<span class="gmail_quote">On 6/19/07, <b class="gmail_sendername">Michael Koch</b> <<a href="mailto:konqueror@gmx.de">konqueror@gmx.de</a>> wrote:</span><br><div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<br>The problem seems to be related to the ForwardURICompatUnparsed-Option<br>being default since mod_jk 1.2.23. This was made default because of the<br>security advisory CVS-2007-1860. When you are sure this security issue
<br>can't be exposed on your system please change the default options to us<br>ForwardURICompat instead of ForwardURICompatUnparsed. This re-enables<br>the old behavior:<br><br>JkOptions +ForwardURICompat<br><br>Please report back if this fixes your issues.
</blockquote><div><br><br>Thanks for pointing me in the right direction. I saw bug 425836, but <br>didn't follow the link to the tomcat to see that it might effect <br>mod_rewrite functionality.<br><br>Yep, both<br><br>
JkOptions +ForwardURICompat<br>and<br>JkOptions +ForwardURIEscaped<br><br>work with mod_rewrite.<br><br>I decided to use ForwardURIEscaped because of the warning against <br>using ForwardURICompat with prefix JkMounts. Since we're not using
<br>URL encoded session IDs, it seemed like a better way to go.<br><br><a href="http://tomcat.apache.org/connectors-doc/reference/apache.html#Forwarding">http://tomcat.apache.org/connectors-doc/reference/apache.html#Forwarding
</a><br><br>I was unable to reproduce the vulnerability with a specially crafted <br>URL with version 1.2.21-1, but maybe my URL wasn't special <br>enough... I tried to follow the example from the Red Hat's bugzilla.
<br><br>Thanks again for your help!<br>
<br>
Andy Hamilton<br>
<br></div></div><br>