Tomcat 8.5.51 - Issues with secretRequired="false"

Question

The secretRequired="false" option added to AJP connector is server.xml. However, the connector does not start with Protocol handler start failed error. It is behind an Apache Server version 2.4.25.

    <Connector port="8009"
               address="127.0.0.1" tomcatAuthentication="false" URIEncoding="UTF-8" enableLookups="false"
               protocol="AJP/1.3" redirectPort="8663" connectionTimeout="600000" secretRequired="false" />

The error:

Caused by: java.lang.IllegalArgumentException: The AJP Connector is configured with secretRequired="true" but the secret attribute is either null or "". This combination is not valid.

Thanks

Answer 1

Adding the address attribute and specifying the loopback address is what worked for me on Tomcat 8.5.54.

<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" address="0.0.0.0" secretRequired="false" />

Answer 2

Tomcat 9.0.34 has that secretReqiured set to true by default now to address CVS issue.

See these URLs for details of this issue:
https://access.redhat.com/solutions/4851251 https://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html https://github.com/spring-projects/spring-boot/issues/20377