Gecko [ edgpens.lpkmn.gov.my ]

Name	Size	Permission
ajp.html	53.52 KB	-rw-rw-rw-
automatic-deployment.html	78.04 KB	-rw-rw-rw-
cluster-channel.html	12.05 KB	-rw-rw-rw-
cluster-deployer.html	10.31 KB	-rw-rw-rw-
cluster-interceptor.html	32.31 KB	-rw-rw-rw-
cluster-listener.html	8.6 KB	-rw-rw-rw-
cluster-manager.html	26.82 KB	-rw-rw-rw-
cluster-membership.html	14.12 KB	-rw-rw-rw-
cluster-receiver.html	16.68 KB	-rw-rw-rw-
cluster-sender.html	18 KB	-rw-rw-rw-
cluster-valve.html	16.63 KB	-rw-rw-rw-
cluster.html	16.29 KB	-rw-rw-rw-
context.html	96.03 KB	-rw-rw-rw-
engine.html	18.48 KB	-rw-rw-rw-
executor.html	11.98 KB	-rw-rw-rw-
filter.html	114.75 KB	-rw-rw-rw-
globalresources.html	18.98 KB	-rw-rw-rw-
host.html	41.36 KB	-rw-rw-rw-
http.html	95.74 KB	-rw-rw-rw-
index.html	8.73 KB	-rw-rw-rw-
jar-scanner.html	11.84 KB	-rw-rw-rw-
listeners.html	45.44 KB	-rw-rw-rw-
loader.html	15.9 KB	-rw-rw-rw-
manager.html	39.54 KB	-rw-rw-rw-
realm.html	75.08 KB	-rw-rw-rw-
resources.html	12.17 KB	-rw-rw-rw-
server.html	10.82 KB	-rw-rw-rw-
service.html	9.92 KB	-rw-rw-rw-
sessionidgenerator.html	10.85 KB	-rw-rw-rw-
systemprops.html	50.22 KB	-rw-rw-rw-
valve.html	129.69 KB	-rw-rw-rw-

Code Editor : valve.html

<html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 7 Configuration Reference (7.0.107) - The Valve Component</title><meta name="author" content="Craig R. McClanahan"><style type="text/css" media="print">
 .noPrint {display: none;}
 td#mainBody {width: 100%;}
</style><style type="text/css">
code {background-color:rgb(224,255,255);padding:0 0.1em;}
code.attributeName, code.propertyName {background-color:transparent;}

table {
 border-collapse: collapse;
 text-align: left;
}
table *:not(table) {
 /* Prevent border-collapsing for table child elements like <div> */
 border-collapse: separate;
}

th {
  text-align: left;
}

div.codeBox pre code, code.attributeName, code.propertyName, code.noHighlight, .noHighlight code {
 background-color: transparent;
}
div.codeBox {
 overflow: auto;
 margin: 1em 0;
}
div.codeBox pre {
 margin: 0;
 padding: 4px;
 border: 1px solid #999;
 border-radius: 5px;
 background-color: #eff8ff;
 display: table; /* To prevent <pre>s from taking the complete available width. */
 /*
 When it is officially supported, use the following CSS instead of display: table
 to prevent big <pre>s from exceeding the browser window:
 max-width: available;
 width: min-content;
 */
}

div.codeBox pre.wrap {
  white-space: pre-wrap;
}

table.defaultTable tr, table.detail-table tr {
    border: 1px solid #CCC;
}

table.defaultTable tr:nth-child(even), table.detail-table tr:nth-child(even) {
    background-color: #FAFBFF;
}

table.defaultTable tr:nth-child(odd), table.detail-table tr:nth-child(odd) {
    background-color: #EEEFFF;
}

table.defaultTable th, table.detail-table th {
  background-color: #88b;
  color: #fff;
}

table.defaultTable th, table.defaultTable td, table.detail-table th, table.detail-table td {
  padding: 5px 8px;
}

p.notice {
 border: 1px solid rgb(255, 0, 0);
 background-color: rgb(238, 238, 238);
 color: rgb(0, 51, 102);
 padding: 0.5em;
 margin: 1em 2em 1em 1em;
}
</style></head><body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76"><table border="0" width="100%" cellspacing="0"><tr><td><a href="https://tomcat.apache.org/"><img src="../images/tomcat.gif" align="right" alt="
 The Apache Tomcat Servlet/JSP Container
 " border="0"></a></td><td><h1>Apache Tomcat 7</h1>Version 7.0.107, Nov 18 2020</td><td><a href="http://www.apache.org/"><img src="../images/asf-logo.svg" align="right" alt="Apache Logo" border="0" style="width: 266px;height: 83px;"></a></td></tr></table><table border="0" width="100%" cellspacing="4"><tr><td colspan="2"><hr noshade size="1"></td></tr><tr><td width="20%" valign="top" nowrap class="noPrint">Links<ul><li><a href="../index.html">Docs Home</a></li><li><a href="index.html">Config Ref. Home</a></li><li><a href="https://wiki.apache.org/tomcat/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul>Top Level Elements<ul><li><a href="server.html">Server</a></li><li><a href="service.html">Service</a></li></ul>Executors<ul><li><a href="executor.html">Executor</a></li></ul>Connectors<ul><li><a href="http.html">HTTP</a></li><li><a href="ajp.html">AJP</a></li></ul>Containers<ul><li><a href="context.html">Context</a></li><li><a href="engine.html">Engine</a></li><li><a href="host.html">Host</a></li><li><a href="cluster.html">Cluster</a></li></ul>Nested Components<ul><li><a href="globalresources.html">Global Resources</a></li><li><a href="jar-scanner.html">JarScanner</a></li><li><a href="listeners.html">Listeners</a></li><li><a href="loader.html">Loader</a></li><li><a href="manager.html">Manager</a></li><li><a href="realm.html">Realm</a></li><li><a href="resources.html">Resources</a></li><li><a href="sessionidgenerator.html">SessionIdGenerator</a></li><li><a href="valve.html">Valve</a></li></ul>Cluster Elements<ul><li><a href="cluster.html">Cluster</a></li><li><a href="cluster-manager.html">Manager</a></li><li><a href="cluster-channel.html">Channel</a></li><li><a href="cluster-membership.html">Channel/Membership</a></li><li><a href="cluster-sender.html">Channel/Sender</a></li><li><a href="cluster-receiver.html">Channel/Receiver</a></li><li><a href="cluster-interceptor.html">Channel/Interceptor</a></li><li><a href="cluster-valve.html">Valve</a></li><li><a href="cluster-deployer.html">Deployer</a></li><li><a href="cluster-listener.html">ClusterListener</a></li></ul>web.xml<ul><li><a href="filter.html">Filter</a></li></ul>Other<ul><li><a href="systemprops.html">System properties</a></li></ul></td><td width="80%" valign="top" align="left" id="mainBody"><h1>The Valve Component</h1><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Table of Contents"></a><a name="Table_of_Contents">Table of Contents</a></td></tr><tr><td><blockquote>
<ul><li><a href="#Introduction">Introduction</a></li><li><a href="#Access_Logging">Access Logging</a><ol><li><a href="#Access_Log_Valve">Access Log Valve</a><ol><li><a href="#Access_Log_Valve/Introduction">Introduction</a></li><li><a href="#Access_Log_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Extended_Access_Log_Valve">Extended Access Log Valve</a><ol><li><a href="#Extended_Access_Log_Valve/Introduction">Introduction</a></li><li><a href="#Extended_Access_Log_Valve/Attributes">Attributes</a></li></ol></li></ol></li><li><a href="#Access_Control">Access Control</a><ol><li><a href="#Remote_Address_Valve">Remote Address Valve</a><ol><li><a href="#Remote_Address_Valve/Introduction">Introduction</a></li><li><a href="#Remote_Address_Valve/Attributes">Attributes</a></li><li><a href="#Remote_Address_Valve/Example_localhost">Example 1</a></li><li><a href="#Remote_Address_Valve/Example_localhost_port">Example 2</a></li><li><a href="#Remote_Address_Valve/Example_port_auth">Example 3</a></li></ol></li><li><a href="#Remote_Host_Valve">Remote Host Valve</a><ol><li><a href="#Remote_Host_Valve/Introduction">Introduction</a></li><li><a href="#Remote_Host_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Remote_CIDR_Valve">Remote CIDR Valve</a><ol><li><a href="#Remote_CIDR_Valve/Introduction">Introduction</a></li><li><a href="#Remote_CIDR_Valve/Attributes">Attributes</a></li><li><a href="#Example">Example</a></li></ol></li></ol></li><li><a href="#Proxies_Support">Proxies Support</a><ol><li><a href="#Remote_IP_Valve">Remote IP Valve</a><ol><li><a href="#Remote_IP_Valve/Introduction">Introduction</a></li><li><a href="#Remote_IP_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#SSL_Valve">SSL Valve</a><ol><li><a href="#SSL_Valve/Introduction">Introduction</a></li><li><a href="#SSL_Valve/Attributes">Attributes</a></li></ol></li></ol></li><li><a href="#Single_Sign_On_Valve">Single Sign On Valve</a><ol><li><a href="#Single_Sign_On_Valve/Introduction">Introduction</a></li><li><a href="#Single_Sign_On_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Authentication">Authentication</a><ol><li><a href="#Basic_Authenticator_Valve">Basic Authenticator Valve</a><ol><li><a href="#Basic_Authenticator_Valve/Introduction">Introduction</a></li><li><a href="#Basic_Authenticator_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Digest_Authenticator_Valve">Digest Authenticator Valve</a><ol><li><a href="#Digest_Authenticator_Valve/Introduction">Introduction</a></li><li><a href="#Digest_Authenticator_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Form_Authenticator_Valve">Form Authenticator Valve</a><ol><li><a href="#Form_Authenticator_Valve/Introduction">Introduction</a></li><li><a href="#Form_Authenticator_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#SSL_Authenticator_Valve">SSL Authenticator Valve</a><ol><li><a href="#SSL_Authenticator_Valve/Introduction">Introduction</a></li><li><a href="#SSL_Authenticator_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#SPNEGO_Valve">SPNEGO Valve</a><ol><li><a href="#SPNEGO_Valve/Introduction">Introduction</a></li><li><a href="#SPNEGO_Valve/Attributes">Attributes</a></li></ol></li></ol></li><li><a href="#Error_Report_Valve">Error Report Valve</a><ol><li><a href="#Error_Report_Valve/Introduction">Introduction</a></li><li><a href="#Error_Report_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Crawler_Session_Manager_Valve">Crawler Session Manager Valve</a><ol><li><a href="#Crawler_Session_Manager_Valve/Introduction">Introduction</a></li><li><a href="#Crawler_Session_Manager_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Stuck_Thread_Detection_Valve">Stuck Thread Detection Valve</a><ol><li><a href="#Stuck_Thread_Detection_Valve/Introduction">Introduction</a></li><li><a href="#Stuck_Thread_Detection_Valve/Attributes">Attributes</a></li></ol></li><li><a href="#Semaphore_Valve">Semaphore Valve</a><ol><li><a href="#Semaphore_Valve/Introduction">Introduction</a></li><li><a href="#Semaphore_Valve/Attributes">Attributes</a></li></ol></li></ul>
</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Introduction">Introduction</a></td></tr><tr><td><blockquote>

