Recommended Tomcat Setup - Revision history

Vmurrell at 09:59, 3 November 2025

2025-11-03T09:59:19Z

Lythhishmeh at 21:09, 13 June 2024

2024-06-13T21:09:55Z

Lythhishmeh at 21:07, 13 June 2024

2024-06-13T21:07:51Z

Vmurrell at 12:08, 16 January 2024

2024-01-16T12:08:41Z

Plazarou: /* context.xml file */

2024-01-15T14:20:40Z

‎context.xml file

Plazarou: /* server.xml file */

2024-01-15T14:17:29Z

‎server.xml file

Plazarou: /* server.xml file */

2024-01-15T14:13:43Z

‎server.xml file

Plazarou: /* Recommended Apache Tomcat Setup */

2024-01-14T22:54:18Z

‎Recommended Apache Tomcat Setup

Lythhishmeh: Created page with " == Recommended Apache Tomcat Setup == Fusion Registry 11 is designed to run on a variety of web servers and platforms, although we recommend and support Fusion Registry runn..."

2024-01-12T16:23:03Z

Created page with " == Recommended Apache Tomcat Setup == Fusion Registry 11 is designed to run on a variety of web servers and platforms, although we recommend and support Fusion Registry runn..."

New page

== Recommended Apache Tomcat Setup ==

Fusion Registry 11 is designed to run on a variety of web servers and platforms, although we recommend and support Fusion Registry running on Apache Tomcat.

There are a few things to consider when running Fusion Registry on Apache Tomcat.

=== Security ===

For enhanced security, we recommend the following:

==== server.xml file ====

To prevent Tomcat related stack traces from being displayed in certain circumstances, we recommend the following changes be made to the server.xml file. This file can be found in (Apache Tomcat Directory)/conf.

Open the file in a text editor, and just before the </Host> tag, insert

'''<Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false"/>
'''

and then save the file.

This prevents stack traces from being displayed to the user with HTTP error codes.

==== context.xml file ====

This is not a change you are required to make, but we present the following for informational purposes. To prevent potential vulnerabilities related to Cross-Site Request Forgery (CSRF), we have included a context.xml file, which is located in the META-INF directory in the Fusion Registry directory. This file overwrites Tomcat's cookie pre-processor settings and enforces a strict SameSite cookies policy. More information on SameSite cookie security policies can be found [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie here].

← Older revision		Revision as of 09:59, 3 November 2025
Line 1:		Line 1:
−	~~[[Category:How_To]]~~	+	[[Category:Fusion Registry Configuration]]
−	[[Category:Fusion Registry ~~Install~~]]
−
	= Recommended Apache Tomcat Setup =		= Recommended Apache Tomcat Setup =

@@ Line 10: / Line 10: @@
 == Security ==
-For enhanced security, we recommend the following:
+It's worth noting that this is not an exhaustive list of all needed security settings, nor is it a substitute for on-team infrastructure expertise, but for enhanced security, we recommend the following settings:
 === server.xml File ===

@@ Line 2: / Line 2: @@
 [[Category:Fusion Registry Install]]
-== Recommended Apache Tomcat Setup ==
+= Recommended Apache Tomcat Setup =
 Fusion Registry must be run within a Java Servlet Container. Regnology recommends using Apache Tomcat as the Java Servlet Container, as this has been used during the testing lifecycle of Fusion Registry. The Fusion Registry has only been tested in Apache Tomcat and therefore we cannot guarantee that the Fusion Registry will work with other Java Servlet Containers.
@@ Line 8: / Line 8: @@
 There are a few things to consider when running Fusion Registry on Apache Tomcat.
-=== Security ===
+== Security ==
 For enhanced security, we recommend the following:
-==== server.xml file ====
+=== server.xml File ===
 By default, Tomcat will display Stack Traces in certain circumstances.  We recommend the following change be made to the file: '''server.xml'''. This file is located in the Apache Tomcat Directory ''<Apache Root>/conf''
@@ Line 21: / Line 23: @@
 This will prevent stack traces from being displayed to the user with HTTP error codes.  Tomcat must be restarted for this change to take effect.
-==== context.xml file ====
+=== context.xml File ===
 Since release 11.13 of the Fusion Registry, the product now ships with a default ''context.xml'' file which is located in the META-INF directory in the Fusion Registry directory.  This file overrides Tomcat's cookie pre-processor settings and enforces a strict SameSite cookies policy. More information on SameSite cookie security policies can be found [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie here].  This prevents potential vulnerabilities related to Cross-Site Request Forgery (CSRF).
 No action is required on the deployer's side, but if you want to disable this setting, either change or delete the file.

← Older revision		Revision as of 12:08, 16 January 2024
Line 1:		Line 1:
		+	[[Category:How_To]]
		+	[[Category:Fusion Registry Install]]

	== Recommended Apache Tomcat Setup ==		== Recommended Apache Tomcat Setup ==

← Older revision		Revision as of 14:20, 15 January 2024
Line 21:		Line 21:
	==== context.xml file ====		==== context.xml file ====

−	~~This is not a change you are required to make~~, ~~but we present~~ the ~~following for informational purposes. To prevent potential vulnerabilities related to Cross-Site Request Forgery (CSRF), we have included~~ a context.xml file, which is located in the META-INF directory in the Fusion Registry directory. This file ~~overwrites~~ Tomcat's cookie pre-processor settings and enforces a strict SameSite cookies policy. More information on SameSite cookie security policies can be found [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie here].	+	Since release 11.13 of the Fusion Registry, the product now ships with a default ''context.xml'' file which is located in the META-INF directory in the Fusion Registry directory. This file overrides Tomcat's cookie pre-processor settings and enforces a strict SameSite cookies policy. More information on SameSite cookie security policies can be found [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie here]. This prevents potential vulnerabilities related to Cross-Site Request Forgery (CSRF).
		+
		+	No action is required on the deployer's side, but if you want to disable this setting, either change or delete the file.

@@ Line 12: / Line 12: @@
 ==== server.xml file ====
-To prevent Tomcat related stack traces from being displayed in certain circumstances, we recommend the following changes be made to the server.xml file. This file can be found in (Apache Tomcat Directory)/conf.
+By default, Tomcat will display Stack Traces in certain circumstances.  We recommend the following change be made to the file: '''server.xml'''. This file is located in the Apache Tomcat Directory ''<Apache Root>/conf''
-Open the file in a text editor, and just before the </Host> tag, insert
+Edit the file and and locate the "Host" section.  At the end of this section, just before the closing </Host> tag, insert the following:
    <Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false"/>
+This will prevent stack traces from being displayed to the user with HTTP error codes.  Tomcat must be restarted for this change to take effect.
 ==== context.xml file ====
 This is not a change you are required to make, but we present the following for informational purposes. To prevent potential vulnerabilities related to Cross-Site Request Forgery (CSRF), we have included a context.xml file, which is located in the META-INF directory in the Fusion Registry directory. This file overwrites Tomcat's cookie pre-processor settings and enforces a strict SameSite cookies policy. More information on SameSite cookie security policies can be found [https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie here].

← Older revision		Revision as of 14:13, 15 January 2024
Line 15:		Line 15:

	Open the file in a text editor, and just before the </Host> tag, insert		Open the file in a text editor, and just before the </Host> tag, insert
		+	<Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false"/>

−	~~'''<Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false"/>~~
−	~~'''~~

	and then save the file.		and then save the file.