ALLOW_ENCODED_SLASH on AWS Elasticbeanstalk

Question

How do I configure ElasticBeanstalk on AWS to allow encoded slashes in URLs? (Using -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH = true)

I created a directory called .ebextensions with the tomcat.config file in the top level directory of my source package ( http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers.html ) with the contents:

commands: allow-encoded-slash: command: export CATALINA_OPTS="$CATALINA_OPTS -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true" cwd: /home/ec2-user 

But this does not seem to have any effect; it does not appear in these directories:

 ls -la /tmp/deployment/application/ROOT/ ls -la /var/lib/tomcat7/webapps/ROOT/ 

Answer 1

ElasticBeanstalk has apache (I think for Load Balancer) before Tomcat, so this is the first one to receive the request, and where it should be indicated that slashes should not be decoded.

To get this, we used this virtual host:

 <VirtualHost *:80> <Proxy *> Order deny,allow Allow from all </Proxy> ProxyPass / http://localhost:8080/ retry=0 ProxyPassReverse / http://localhost:8080/ ProxyPreserveHost on AllowEncodedSlashes NoDecode LogFormat "%h (%{X-Forwarded-For}i) %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" ErrorLog /var/log/httpd/elasticbeanstalk-error_log TransferLog /var/log/httpd/elasticbeanstalk-access_log </VirtualHost> 

This URL is useful for setting up EBS and its apache http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/customize-containers.html

Answer 2

We also tried to set the ALLOW_ENCODED_SLASH system property through the "Edit Configuration" dialog in the Elastic Beanstalk console. But, although the property seems to be present, Tomcat still does not allow the use of coded slashes (% 2F).

We believe that the system property ALLOW_ENCODED_SLASH is set correctly, because:

1) We see this property in the java command that starts Tomcat:

 /usr/lib/jvm/jre/bin/java -DAWS_ACCESS_KEY_ID= -DAWS_SECRET_KEY= -DJDBC_CONNECTION_STRING= -DPARAM1= -DPARAM2= -DPARAM3= -DPARAM4= -DPARAM5= -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH=true -Dhazelcast.native.client=true -Dcom.sun.management.jmxremote -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=8765 -XX:MaxPermSize=256m -Xmx1024m -Xms256m -classpath :/usr/share/tomcat7/bin/bootstrap.jar:/usr/share/tomcat7/bin/tomcat-juli.jar:/usr/share/java/commons-daemon.jar -Dcatalina.base=/usr/share/tomcat7 -Dcatalina.home=/usr/share/tomcat7 -Djava.awt.headless=true -Djava.endorsed.dirs= -Djava.io.tmpdir=/var/cache/tomcat7/temp -Djava.util.logging.config.file=/usr/share/tomcat7/conf/logging.properties -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager org.apache.catalina.startup.Bootstrap start 

2) And since we also get "true" when doing this from our web application:

 System.getProperty("org.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH") 

Does anyone know why Tomcat still rejects encoded slashes?

For example, this URL should return JSON saying "Application not found: A / 1":

 http://our-site/campaigns/application/A%2F1/udid/U1 

But instead he says:

The requested URL / v1 / campaign / application / A / 1 / udid / U1 was not found on this server.

This is strange because we tried to use the ALLOW_ENCODED_SLASH property in the local Tomcat and it works fine.

Recently, we have tried another property. This works in both my local Tomcat and AWS:

 org.apache.catalina.connector.CoyoteAdapter.ALLOW_BACKSLASH 

I am completely puzzled ...: - /

Answer 3

Note that if you have apache httpd before tomcat, then you need to configure it to cut

for tomcat property -Dorg.apache.tomcat.util.buf.UDecoder.ALLOW_ENCODED_SLASH = true (best placed in CATALINA_OPTS in the conf file of the tomcat file)

for apache, the AllowEncodedSlashes directive must be set to NoDecode; in addition, the ProxyPass directive must be set to nocanon, otherwise tomcat will get a coded slash as% 252F instead of% 2F

So, the correct Apache configuration looks like this:

 <VirtualHost *:80> ProxyPass / http://localhost:8080/ nocanon ProxyPassReverse / http://localhost:8080/ nocanon ProxyPreserveHost on AllowEncodedSlashes NoDecode </VirtualHost>