Moved from JDBCRealm to DataSourceRealm - now continually getting 408 responses

[John Paul Hoey]

Hi,

I recently upgraded a working web application which utilises JDBCRealm to Tomcat 10 however it stopped working. Further investigations found that JDBCRealm is now deprecated with Tomcat 10 therefore I have implemented DataSourceRealm.

The connection to the database using DataSourceRealm appears to be fine.

Now, however, when I attempt to log into the application using form authentication I am getting a server 408 response. Strangely, when I enter invalid credentials the invalid credentials page is being displayed.

I have performed a quick Google for a solution however the answers that I find don't seem to fix the issue.

I'm not sure why changing from JDBCRealm to DataSourceRealm would cause this issue however I'm hoping developers with more knowledge and experience than myself may be able to help me.

For info, here are the resource and realm tags from my context.xml file:

<Resource name="jdbc/login_details"                auth="Container"                type="javax.sql.DataSource"                maxTotal="100" maxIdle="30" maxWaitMillis="10000"                username="root" password="sesame"                driverClassName="com.mysql.cj.jdbc.Driver"                url="jdbc:mysql://localhost:3306/login_details"/>                  <Realm className="org.apache.catalina.realm.DataSourceRealm"                      dataSourceName="jdbc/login_details" localDataSource="true" userTable="userpass"                      userRoleTable="userrole" userNameCol="Username" userCredCol="Password"                      roleNameCol="role">                </Realm>

And here is my web.xml file:

<login-config>        <auth-method>FORM</auth-method>        <form-login-config>            <form-login-page>/Web-pages/Home/login.html</form-login-page>            <form-error-page>/Web-pages/Home/login_error.html</form-error-page>        </form-login-config>    </login-config>

I have left the server.xml file as default.

If you would like me to submit any more code then please let me know. Thanks

[John Paul Hoey]

Its now working - but in Chrome and not Edge.

It seems to be browser related.

Strange that since I updated the app to run on Tomcat 10 and moved to a DataSourceRealm, Edge has stopped working.

PS  I've also just noticed I have posted this in the wrong section as it should probably be under security - apologies. Feel free to move if required.

[Tim Holloway]

Actually I added this thread to the Tomcat forum, since it's specifically related to Tomcat's Realm configuration.

A "408" is an HTTP request timeout and I'm not sure you can actually blame that on the database although if you have properly set up JEE container security, there shouldn't be any user code to be doing wrong things, since the login is handled entirely by Tomcat's own internal code. In that case, I'd suggest looking at the database server's logs and also see if you can get the actual SQL statements being used. Plus make sure that you are using a compatible JDBC driver class/version, as MySQL has changed the class/package name a couple of times over the years. One thing that might help is to put an EXPLAIN on the login SQL and see what its timing is.

There is no way I can explain the difference in browers other than that maybe your browser request timeout intervals are different. But in a properly operating system, the amount of time it takes to do a "SELECT COUNT(*) FROM userpass WHERE Username = ? AND Password = ?" which is the form it should be using should be minimal. Unless it's a VERY large table and you didn't make Username a Primary Key.

Incidentally, I don't recommend using upper-case in database table or column names. It's common, but different databases handle it differently and some get annoyed if you aren't careful.