I restart Tomcat 4.1.X there is no problem. But I upgrade it to Tomcat 5.0.X. Now ,when I restart Tomcat 5.0.X session is down and application redirect me to login page. Any idea? >>> More
Restarting Tomcat from Tomcat itself

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, is it possible to restart Tomcat6 by executing a JSP? This because I would like to deploy the changes of an application by doing it remotely using the webserver. The deploy script is written in bash and it checkouts the latest version from the svn, then package it as a war, then copy it in… >>> More

Developer IT

Tomcat repeated 401 and the client nonce cache - Developer IT

Tomcat repeated 401 and the client nonce cache

tomcat

Related posts about tomcat

SSL in tomcat with apr and Centos 6

Apache+Tomcat VS Stand Alone Tomcat or GlassFish

Tomcat - How to limit the maximum memory Tomcat will use

Tomcat 4.1.X and Tomcat 5.0.X

Restarting Tomcat from Tomcat itself

Categories cloud