SA-1663

Summary

Users are trying to eliminate cross-site scripting vulnerability by using the URL encryption configuration option. However, when doing so, they see the HTTP 400 errors when  they try to open the portal after logging in.

Error Messages

HTTP Status 400 - Invalid URL used in request
________________________________________
type Status report
message Invalid URL used in request
description The request sent by the client was syntactically incorrect (Invalid URL used in request).
________________________________________
Apache Tomcat/7.0.27

Steps to Reproduce

 

1. Add to prconfig <env name="initialization/urlencryption" value="true"/>
2. Stop and start the JVM.
3. Try to connect to prweb.

Root Cause

The use of an unsupported version of Web Application
PRPC 5.5 SP1 does not support the use of Tomcat 7.x.

Resolution

Choose a variant of Tomcat 6, for example, Tomcat 6.0.35, in order to use the URLEncryption parameter.  PRPC 5.5 SP1 does not support the use of Tomcat 7 with the the URLEncryption parameter.