A Valve element represents a component that will be
 inserted into the request processing pipeline for the associated
 Catalina container (<a href="engine.html">Engine</a>,
 <a href="host.html">Host</a>, or <a href="context.html">Context</a>).
 Individual Valves have distinct processing capabilities, and are
 described individually below.

The description below uses the variable name $CATALINA_BASE to refer the
 base directory against which most relative paths are resolved. If you have
 not configured Tomcat for multiple instances by setting a CATALINA_BASE
 directory, then $CATALINA_BASE will be set to the value of $CATALINA_HOME,
 the directory into which you have installed Tomcat.

</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Access Logging"></a><a name="Access_Logging">Access Logging</a></td></tr><tr><td><blockquote>

Access logging is performed by valves that implement
org.apache.catalina.AccessLog interface.

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Access Log Valve"></a><a name="Access_Log_Valve">Access Log Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Access Log Valve/Introduction"></a><a name="Access_Log_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Access Log Valve creates log files in the
 same format as those created by standard web servers. These logs
 can later be analyzed by standard log analysis tools to track page
 hit counts, user session activity, and so on. This <code>Valve</code>
 uses self-contained logic to write its log files, which can be
 automatically rolled over at midnight each day. (The essential
 requirement for access logging is to handle a large continuous
 stream of data with low overhead. This <code>Valve</code> does not
 use Apache Commons Logging, thus avoiding additional overhead and
 potentially complex configuration).

This <code>Valve</code> may be associated with any Catalina container
 (<code>Context</code>, <code>Host</code>, or <code>Engine</code>), and
 will record ALL requests processed by that container.

Some requests may be handled by Tomcat before they are passed to a
 container. These include redirects from /foo to /foo/ and the rejection of
 invalid requests. Where Tomcat can identify the <code>Context</code> that
 would have handled the request, the request/response will be logged in the
 <code>AccessLog</code>(s) associated <code>Context</code>, <code>Host</code>
 and <code>Engine</code>. Where Tomcat cannot identify the
 <code>Context</code> that would have handled the request, e.g. in cases
 where the URL is invalid, Tomcat will look first in the <code>Engine</code>,
 then the default <code>Host</code> for the <code>Engine</code> and finally
 the ROOT (or default) <code>Context</code> for the default <code>Host</code>
 for an <code>AccessLog</code> implementation. Tomcat will use the first
 <code>AccessLog</code> implementation found to log those requests that are
 rejected before they are passed to a container.

The output file will be placed in the directory given by the
 <code>directory</code> attribute. The name of the file is composed
 by concatenation of the configured <code>prefix</code>, timestamp and
 <code>suffix</code>. The format of the timestamp in the file name can be
 set using the <code>fileDateFormat</code> attribute. This timestamp will
 be omitted if the file rotation is switched off by setting
 <code>rotatable</code> to <code>false</code>.

Warning: If multiple AccessLogValve instances
 are used, they should be configured to use different output files.

If sendfile is used, the response bytes will be written asynchronously
 in a separate thread and the access log valve will not know how many bytes
 were actually written. In this case, the number of bytes that was passed to
 the sendfile thread for writing will be recorded in the access log valve.
 
 </blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Access Log Valve/Attributes"></a><a name="Access_Log_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Access Log Valve supports the following
 configuration attributes:

