Issue Details (XML | Word | Printable)

Key: GLASSFISH-18341
Type: Bug Bug
Status: Closed Closed
Resolution: Invalid
Priority: Major Major
Assignee: Ryan Lubke
Reporter: loonesp
Votes: 0
Watchers: 2
Operations

If you were logged in you would be able to see more operations.
glassfish

Extra-content in HTML using AJP with GF 3.1.2 and https on IE

Created: 08/Feb/12 03:52 PM   Updated: 09/Aug/12 11:34 AM   Resolved: 09/Feb/12 05:15 PM
Component/s: web_container
Affects Version/s: 3.1.2_b20
Fix Version/s: None

Time Tracking:
Not Specified

File Attachments: 1. File index.jsp (8 kB) 08/Feb/12 03:52 PM - loonesp

Environment:

Windows 7 64bits
IE 9
Apache 2.2


Tags: ajp 3_1_2-exclude
Participants: Amy Roh, corti, loonesp, oleksiys and Ryan Lubke


 Description  « Hide

I have a GF 3.1.2 domain behind an Apache 2.2 with AJP enabled.
When I try to access a JSP file larger than 8192 bytes from IE using HTTPS, the page starts with "2000\r\n".
This page is correct:

  • if I try to connect with IE using HTTP or with Firefox (HTTP or HTTPS).
  • if the page is 8192 bytes or less.
  • if I use GF 3.1.1 with AJP.

Steps to reproduce:

  1. asadmin create-domain domain_ajp
  2. asadmin start-domain domain_ajp
  3. asadmin create-http-listener --listenerport 8009 --listeneraddress 0.0.0.0 --defaultvs server jk-connector
  4. asadmin set configs.config.server-config.network-config.network-listeners.network-listener.jk-connector.jk-enabled=true
  5. copy the attached file to domain_ajp/docroot
  6. access the page with IE on https://localhost/index.jsp
    Result: the HTML source code starts with 2000\r\n

AJP is set in Apache with:

<IfModule proxy_module>
<IfModule proxy_ajp_module>
  <Location />
    ProxyPass ajp://127.0.0.1:8009/
    ProxyPassReverse ajp://127.0.0.1:8009/
  </Location>
</IfModule>
</IfModule>


Amy Roh added a comment - 08/Feb/12 09:32 PM - edited

Did this work with 3.1.1? 3.1.1 didn't officially support mod_proxy_ajp.
You might want to try mod_jk since the max packet size for mod_proxy_ajp is 8k [1] and it might be related.

[1] http://httpd.apache.org/docs/2.2/mod/mod_proxy_ajp.html#basppacketstruct


Amy Roh added a comment - 08/Feb/12 10:07 PM

GF 3.1.2 switched to use Grizzly ajp implementation. Assigning to Ryan for evaluation.


Ryan Lubke added a comment - 08/Feb/12 10:54 PM

In addition to Amy's suggestion of trying mod_jk, can you capture the headers sent between IE and apache and attach them to the issue?


Ryan Lubke added a comment - 09/Feb/12 12:30 AM

Alexey and I were discussing this issue while I was getting my environment setup. The 2000 in the response sounded like an issue with chunking.

We both were able to reproduce this and found that the apache was setting the response protocol to HTTP/1.0 along with the transfer-encoding header set to chunked. Chunking isn't supported in HTTP 1.0.

As you stated, the issue only occurred when using SSL. We checked the ssl config file and found this:

BrowserMatch ".MSIE." \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

This configuration forces a downgrade of the response when the user-agent is MSIE.

Based on this article [1], this configuration should be changed to:

BrowserMatch ".*MSIE [2-5]\..*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0

This only forces the downgrade for older versions of IE. The comments above the BrowserMatch
explain why this is needed.

Once we updated the match expression, IE worked as expected.

[1] http://blogs.msdn.com/b/ieinternals/archive/2011/03/26/https-and-connection-close-is-your-apache-modssl-server-configuration-set-to-slow.aspx


loonesp added a comment - 09/Feb/12 08:31 AM

It works fine when I modify the Apache configuration as suggested.
Thanks for the quick resolution.
It's strange that it worked correctly with GF 3.1.1

Does 3.1.2 officially support mod_proxy_ajp or should I use mod_jk instead ?


oleksiys added a comment - 09/Feb/12 09:44 AM

> It works fine when I modify the Apache configuration as suggested.
> Thanks for the quick resolution.
> It's strange that it worked correctly with GF 3.1.1
In GF 3.1.1 we used different AJP implementation, which didn't use HTTP/1.1 features.

> Does 3.1.2 officially support mod_proxy_ajp or should I use mod_jk instead ?
3.1.2 should support both.


Ryan Lubke added a comment - 09/Feb/12 05:15 PM

At this point, I think we can close this issue out.


corti added a comment - 09/Aug/12 11:23 AM

I am using 3.1.2.2 and even by changing the Apache configuration as suggested the problem persists.


oleksiys added a comment - 09/Aug/12 11:28 AM

can you pls. share the steps how we can reproduce it?


corti added a comment - 09/Aug/12 11:34 AM

Sorry I just noticed that in addition of the BrowserMatch directive there was an additional

  1. SetEnvIf User-Agent ".MSIE." \
  2. nokeepalive ssl-unclean-shutdown \
  3. downgrade-1.0 force-response-1.0

which I had to comment out. It now works as expected.