Resolving 400 Bad Request Errors Due to Multiple Slashes in Tomcat 10

Опубликовано: 14 Июнь 2025
на канале: vlogize

Discover how to fix `400 Bad Request` errors in Tomcat 10 caused by multiple consecutive slashes in requests. Learn about configuring `HttpFirewall` to ensure requests are properly handled.
---
This video is based on the question https://stackoverflow.com/q/77939140/ asked by the user 'Gokul P' ( https://stackoverflow.com/u/19577199/ ) and on the answer https://stackoverflow.com/a/78111940/ provided by the user 'Gokul P' ( https://stackoverflow.com/u/19577199/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, comments, revision history etc. For example, the original title of the Question was: Multiple consecutive slashes in the request causes 400 bad request error in Tomcat 10

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Understanding the 400 Bad Request Error in Tomcat 10

When upgrading legacy projects to newer versions of frameworks and servers, you may encounter unexpected challenges. One common issue is the 400 Bad Request error, which blocks requests containing multiple consecutive slashes. This error can be particularly frustrating if prior versions of your server handled those requests without any issues. In this guide, we’ll explore the root causes of this error and how to effectively resolve it within your Spring and Tomcat configuration.

The Problem: Multiple Consecutive Slashes in Requests

In this specific case, a developer faced a 400 Bad Request error in Tomcat 10 when making certain requests that included multiple consecutive slashes. For example:

Problematic Request:

[[See Video to Reveal this Text or Code Snippet]]

Working Request:

[[See Video to Reveal this Text or Code Snippet]]

Key Observations:

The only difference between the two requests is the presence of multiple slashes in the first request.

Upon debugging, it was found that these malformed requests weren’t reaching the Spring layer; instead, Tomcat was interpreting them as invalid requests.

Exploring the Cause

The 400 Bad Request error often indicates a client-side issue where the server cannot process the request due to a malformed syntax. In this case, Tomcat's configuration was too strict, disallowing paths with multiple slashes. Historically, requests with such formats had been accepted under previous configurations, thus posing challenges during the upgrade from Tomcat 8 to Tomcat 10.

Insights into Tomcat's Behavior:

Tomcat employs an HttpFirewall to manage restrictions on incoming requests. Depending on the configuration, it may block requests that do not comply with specific rules, such as those with multiple slashes.

The Solution: Adjusting the HttpFirewall Configuration

After identifying the cause of the issue, the solution was relatively straightforward: switch from a StrictHttpFirewall to a DefaultHttpFirewall. The transition to a more permissive firewall resolved the error.

Implementation Steps:

Update your Spring Security Configuration

Replace the strict firewall bean with the following:

[[See Video to Reveal this Text or Code Snippet]]

Test Your Requests

Once updated, re-test the requests containing multiple slashes. They should now be processed correctly without yielding a 400 Bad Request response.

Conclusion

In summary, upgrading technology stacks often uncovers hidden issues, especially around strict configurations that were more relaxed in previous versions. By revisiting the HttpFirewall settings in Spring Security, you can effectively manage how Tomcat handles various incoming requests, including those with multiple consecutive slashes. This simple change can save you time and frustration, allowing your upgraded application to function smoothly.

Hopefully, this guide serves as a valuable resource for developers facing similar challenges with Tomcat 10. By understanding the underlying mechanisms and making the required configuration adjustments, you can enhance the robustness of your web applications.