<table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264">Attribute</th><th width="85%" bgcolor="#023264">Description</th></tr><tr><td align="left" valign="center"><code class="attributeName">buffered</code></td><td align="left" valign="center">
 Flag to determine if logging will be buffered.
 If set to <code>false</code>, then access logging will be written after each
 request. Default value: <code>true</code>
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">className</code></td><td align="left" valign="center">
 Java class name of the implementation to use. This MUST be set to
 org.apache.catalina.valves.AccessLogValve to use the
 default access log valve.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">condition</code></td><td align="left" valign="center">
 The same as <code>conditionUnless</code>. This attribute is
 provided for backwards compatibility.
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">conditionIf</code></td><td align="left" valign="center">
 Turns on conditional logging. If set, requests will be
 logged only if <code>ServletRequest.getAttribute()</code> is
 not null. For example, if this value is set to
 <code>important</code>, then a particular request will only be logged
 if <code>ServletRequest.getAttribute("important") != null</code>.
 The use of Filters is an easy way to set/unset the attribute
 in the ServletRequest on many different requests.
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">conditionUnless</code></td><td align="left" valign="center">
 Turns on conditional logging. If set, requests will be
 logged only if <code>ServletRequest.getAttribute()</code> is
 null. For example, if this value is set to
 <code>junk</code>, then a particular request will only be logged
 if <code>ServletRequest.getAttribute("junk") == null</code>.
 The use of Filters is an easy way to set/unset the attribute
 in the ServletRequest on many different requests.
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">directory</code></td><td align="left" valign="center">
 Absolute or relative pathname of a directory in which log files
 created by this valve will be placed. If a relative path is
 specified, it is interpreted as relative to $CATALINA_BASE. If
 no directory attribute is specified, the default value is "logs"
 (relative to $CATALINA_BASE).
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">encoding</code></td><td align="left" valign="center">
 Character set used to write the log file. An empty string means
 to use the system default character set. Default value: use the
 system default character set.
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">fileDateFormat</code></td><td align="left" valign="center">
 Allows a customized timestamp in the access log file name.
 The file is rotated whenever the formatted timestamp changes.
 The default value is <code>yyyy-MM-dd</code>.
 If you wish to rotate every hour, then set this value
 to <code>yyyy-MM-dd.HH</code>.
 The date format will always be localized
 using the locale <code>en_US</code>.
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">locale</code></td><td align="left" valign="center">
 The locale used to format timestamps in the access log
 lines. Any timestamps configured using an
 explicit SimpleDateFormat pattern (<code>%{xxx}t</code>)
 are formatted in this locale. By default the
 default locale of the Java process is used. Switching the
 locale after the AccessLogValve is initialized is not supported.
 Any timestamps using the common log format
 (<code>CLF</code>) are always formatted in the locale
 <code>en_US</code>.
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxDays</code></td><td align="left" valign="center">
 The maximum number of days rotated access logs will be retained for
 before being deleted. If not specified, the default value of
 <code>-1</code> will be used which means never delete old files.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">pattern</code></td><td align="left" valign="center">
 A formatting layout identifying the various information fields
 from the request and response to be logged, or the word
 <code>common</code> or <code>combined</code> to select a
 standard format. See below for more information on configuring
 this attribute.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">prefix</code></td><td align="left" valign="center">
 The prefix added to the start of each log file's name. If not
 specified, the default value is "access_log".
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">renameOnRotate</code></td><td align="left" valign="center">
 By default for a rotatable log the active access log file name
 will contain the current timestamp in <code>fileDateFormat</code>.
 During rotation the file is closed and a new file with the next
 timestamp in the name is created and used. When setting
 <code>renameOnRotate</code> to <code>true</code>, the timestamp
 is no longer part of the active log file name. Only during rotation
 the file is closed and then renamed to include the timestamp.
 This is similar to the behavior of most log frameworks when
 doing time based rotation.
 Default value: <code>false</code>
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">requestAttributesEnabled</code></td><td align="left" valign="center">
 Set to <code>true</code> to check for the existence of request
 attributes (typically set by the RemoteIpValve and similar) that should
 be used to override the values returned by the request for remote
 address, remote host, server port and protocol. If the attributes are
 not set, or this attribute is set to <code>false</code> then the values
 from the request will be used. If not set, the default value of
 <code>false</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">resolveHosts</code></td><td align="left" valign="center">
 This attribute is no longer supported. Use the connector
 attribute <code>enableLookups</code> instead.
 If you have <code>enableLookups</code> on the connector set to
 <code>true</code> and want to ignore it, use %a instead of
 %h in the value of <code>pattern</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">rotatable</code></td><td align="left" valign="center">
 Flag to determine if log rotation should occur.
 If set to <code>false</code>, then this file is never rotated and
 <code>fileDateFormat</code> is ignored.
 Default value: <code>true</code>
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">suffix</code></td><td align="left" valign="center">
 The suffix added to the end of each log file's name. If not
 specified, the default value is "" (a zero-length string),
 meaning that no suffix will be added.
 </td></tr></table>

Values for the <code>pattern</code> attribute are made up of literal
 text strings, combined with pattern identifiers prefixed by the "%"
 character to cause replacement by the corresponding variable value from
 the current request and response. The following pattern codes are
 supported:
 <ul>
 <li>%a - Remote IP address</li>
 <li>%A - Local IP address</li>
 <li>%b - Bytes sent, excluding HTTP headers, or '-' if zero</li>
 <li>%B - Bytes sent, excluding HTTP headers</li>
 <li>%h - Remote host name (or IP address if
 <code>enableLookups</code> for the connector is false)</li>
 <li>%H - Request protocol</li>
 <li>%l - Remote logical username from identd (always returns
 '-')</li>
 <li>%m - Request method (GET, POST, etc.)</li>
 <li>%p - Local port on which this request was received.
 See also <code>%{xxx}p</code> below.</li>
 <li>%q - Query string (prepended with a '?' if it exists)</li>
 <li>%r - First line of the request (method and request URI)</li>
 <li>%s - HTTP status code of the response</li>
 <li>%S - User session ID</li>
 <li>%t - Date and time, in Common Log Format</li>
 <li>%u - Remote user that was authenticated (if any), else '-'</li>
 <li>%U - Requested URL path</li>
 <li>%v - Local server name</li>
 <li>%D - Time taken to process the request in millis. Note: In
 httpd %D is microseconds. Behaviour will be aligned to httpd
 in Tomcat 10 onwards.</li>
 <li>%T - Time taken to process the request, in seconds. Note: This
 value has millisecond resolution whereas in httpd it has
 second resolution. Behaviour will be align to httpd
 in Tomcat 10 onwards.</li>
 <li>%F - Time taken to commit the response, in millis</li>
 <li>%I - Current request thread name (can compare later with stacktraces)</li>
 </ul>

There is also support to write information incoming or outgoing
 headers, cookies, session or request attributes and special
 timestamp formats.
 It is modeled after the
 <a href="https://httpd.apache.org/">Apache HTTP Server</a> log configuration
 syntax. Each of them can be used multiple times with different <code>xxx</code> keys:
 
 <ul>
 <li><code>%{xxx}i</code> write value of incoming header with name <code>xxx</code></li>
 <li><code>%{xxx}o</code> write value of outgoing header with name <code>xxx</code></li>
 <li><code>%{xxx}c</code> write value of cookie with name <code>xxx</code></li>
 <li><code>%{xxx}r</code> write value of ServletRequest attribute with name <code>xxx</code></li>
 <li><code>%{xxx}s</code> write value of HttpSession attribute with name <code>xxx</code></li>
 <li><code>%{xxx}p</code> write local (server) port (<code>xxx==local</code>) or
 remote (client) port (<code>xxx=remote</code>)</li>
 <li><code>%{xxx}t</code> write timestamp at the end of the request formatted using the
 enhanced SimpleDateFormat pattern <code>xxx</code></li>
 </ul>

All formats supported by SimpleDateFormat are allowed in <code>%{xxx}t</code>.
 In addition the following extensions have been added:
 <ul>
 <li><code>sec</code> - number of seconds since the epoch</li>
 <li><code>msec</code> - number of milliseconds since the epoch</li>
 <li><code>msec_frac</code> - millisecond fraction</li>
 </ul>
 These formats cannot be mixed with SimpleDateFormat formats in the same format
 token.

Furthermore one can define whether to log the timestamp for the request start
 time or the response finish time:
 <ul>
 <li><code>begin</code> or prefix <code>begin:</code> chooses
 the request start time</li>
 <li><code>end</code> or prefix <code>end:</code> chooses
 the response finish time</li>
 </ul>
 By adding multiple <code>%{xxx}t</code> tokens to the pattern, one can
 also log both timestamps.

The shorthand pattern <code>pattern="common"</code>
 corresponds to the Common Log Format defined by
 '%h %l %u %t "%r" %s %b'.

The shorthand pattern <code>pattern="combined"</code>
 appends the values of the <code>Referer</code> and <code>User-Agent</code>
 headers, each in double quotes, to the <code>common</code> pattern.

When Tomcat is operating behind a reverse proxy, the client information
 logged by the Access Log Valve may represent the reverse proxy, the browser
 or some combination of the two depending on the configuration of Tomcat and
 the reverse proxy. For Tomcat configuration options see
 <a href="#Proxies_Support">Proxies Support</a> and the
 <a href="../proxy-howto.html">Proxy How-To</a>. For reverse proxies that
 use mod_jk, see the <a href="https://tomcat.apache.org/connectors-doc/generic_howto/proxy.html">generic
 proxy</a> documentation. For other reverse proxies, consult their
 documentation.
 </blockquote></td></tr></table>

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Extended Access Log Valve"></a><a name="Extended_Access_Log_Valve">Extended Access Log Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Extended Access Log Valve/Introduction"></a><a name="Extended_Access_Log_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Extended Access Log Valve extends the
 <a href="#Access_Log_Valve">Access Log Valve</a> class, and so
 uses the same self-contained logging logic. This means it
 implements many of the same file handling attributes. The main
 difference to the standard <code>AccessLogValve</code> is that
 <code>ExtendedAccessLogValve</code> creates log files which
 conform to the Working Draft for the
 <a href="https://www.w3.org/TR/WD-logfile.html">Extended Log File Format</a>
 defined by the W3C.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Extended Access Log Valve/Attributes"></a><a name="Extended_Access_Log_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Extended Access Log Valve supports all
 configuration attributes of the standard
 <a href="#Access_Log_Valve">Access Log Valve.</a> Only the
 values used for <code>className</code> and <code>pattern</code> differ.

Values for the <code>pattern</code> attribute are made up of
 format tokens. Some of the tokens need an additional prefix. Possible
 prefixes are <code>c</code> for "client", <code>s</code> for "server",
 <code>cs</code> for "client to server", <code>sc</code> for
 "server to client" or <code>x</code> for "application specific".
 Furthermore some tokens are completed by an additional selector.
 See the <a href="https://www.w3.org/TR/WD-logfile.html">W3C specification</a>
 for more information about the format.

The following format tokens are supported:
 <ul>
 <li>bytes - Bytes sent, excluding HTTP headers, or '-' if zero</li>
 <li>c-dns - Remote host name (or IP address if
 <code>enableLookups</code> for the connector is false)</li>
 <li>c-ip - Remote IP address</li>
 <li>cs-method - Request method (GET, POST, etc.)</li>
 <li>cs-uri - Request URI</li>
 <li>cs-uri-query - Query string (prepended with a '?' if it exists)</li>
 <li>cs-uri-stem - Requested URL path</li>
 <li>date - The date in yyyy-mm-dd format for GMT</li>
 <li>s-dns - Local host name</li>
 <li>s-ip - Local IP address</li>
 <li>sc-status - HTTP status code of the response</li>
 <li>time - Time the request was served in HH:mm:ss format for GMT</li>
 <li>time-taken - Time (in seconds as floating point) taken to serve the request</li>
 <li>x-threadname - Current request thread name (can compare later with stacktraces)</li>
 </ul>

For any of the <code>x-H(XXX)</code> the following method will be called from the
 HttpServletRequest object:
 <ul>
 <li><code>x-H(authType)</code>: getAuthType </li>
 <li><code>x-H(characterEncoding)</code>: getCharacterEncoding </li>
 <li><code>x-H(contentLength)</code>: getContentLength </li>
 <li><code>x-H(locale)</code>: getLocale</li>
 <li><code>x-H(protocol)</code>: getProtocol </li>
 <li><code>x-H(remoteUser)</code>: getRemoteUser</li>
 <li><code>x-H(requestedSessionId)</code>: getRequestedSessionId</li>
 <li><code>x-H(requestedSessionIdFromCookie)</code>:
 isRequestedSessionIdFromCookie </li>
 <li><code>x-H(requestedSessionIdValid)</code>:
 isRequestedSessionIdValid</li>
 <li><code>x-H(scheme)</code>: getScheme</li>
 <li><code>x-H(secure)</code>: isSecure</li>
 </ul>

There is also support to write information about headers
 cookies, context, request or session attributes and request
 parameters.
 
 <ul>
 <li><code>cs(XXX)</code> for incoming request headers with name XXX</li>
 <li><code>sc(XXX)</code> for outgoing response headers with name XXX</li>
 <li><code>x-A(XXX)</code> for the servlet context attribute with name XXX</li>
 <li><code>x-C(XXX)</code> for the first cookie with name XXX</li>
 <li><code>x-O(XXX)</code> for a concatenation of all outgoing response headers with name XXX</li>
 <li><code>x-P(XXX)</code> for the URL encoded (using UTF-8) request parameter with name XXX</li>
 <li><code>x-R(XXX)</code> for the request attribute with name XXX</li>
 <li><code>x-S(XXX)</code> for the session attribute with name XXX</li>
 </ul>

</blockquote></td></tr></table>

</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Access Control"></a><a name="Access_Control">Access Control</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote Address Valve"></a><a name="Remote_Address_Valve">Remote Address Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote Address Valve/Introduction"></a><a name="Remote_Address_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Remote Address Valve allows you to compare the
 IP address of the client that submitted this request against one or more
 regular expressions, and either allow the request to continue
 or refuse to process the request from this client. A Remote Address
 Valve can be associated with any Catalina container
 (<a href="engine.html">Engine</a>, <a href="host.html">Host</a>, or
 <a href="context.html">Context</a>), and must accept any request
 presented to this container for processing before it will be passed on.

The syntax for regular expressions is different than that for
 'standard' wildcard matching. Tomcat uses the <code>java.util.regex</code>
 package. Please consult the Java documentation for details of the
 expressions supported.

Optionally one can append the server connector port separated with a
 semicolon (";") to allow different expressions for each connector.

The behavior when a request is refused can be changed
 to not deny but instead set an invalid <code>authentication</code>
 header. This is useful in combination with the context attribute
 <code>preemptiveAuthentication="true"</code>.

Note: There is a caveat when using this valve with
 IPv6 addresses. Format of the IP address that this valve is processing
 depends on the API that was used to obtain it. If the address was obtained
 from Java socket using Inet6Address class, its format will be
 <code>x:x:x:x:x:x:x:x</code>. That is, the IP address for localhost
 will be <code>0:0:0:0:0:0:0:1</code> instead of the more widely used
 <code>::1</code>. Consult your access logs for the actual value.

See also: <a href="#Remote_Host_Valve">Remote Host Valve</a>,
 <a href="#Remote_IP_Valve">Remote IP Valve</a>.
 </blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote Address Valve/Attributes"></a><a name="Remote_Address_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Remote Address Valve supports the following
 configuration attributes:

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote_Address_Valve/Example_localhost_port">Example 2</a></td></tr><tr><td><blockquote>
 To allow unrestricted access for the clients connecting from localhost
 but for all other clients only to port 8443:
 <div class="codeBox"><pre><code>&lt;Valve className="org.apache.catalina.valves.RemoteAddrValve"
 addConnectorPort="true"
 allow="127\.\d+\.\d+\.\d+;\d*|::1;\d*|0:0:0:0:0:0:0:1;\d*|.*;8443"/&gt;</code></pre></div>
 </blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote_Address_Valve/Example_port_auth">Example 3</a></td></tr><tr><td><blockquote>
 To allow unrestricted access to port 8009, but trigger basic
 authentication if the application is accessed on another port:
<div class="codeBox"><pre><code>&lt;Context&gt;
 ...
 &lt;Valve className="org.apache.catalina.valves.RemoteAddrValve"
 addConnectorPort="true"
 invalidAuthenticationWhenDeny="true"
 allow=".*;8009"/&gt;
 &lt;Valve className="org.apache.catalina.authenticator.BasicAuthenticator" /&gt;
 ...
&lt;/Context&gt;</code></pre></div>
 </blockquote></td></tr></table>

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote Host Valve"></a><a name="Remote_Host_Valve">Remote Host Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote Host Valve/Introduction"></a><a name="Remote_Host_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Remote Host Valve allows you to compare the
 hostname of the client that submitted this request against one or more
 regular expressions, and either allow the request to continue
 or refuse to process the request from this client. A Remote Host
 Valve can be associated with any Catalina container
 (<a href="engine.html">Engine</a>, <a href="host.html">Host</a>, or
 <a href="context.html">Context</a>), and must accept any request
 presented to this container for processing before it will be passed on.

Optionally one can append the server connector port separated with a
 semicolon (";") to allow different expressions for each connector.

Note: This valve processes the value returned by
 method <code>ServletRequest.getRemoteHost()</code>. To allow the method
 to return proper host names, you have to enable "DNS lookups" feature on
 a Connector.

See also: <a href="#Remote_Address_Valve">Remote Address Valve</a>,
 <a href="http.html">HTTP Connector</a> configuration.
 </blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote Host Valve/Attributes"></a><a name="Remote_Host_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Remote Host Valve supports the following
 configuration attributes:

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote CIDR Valve"></a><a name="Remote_CIDR_Valve">Remote CIDR Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote CIDR Valve/Introduction"></a><a name="Remote_CIDR_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Remote CIDR Valve allows you to compare the
 IP address of the client that submitted this request against one or more
 netmasks following the CIDR notation, and either allow the request to
 continue or refuse to process the request from this client. IPv4 and
 IPv6 are both fully supported. A Remote CIDR Valve can be associated
 with any Catalina container (<a href="engine.html">Engine</a>,
 <a href="host.html">Host</a>, or <a href="context.html">Context</a>), and
 must accept any request presented to this container for processing before
 it will be passed on.

This valve mimicks Apache's <code>Order</code>,
 <code>Allow from</code> and <code>Deny from</code> directives,
 with the following limitations:

<ul>
 <li><code>Order</code> will always be <code>allow, deny</code>;</li>
 <li>dotted quad notations for netmasks are not supported (that is, you
 cannot write <code>192.168.1.0/255.255.255.0</code>, you must write
 <code>192.168.1.0/24</code>;
 </li>
 <li>shortcuts, like <code>10.10.</code>, which is equivalent to
 <code>10.10.0.0/16</code>, are not supported;
 </li>
 <li>as the valve name says, this is a CIDR only valve,
 therefore subdomain notations like <code>.mydomain.com</code> are not
 supported either.
 </li>
 </ul>

Some more features of this valve are:

<ul>
 <li>if you omit the CIDR prefix, this valve becomes a single IP
 valve;</li>
 <li>unlike the <a href="#Remote_Host_Valve">Remote Host Valve</a>,
 it can handle IPv6 addresses in condensed form (<code>::1</code>,
 <code>fe80::/71</code>, etc).</li>
 </ul>

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote CIDR Valve/Attributes"></a><a name="Remote_CIDR_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Remote CIDR Valve supports the following
 configuration attributes:

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Example">Example</a></td></tr><tr><td><blockquote>
 To allow access only for the clients connecting from localhost:
 <pre>
 &lt;Valve className="org.apache.catalina.valves.RemoteCIDRValve"
 allow="127.0.0.1, ::1"/&gt;
 </pre>
 </blockquote></td></tr></table>

</blockquote></td></tr></table>

</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Proxies Support"></a><a name="Proxies_Support">Proxies Support</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote IP Valve"></a><a name="Remote_IP_Valve">Remote IP Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote IP Valve/Introduction"></a><a name="Remote_IP_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

Tomcat port of
 <a href="https://httpd.apache.org/docs/trunk/mod/mod_remoteip.html">mod_remoteip</a>,
 this valve replaces the apparent client remote IP address and hostname for
 the request with the IP address list presented by a proxy or a load balancer
 via a request headers (e.g. "X-Forwarded-For").

Another feature of this valve is to replace the apparent scheme
 (http/https), server port and <code>request.secure</code> with the scheme presented
 by a proxy or a load balancer via a request header
 (e.g. "X-Forwarded-Proto").

This Valve may be used at the <code>Engine</code>, <code>Host</code> or
 <code>Context</code> level as required. Normally, this Valve would be used
 at the <code>Engine</code> level.

If used in conjunction with Remote Address/Host valves then this valve
 should be defined first to ensure that the correct client IP address is
 presented to the Remote Address/Host valves.

Note: By default this valve has no effect on the
 values that are written into access log. The original values are restored
 when request processing leaves the valve and that always happens earlier
 than access logging. To pass the remote address, remote host, server port
 and protocol values set by this valve to the access log,
 they are put into request attributes. Publishing these values here
 is enabled by default, but <code>AccessLogValve</code> should be explicitly
 configured to use them. See documentation for
 <code>requestAttributesEnabled</code> attribute of
 <code>AccessLogValve</code>.

The names of request attributes that are set by this valve
 and can be used by access logging are the following:

<ul>
 <li><code>org.apache.catalina.AccessLog.RemoteAddr</code></li>
 <li><code>org.apache.catalina.AccessLog.RemoteHost</code></li>
 <li><code>org.apache.catalina.AccessLog.Protocol</code></li>
 <li><code>org.apache.catalina.AccessLog.ServerPort</code></li>
 <li><code>org.apache.tomcat.remoteAddr</code></li>
 </ul>

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Remote IP Valve/Attributes"></a><a name="Remote_IP_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Remote IP Valve supports the
 following configuration attributes:

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="SSL Valve"></a><a name="SSL_Valve">SSL Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="SSL Valve/Introduction"></a><a name="SSL_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

When using mod_proxy_http, the client SSL information is not included in
 the protocol (unlike mod_jk and mod_proxy_ajp). To make the client SSL
 information available to Tomcat, some additional configuration is required.
 In httpd, mod_headers is used to add the SSL information as HTTP headers. In
 Tomcat, this valve is used to read the information from the HTTP headers and
 insert it into the request.

Note: Ensure that the headers are always set by httpd for all requests to
 prevent a client spoofing SSL information by sending fake headers.

To configure httpd to set the necessary headers, add the following:
<div class="codeBox"><pre><code>&lt;IfModule ssl_module&gt;
 RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
 RequestHeader set SSL_CIPHER "%{SSL_CIPHER}s"
 RequestHeader set SSL_SESSION_ID "%{SSL_SESSION_ID}s"
 RequestHeader set SSL_CIPHER_USEKEYSIZE "%{SSL_CIPHER_USEKEYSIZE}s"
&lt;/IfModule&gt;</code></pre></div>

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="SSL Valve/Attributes"></a><a name="SSL_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The SSL Valve supports the following configuration
 attribute:

</blockquote></td></tr></table>

</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Single Sign On Valve"></a><a name="Single_Sign_On_Valve">Single Sign On Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Single Sign On Valve/Introduction"></a><a name="Single_Sign_On_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Single Sign On Valve is utilized when you wish to give users
 the ability to sign on to any one of the web applications associated with
 your virtual host, and then have their identity recognized by all other
 web applications on the same virtual host.

See the <a href="host.html#Single_Sign_On">Single Sign On</a> special
 feature on the Host element for more information.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Single Sign On Valve/Attributes"></a><a name="Single_Sign_On_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Single Sign On Valve supports the following
 configuration attributes:

</blockquote></td></tr></table>

</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Authentication">Authentication</a></td></tr><tr><td><blockquote>

The valves in this section implement
org.apache.catalina.Authenticator interface.

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Basic Authenticator Valve"></a><a name="Basic_Authenticator_Valve">Basic Authenticator Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Basic Authenticator Valve/Introduction"></a><a name="Basic_Authenticator_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Basic Authenticator Valve is automatically added to
 any <a href="context.html">Context</a> that is configured to use BASIC
 authentication.

If any non-default settings are required, the valve may be configured
 within <a href="context.html">Context</a> element with the required
 values.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Basic Authenticator Valve/Attributes"></a><a name="Basic_Authenticator_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Basic Authenticator Valve supports the following
 configuration attributes:

<table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264">Attribute</th><th width="85%" bgcolor="#023264">Description</th></tr><tr><td align="left" valign="center"><code class="attributeName">allowCorsPreflight</code></td><td align="left" valign="center">
 Are requests that appear to be CORS preflight requests allowed to
 bypass the authenticator as required by the CORS specification. The
 allowed values are <code>never</code>, <code>filter</code> and
 <code>always</code>. <code>never</code> means that a request will never
 bypass authentication even if it appears to be a CORS preflight request.
 <code>filter</code> means that a request will bypass authentication if
 it appears to be a CORS preflight request; it is mapped to a web
 application that has the <a href="filter.html#CORS_Filter">CORS
 Filter</a> enabled; and the CORS Filter is mapped to <code>/*</code>.
 <code>always</code> means that all requests that appear to be CORS
 preflight requests will bypass authentication. If not set, the default
 value is <code>never</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">alwaysUseSession</code></td><td align="left" valign="center">
 Should a session always be used once a user is authenticated? This
 may offer some performance benefits since the session can then be used
 to cache the authenticated Principal, hence removing the need to
 authenticate the user via the Realm on every request. This may be of
 help for combinations such as BASIC authentication used with the
 JNDIRealm or DataSourceRealms. However there will also be the
 performance cost of creating and GC'ing the session. If not set, the
 default value of <code>false</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">cache</code></td><td align="left" valign="center">
 Should we cache authenticated Principals if the request is part of an
 HTTP session? If not specified, the default value of <code>true</code>
 will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">changeSessionIdOnAuthentication</code></td><td align="left" valign="center">
 Controls if the session ID is changed if a session exists at the
 point where users are authenticated. This is to prevent session fixation
 attacks. If not set, the default value of <code>true</code> will be
 used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">charset</code></td><td align="left" valign="center">
 Controls if the <code>WWW-Authenticate</code> HTTP header includes a
 <code>charset</code> authentication parameter as per RFC 7617. The only
 permitted options are <code>null</code>, the empty string and
 <code>UTF-8</code>. If <code>UTF-8</code> is specified then the
 <code>charset</code> authentication parameter will be sent with that
 value and the provided user name and optional password will be converted
 from bytes to characters using UTF-8. Otherwise, no <code>charset</code>
 authentication parameter will be sent and the provided user name and
 optional password will be converted from bytes to characters using
 ISO-8859-1. The default value is <code>null</code>
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">className</code></td><td align="left" valign="center">
 Java class name of the implementation to use. This MUST be set to
 org.apache.catalina.authenticator.BasicAuthenticator.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableProxyCaching</code></td><td align="left" valign="center">
 Controls the caching of pages that are protected by security
 constraints. Setting this to <code>false</code> may help work around
 caching issues in some browsers but will also cause secured pages to be
 cached by proxies which will almost certainly be a security issue.
 <code>securePagesWithPragma</code> offers an alternative, secure,
 workaround for browser caching issues. If not set, the default value of
 <code>true</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">securePagesWithPragma</code></td><td align="left" valign="center">
 Controls the caching of pages that are protected by security
 constraints. Setting this to <code>false</code> may help work around
 caching issues in some browsers by using
 <code>Cache-Control: private</code> rather than the default of
 <code>Pragma: No-cache</code> and <code>Cache-control: No-cache</code>.
 If not set, the default value of <code>false</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomAlgorithm</code></td><td align="left" valign="center">
 Name of the algorithm to use to create the
 <code>java.security.SecureRandom</code> instances that generate session
 IDs. If an invalid algorithm and/or provider is specified, the platform
 default provider and the default algorithm will be used. If not
 specified, the default algorithm of SHA1PRNG will be used. If the
 default algorithm is not supported, the platform default will be used.
 To specify that the platform default should be used, do not set the
 secureRandomProvider attribute and set this attribute to the empty
 string.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomClass</code></td><td align="left" valign="center">
 Name of the Java class that extends
 <code>java.security.SecureRandom</code> to use to generate SSO session
 IDs. If not specified, the default value is
 <code>java.security.SecureRandom</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomProvider</code></td><td align="left" valign="center">
 Name of the provider to use to create the
 <code>java.security.SecureRandom</code> instances that generate SSO
 session IDs. If an invalid algorithm and/or provider is specified, the
 platform default provider and the default algorithm will be used. If not
 specified, the platform default provider will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">sendAuthInfoResponseHeaders</code></td><td align="left" valign="center">
 Controls whether the auth information (remote user and auth type)
 shall be returned as response headers for a forwarded/proxied request.
 When the <code>RemoteIpValve</code> or <code>RemoteIpFilter</code> mark
 a forwarded request with the <code>Globals.REQUEST_FORWARDED_ATTRIBUTE</code>
 this authenticator can return the values of
 <code>HttpServletRequest.getRemoteUser()</code> and
 <code>HttpServletRequest.getAuthType()</code> as response headers
 <code>remote-user</code> and <code>auth-type</code> to a reverse proxy.
 This is useful, e.g., for access log consistency or other decisions to make.
 If not specified, the default value is <code>false</code>.
 </td></tr></table>

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Digest Authenticator Valve"></a><a name="Digest_Authenticator_Valve">Digest Authenticator Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Digest Authenticator Valve/Introduction"></a><a name="Digest_Authenticator_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Digest Authenticator Valve is automatically added to
 any <a href="context.html">Context</a> that is configured to use DIGEST
 authentication.

If any non-default settings are required, the valve may be configured
 within <a href="context.html">Context</a> element with the required
 values.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Digest Authenticator Valve/Attributes"></a><a name="Digest_Authenticator_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Digest Authenticator Valve supports the following
 configuration attributes:

<table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264">Attribute</th><th width="85%" bgcolor="#023264">Description</th></tr><tr><td align="left" valign="center"><code class="attributeName">allowCorsPreflight</code></td><td align="left" valign="center">
 Are requests that appear to be CORS preflight requests allowed to
 bypass the authenticator as required by the CORS specification. The
 allowed values are <code>never</code>, <code>filter</code> and
 <code>always</code>. <code>never</code> means that a request will never
 bypass authentication even if it appears to be a CORS preflight request.
 <code>filter</code> means that a request will bypass authentication if
 it appears to be a CORS preflight request; it is mapped to a web
 application that has the <a href="filter.html#CORS_Filter">CORS
 Filter</a> enabled; and the CORS Filter is mapped to <code>/*</code>.
 <code>always</code> means that all requests that appear to be CORS
 preflight requests will bypass authentication. If not set, the default
 value is <code>never</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">alwaysUseSession</code></td><td align="left" valign="center">
 Should a session always be used once a user is authenticated? This
 may offer some performance benefits since the session can then be used
 to cache the authenticated Principal, hence removing the need to
 authenticate the user via the Realm on every request. This may be of
 help for combinations such as BASIC authentication used with the
 JNDIRealm or DataSourceRealms. However there will also be the
 performance cost of creating and GC'ing the session. If not set, the
 default value of <code>false</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">cache</code></td><td align="left" valign="center">
 Should we cache authenticated Principals if the request is part of an
 HTTP session? If not specified, the default value of <code>false</code>
 will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">changeSessionIdOnAuthentication</code></td><td align="left" valign="center">
 Controls if the session ID is changed if a session exists at the
 point where users are authenticated. This is to prevent session fixation
 attacks. If not set, the default value of <code>true</code> will be
 used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">className</code></td><td align="left" valign="center">
 Java class name of the implementation to use. This MUST be set to
 org.apache.catalina.authenticator.DigestAuthenticator.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableProxyCaching</code></td><td align="left" valign="center">
 Controls the caching of pages that are protected by security
 constraints. Setting this to <code>false</code> may help work around
 caching issues in some browsers but will also cause secured pages to be
 cached by proxies which will almost certainly be a security issue.
 <code>securePagesWithPragma</code> offers an alternative, secure,
 workaround for browser caching issues. If not set, the default value of
 <code>true</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">key</code></td><td align="left" valign="center">
 The secret key used by digest authentication. If not set, a secure
 random value is generated. This should normally only be set when it is
 necessary to keep key values constant either across server restarts
 and/or across a cluster.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">nonceCacheSize</code></td><td align="left" valign="center">
 To protect against replay attacks, the DIGEST authenticator tracks
 server nonce and nonce count values. This attribute controls the size
 of that cache. If not specified, the default value of 1000 is used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">nonceCountWindowSize</code></td><td align="left" valign="center">
 Client requests may be processed out of order which in turn means
 that the nonce count values may be processed out of order. To prevent
 authentication failures when nonce counts are presented out of order
 the authenticator tracks a window of nonce count values. This attribute
 controls how big that window is. If not specified, the default value of
 100 is used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">nonceValidity</code></td><td align="left" valign="center">
 The time, in milliseconds, that a server generated nonce will be
 considered valid for use in authentication. If not specified, the
 default value of 300000 (5 minutes) will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">opaque</code></td><td align="left" valign="center">
 The opaque server string used by digest authentication. If not set, a
 random value is generated. This should normally only be set when it is
 necessary to keep opaque values constant either across server restarts
 and/or across a cluster.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">securePagesWithPragma</code></td><td align="left" valign="center">
 Controls the caching of pages that are protected by security
 constraints. Setting this to <code>false</code> may help work around
 caching issues in some browsers by using
 <code>Cache-Control: private</code> rather than the default of
 <code>Pragma: No-cache</code> and <code>Cache-control: No-cache</code>.
 If not set, the default value of <code>false</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomAlgorithm</code></td><td align="left" valign="center">
 Name of the algorithm to use to create the
 <code>java.security.SecureRandom</code> instances that generate session
 IDs. If an invalid algorithm and/or provider is specified, the platform
 default provider and the default algorithm will be used. If not
 specified, the default algorithm of SHA1PRNG will be used. If the
 default algorithm is not supported, the platform default will be used.
 To specify that the platform default should be used, do not set the
 secureRandomProvider attribute and set this attribute to the empty
 string.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomClass</code></td><td align="left" valign="center">
 Name of the Java class that extends
 <code>java.security.SecureRandom</code> to use to generate SSO session
 IDs. If not specified, the default value is
 <code>java.security.SecureRandom</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomProvider</code></td><td align="left" valign="center">
 Name of the provider to use to create the
 <code>java.security.SecureRandom</code> instances that generate SSO
 session IDs. If an invalid algorithm and/or provider is specified, the
 platform default provider and the default algorithm will be used. If not
 specified, the platform default provider will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">sendAuthInfoResponseHeaders</code></td><td align="left" valign="center">
 Controls whether the auth information (remote user and auth type)
 shall be returned as response headers for a forwarded/proxied request.
 When the <code>RemoteIpValve</code> or <code>RemoteIpFilter</code> mark
 a forwarded request with the <code>Globals.REQUEST_FORWARDED_ATTRIBUTE</code>
 this authenticator can return the values of
 <code>HttpServletRequest.getRemoteUser()</code> and
 <code>HttpServletRequest.getAuthType()</code> as response headers
 <code>remote-user</code> and <code>auth-type</code> to a reverse proxy.
 This is useful, e.g., for access log consistency or other decisions to make.
 If not specified, the default value is <code>false</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">validateUri</code></td><td align="left" valign="center">
 Should the URI be validated as required by RFC2617? If not specified,
 the default value of <code>true</code> will be used. This should
 normally only be set when Tomcat is located behind a reverse proxy and
 the proxy is modifying the URI passed to Tomcat such that DIGEST
 authentication always fails.
 </td></tr></table>

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Form Authenticator Valve"></a><a name="Form_Authenticator_Valve">Form Authenticator Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Form Authenticator Valve/Introduction"></a><a name="Form_Authenticator_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Form Authenticator Valve is automatically added to
 any <a href="context.html">Context</a> that is configured to use FORM
 authentication.

If any non-default settings are required, the valve may be configured
 within <a href="context.html">Context</a> element with the required
 values.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Form Authenticator Valve/Attributes"></a><a name="Form_Authenticator_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Form Authenticator Valve supports the following
 configuration attributes:

<table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264">Attribute</th><th width="85%" bgcolor="#023264">Description</th></tr><tr><td align="left" valign="center"><code class="attributeName">allowCorsPreflight</code></td><td align="left" valign="center">
 Are requests that appear to be CORS preflight requests allowed to
 bypass the authenticator as required by the CORS specification. The
 allowed values are <code>never</code>, <code>filter</code> and
 <code>always</code>. <code>never</code> means that a request will never
 bypass authentication even if it appears to be a CORS preflight request.
 <code>filter</code> means that a request will bypass authentication if
 it appears to be a CORS preflight request; it is mapped to a web
 application that has the <a href="filter.html#CORS_Filter">CORS
 Filter</a> enabled; and the CORS Filter is mapped to <code>/*</code>.
 <code>always</code> means that all requests that appear to be CORS
 preflight requests will bypass authentication. If not set, the default
 value is <code>never</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">changeSessionIdOnAuthentication</code></td><td align="left" valign="center">
 Controls if the session ID is changed if a session exists at the
 point where users are authenticated. This is to prevent session fixation
 attacks. If not set, the default value of <code>true</code> will be
 used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">characterEncoding</code></td><td align="left" valign="center">
 Character encoding to use to read the username and password parameters
 from the request. If not set, the encoding of the request body will be
 used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">className</code></td><td align="left" valign="center">
 Java class name of the implementation to use. This MUST be set to
 org.apache.catalina.authenticator.FormAuthenticator.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableProxyCaching</code></td><td align="left" valign="center">
 Controls the caching of pages that are protected by security
 constraints. Setting this to <code>false</code> may help work around
 caching issues in some browsers but will also cause secured pages to be
 cached by proxies which will almost certainly be a security issue.
 <code>securePagesWithPragma</code> offers an alternative, secure,
 workaround for browser caching issues. If not set, the default value of
 <code>true</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">landingPage</code></td><td align="left" valign="center">
 Controls the behavior of the FORM authentication process if the
 process is misused, for example by directly requesting the login page
 or delaying logging in for so long that the session expires. If this
 attribute is set, rather than returning an error response code, Tomcat
 will redirect the user to the specified landing page if the login form
 is submitted with valid credentials. For the login to be processed, the
 landing page must be a protected resource (i.e. one that requires
 authentication). If the landing page does not require authentication
 then the user will not be logged in and will be prompted for their
 credentials again when they access a protected page.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">securePagesWithPragma</code></td><td align="left" valign="center">
 Controls the caching of pages that are protected by security
 constraints. Setting this to <code>false</code> may help work around
 caching issues in some browsers by using
 <code>Cache-Control: private</code> rather than the default of
 <code>Pragma: No-cache</code> and <code>Cache-control: No-cache</code>.
 If not set, the default value of <code>false</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomAlgorithm</code></td><td align="left" valign="center">
 Name of the algorithm to use to create the
 <code>java.security.SecureRandom</code> instances that generate session
 IDs. If an invalid algorithm and/or provider is specified, the platform
 default provider and the default algorithm will be used. If not
 specified, the default algorithm of SHA1PRNG will be used. If the
 default algorithm is not supported, the platform default will be used.
 To specify that the platform default should be used, do not set the
 secureRandomProvider attribute and set this attribute to the empty
 string.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomClass</code></td><td align="left" valign="center">
 Name of the Java class that extends
 <code>java.security.SecureRandom</code> to use to generate SSO session
 IDs. If not specified, the default value is
 <code>java.security.SecureRandom</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomProvider</code></td><td align="left" valign="center">
 Name of the provider to use to create the
 <code>java.security.SecureRandom</code> instances that generate SSO
 session IDs. If an invalid algorithm and/or provider is specified, the
 platform default provider and the default algorithm will be used. If not
 specified, the platform default provider will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">sendAuthInfoResponseHeaders</code></td><td align="left" valign="center">
 Controls whether the auth information (remote user and auth type)
 shall be returned as response headers for a forwarded/proxied request.
 When the <code>RemoteIpValve</code> or <code>RemoteIpFilter</code> mark
 a forwarded request with the <code>Globals.REQUEST_FORWARDED_ATTRIBUTE</code>
 this authenticator can return the values of
 <code>HttpServletRequest.getRemoteUser()</code> and
 <code>HttpServletRequest.getAuthType()</code> as response headers
 <code>remote-user</code> and <code>auth-type</code> to a reverse proxy.
 This is useful, e.g., for access log consistency or other decisions to make.
 If not specified, the default value is <code>false</code>.
 </td></tr></table>

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="SSL Authenticator Valve"></a><a name="SSL_Authenticator_Valve">SSL Authenticator Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="SSL Authenticator Valve/Introduction"></a><a name="SSL_Authenticator_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The SSL Authenticator Valve is automatically added to
 any <a href="context.html">Context</a> that is configured to use SSL
 authentication.

If any non-default settings are required, the valve may be configured
 within <a href="context.html">Context</a> element with the required
 values.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="SSL Authenticator Valve/Attributes"></a><a name="SSL_Authenticator_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The SSL Authenticator Valve supports the following
 configuration attributes:

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="SPNEGO Valve"></a><a name="SPNEGO_Valve">SPNEGO Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="SPNEGO Valve/Introduction"></a><a name="SPNEGO_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The SPNEGO Authenticator Valve is automatically added to
 any <a href="context.html">Context</a> that is configured to use SPNEGO
 authentication.

If any non-default settings are required, the valve may be configured
 within <a href="context.html">Context</a> element with the required
 values.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="SPNEGO Valve/Attributes"></a><a name="SPNEGO_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The SPNEGO Authenticator Valve supports the following
 configuration attributes:

<table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264">Attribute</th><th width="85%" bgcolor="#023264">Description</th></tr><tr><td align="left" valign="center"><code class="attributeName">allowCorsPreflight</code></td><td align="left" valign="center">
 Are requests that appear to be CORS preflight requests allowed to
 bypass the authenticator as required by the CORS specification. The
 allowed values are <code>never</code>, <code>filter</code> and
 <code>always</code>. <code>never</code> means that a request will never
 bypass authentication even if it appears to be a CORS preflight request.
 <code>filter</code> means that a request will bypass authentication if
 it appears to be a CORS preflight request and the web application the
 request maps to has the <a href="filter.html#CORS_Filter">CORS
 Filter</a> enabled and mapped to <code>/*</code>. <code>always</code>
 means that all requests that appear to be CORS preflight requests will
 bypass authentication. If not set, the default value is
 <code>never</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">alwaysUseSession</code></td><td align="left" valign="center">
 Should a session always be used once a user is authenticated? This
 may offer some performance benefits since the session can then be used
 to cache the authenticated Principal, hence removing the need to
 authenticate the user on every request. This will also help with clients
 that assume that the server will cache the authenticated user. However
 there will also be the performance cost of creating and GC'ing the
 session. For an alternative solution see
 <code>noKeepAliveUserAgents</code>. If not set, the default value of
 <code>false</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">applyJava8u40Fix</code></td><td align="left" valign="center">
 A fix introduced in Java 8 update 40 (
 <a href="https://bugs.openjdk.java.net/browse/JDK-8048194">JDK-8048194</a>)
 onwards broke SPNEGO authentication for IE with Tomcat running on
 Windows 2008 R2 servers. This option enables a work-around that allows
 SPNEGO authentication to continue working. The work-around should not
 impact other configurations so it is enabled by default. If necessary,
 the workaround can be disabled by setting this attribute to
 <code>false</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">cache</code></td><td align="left" valign="center">
 Should we cache authenticated Principals if the request is part of an
 HTTP session? If not specified, the default value of <code>true</code>
 will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">className</code></td><td align="left" valign="center">
 Java class name of the implementation to use. This MUST be set to
 org.apache.catalina.authenticator.SpnegoAuthenticator.
 
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">changeSessionIdOnAuthentication</code></td><td align="left" valign="center">
 Controls if the session ID is changed if a session exists at the
 point where users are authenticated. This is to prevent session fixation
 attacks. If not set, the default value of <code>true</code> will be
 used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableProxyCaching</code></td><td align="left" valign="center">
 Controls the caching of pages that are protected by security
 constraints. Setting this to <code>false</code> may help work around
 caching issues in some browsers but will also cause secured pages to be
 cached by proxies which will almost certainly be a security issue.
 <code>securePagesWithPragma</code> offers an alternative, secure,
 workaround for browser caching issues. If not set, the default value of
 <code>true</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">loginConfigName</code></td><td align="left" valign="center">
 The name of the JAAS login configuration to be used to login as the
 service. If not specified, the default of
 <code>com.sun.security.jgss.krb5.accept</code> is used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">noKeepAliveUserAgents</code></td><td align="left" valign="center">
 Some clients (not most browsers) expect the server to cache the
 authenticated user information for a connection and do not resend the
 credentials with every request. Tomcat will not do this unless an HTTP
 session is available. A session will be available if either the
 application creates one or if <code>alwaysUseSession</code> is enabled
 for this Authenticator.
 As an alternative to creating a session, this attribute may be used
 to define the user agents for which HTTP keep-alive is disabled. This
 means that a connection will only used for a single request and hence
 there is no ability to cache authenticated user information per
 connection. There will be a performance cost in disabling HTTP
 keep-alive.
 The attribute should be a regular expression that matches the entire
 user-agent string, e.g. <code>.*Chrome.*</code>. If not specified, no
 regular expression will be defined and no user agents will have HTTP
 keep-alive disabled.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">securePagesWithPragma</code></td><td align="left" valign="center">
 Controls the caching of pages that are protected by security
 constraints. Setting this to <code>false</code> may help work around
 caching issues in some browsers by using
 <code>Cache-Control: private</code> rather than the default of
 <code>Pragma: No-cache</code> and <code>Cache-control: No-cache</code>.
 If not set, the default value of <code>false</code> will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomAlgorithm</code></td><td align="left" valign="center">
 Name of the algorithm to use to create the
 <code>java.security.SecureRandom</code> instances that generate session
 IDs. If an invalid algorithm and/or provider is specified, the platform
 default provider and the default algorithm will be used. If not
 specified, the default algorithm of SHA1PRNG will be used. If the
 default algorithm is not supported, the platform default will be used.
 To specify that the platform default should be used, do not set the
 secureRandomProvider attribute and set this attribute to the empty
 string.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomClass</code></td><td align="left" valign="center">
 Name of the Java class that extends
 <code>java.security.SecureRandom</code> to use to generate SSO session
 IDs. If not specified, the default value is
 <code>java.security.SecureRandom</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">secureRandomProvider</code></td><td align="left" valign="center">
 Name of the provider to use to create the
 <code>java.security.SecureRandom</code> instances that generate SSO
 session IDs. If an invalid algorithm and/or provider is specified, the
 platform default provider and the default algorithm will be used. If not
 specified, the platform default provider will be used.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">sendAuthInfoResponseHeaders</code></td><td align="left" valign="center">
 Controls whether the auth information (remote user and auth type)
 shall be returned as response headers for a forwarded/proxied request.
 When the <code>RemoteIpValve</code> or <code>RemoteIpFilter</code> mark
 a forwarded request with the <code>Globals.REQUEST_FORWARDED_ATTRIBUTE</code>
 this authenticator can return the values of
 <code>HttpServletRequest.getRemoteUser()</code> and
 <code>HttpServletRequest.getAuthType()</code> as response headers
 <code>remote-user</code> and <code>auth-type</code> to a reverse proxy.
 This is useful, e.g., for access log consistency or other decisions to make.
 If not specified, the default value is <code>false</code>.
 </td></tr><tr><td align="left" valign="center"><code class="attributeName">storeDelegatedCredential</code></td><td align="left" valign="center">
 Controls if the user' delegated credential will be stored in
 the user Principal. If available, the delegated credential will be
 available to applications (e.g. for onward authentication to external
 services) via the <code>org.apache.catalina.realm.GSS_CREDENTIAL</code>
 request attribute. If not set, the default value of <code>true</code>
 will be used.
 </td></tr></table>

</blockquote></td></tr></table>

</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Error Report Valve"></a><a name="Error_Report_Valve">Error Report Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Error Report Valve/Introduction"></a><a name="Error_Report_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Error Report Valve is a simple error handler
 for HTTP status codes that will generate and return HTML error pages.

NOTE: Disabling both showServerInfo and showReport will
 only return the HTTP status code.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Error Report Valve/Attributes"></a><a name="Error_Report_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Error Report Valve supports the following
 configuration attributes:

</blockquote></td></tr></table>

</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Crawler Session Manager Valve"></a><a name="Crawler_Session_Manager_Valve">Crawler Session Manager Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Crawler Session Manager Valve/Introduction"></a><a name="Crawler_Session_Manager_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

Web crawlers can trigger the creation of many thousands of sessions as
 they crawl a site which may result in significant memory consumption. This
 Valve ensures that crawlers are associated with a single session - just like
 normal users - regardless of whether or not they provide a session token
 with their requests.

This Valve may be used at the <code>Engine</code>, <code>Host</code> or
 <code>Context</code> level as required. Normally, this Valve would be used
 at the <code>Engine</code> level.

If used in conjunction with Remote IP valve then the Remote IP valve
 should be defined before this valve to ensure that the correct client IP
 address is presented to this valve.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Crawler Session Manager Valve/Attributes"></a><a name="Crawler_Session_Manager_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Crawler Session Manager Valve supports the
 following configuration attributes:

</blockquote></td></tr></table>

</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Stuck Thread Detection Valve"></a><a name="Stuck_Thread_Detection_Valve">Stuck Thread Detection Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Stuck Thread Detection Valve/Introduction"></a><a name="Stuck_Thread_Detection_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

This valve allows to detect requests that take a long time to process,
 which might indicate that the thread that is processing it is stuck.
 Additionally it can optionally interrupt such threads to try and unblock
 them.
 When such a request is detected, the current stack trace of its thread is
 written to Tomcat log with a WARN level.
 The IDs and names of the stuck threads are available through JMX in the
 <code>stuckThreadIds</code> and <code>stuckThreadNames</code> attributes.
 The IDs can be used with the standard Threading JVM MBean
 (<code>java.lang:type=Threading</code>) to retrieve other information
 about each stuck thread.

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Stuck Thread Detection Valve/Attributes"></a><a name="Stuck_Thread_Detection_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Stuck Thread Detection Valve supports the
 following configuration attributes:

</blockquote></td></tr></table>

</blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><a name="Semaphore Valve"></a><a name="Semaphore_Valve">Semaphore Valve</a></td></tr><tr><td><blockquote>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Semaphore Valve/Introduction"></a><a name="Semaphore_Valve/Introduction">Introduction</a></td></tr><tr><td><blockquote>

The Semaphore Valve is able to limit the number of
 concurrent request processing threads.
 org.apache.catalina.valves.SemaphoreValve provides
 methods which may be overridden by a subclass to customize behavior:
 <ul>
 <li><code>controlConcurrency</code> may be overridden to add
 conditions;</li>
 <li><code>permitDenied</code> may be overridden to add error handling
 when a permit isn't granted.</li>
 </ul>

</blockquote></td></tr></table>

<table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><a name="Semaphore Valve/Attributes"></a><a name="Semaphore_Valve/Attributes">Attributes</a></td></tr><tr><td><blockquote>

The Semaphore Valve supports the following
 configuration attributes:

</blockquote></td></tr></table>

</blockquote></td></tr></table></td></tr><tr><td colspan="2"><hr noshade size="1"></td></tr><tr><td colspan="2"><div align="center">
 Copyright &copy; 1999-2020, Apache Software Foundation
 </div></td></tr></table></body></html>

${this.title}

Code Editor : valve.html