Skip to content

Commit 58762dc

Browse files
labkey-adamlabkey-adam
authored
Move default request properties into code (#1109)
1 parent 7710b9b commit 58762dc

File tree

3 files changed

+56
-46
lines changed

3 files changed

+56
-46
lines changed

‎server/configs/application.properties

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,12 @@ context.encryptionKey=@@encryptionKey@@
4646

4747
## By default, we serve LabKey at the root context path (e.g. http://localhost:8080)
4848
## You may customize the context path if you wish (e.g. http://localhost:8080/labkey)
49-
## Context path value must start with a slash
49+
## The context path value must start with a slash
5050
#context.contextPath=/labkey
5151

5252
## Using a legacy context path provides backwards compatibility with old deployments. A typical use case would be to
5353
## deploy to the root context (the default) and configure /labkey as the legacy path. GETs will be redirected.
54-
## All other methods (POSTs, PUTs, etc) will be handled server-side via a servlet forward.
54+
## All other methods (POSTs, PUTs, etc.) will be handled server-side via a servlet forward.
5555
#context.legacyContextPath=/labkey
5656

5757
## Other webapps to be deployed, most commonly to deliver a set of static files. The context path to deploy into is the
@@ -68,11 +68,12 @@ context.encryptionKey=@@encryptionKey@@
6868

6969
## Tomcat v10.1.42 lowered the default for part count from 1000 to 10. Our default is now 500.
7070
## Tomcat also lowered the header size default from 10Kb to 512, which is also our default.
71-
## We lower max connections from default 8192 to 250, providing ample concurrent requests for LabKey Server scenarios.
72-
## These settings can be overridden if needed, but reasonable limits reduce your server's vulnerability to DoS attacks.
73-
server.tomcat.max-part-count=500
74-
server.tomcat.max-part-header-size=512
75-
server.tomcat.max-connections=250
71+
## We lowered max connections from default 8192 to 250, providing ample concurrent requests for LabKey Server scenarios.
72+
## These default values are set via the server code (LabKeyServer.java), but they can be overridden below, if needed.
73+
## However, note that reasonable limits reduce your server's vulnerability to DoS attacks.
74+
#server.tomcat.max-part-count=500
75+
#server.tomcat.max-part-header-size=512
76+
#server.tomcat.max-connections=250
7677

7778
## SMTP configuration
7879
mail.smtpHost=@@smtpHost@@

‎server/configs/webapps/embedded/config/application.properties

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -58,15 +58,15 @@ server.error.include-message=always
5858
## This must not be the same as the server.port set above.
5959
#context.httpPort=80
6060

61-
## We strongly recommend deploying LabKey at the root context path (e.g. http://localhost:8080)
61+
## We strongly recommend deploying LabKey at the root context path (e.g., http://localhost:8080)
6262
## If your previous configuration file was named "ROOT.xml", you were already deployed at the root.
63-
## If you previously used a different context path, such as "/labkey" (i.e. with a configuration
63+
## If you previously used a different context path, such as "/labkey" (i.e., with a configuration
6464
## file named "labkey.xml"), set a legacy context path for backwards compatibility.
6565
## Previous URLs, GETs, etc. will be redirected or handled server-side via a servlet forward.
6666
#context.legacyContextPath=/labkey
6767

68-
## We do not recommend deploying to a non-root context path (e.g. http://localhost:8080/labkey)
69-
## If you do set this property, do not set a legacyContextPath.
68+
## We do not recommend deploying to a non-root context path (e.g., http://localhost:8080/labkey)
69+
## If you do set this property, do not set a legacyContextPath. And the context path value must start with a slash.
7070
#context.contextPath=/labkey
7171

7272
####################################################################################
@@ -105,11 +105,12 @@ mail.smtpUser=Anonymous
105105

106106
## Tomcat v10.1.42 lowered the default for part count from 1000 to 10. Our default is now 500.
107107
## Tomcat also lowered the header size default from 10Kb to 512, which is also our default.
108-
## We lower max connections from default 8192 to 250, providing ample concurrent requests for LabKey Server scenarios.
109-
## These settings can be overridden if needed, but reasonable limits reduce your server's vulnerability to DoS attacks.
110-
server.tomcat.max-part-count=500
111-
server.tomcat.max-part-header-size=512
112-
server.tomcat.max-connections=250
108+
## We lowered max connections from default 8192 to 250, providing ample concurrent requests for LabKey Server scenarios.
109+
## These default values are set via the server code (LabKeyServer.java), but they can be overridden below, if needed.
110+
## However, note that reasonable limits reduce your server's vulnerability to DoS attacks.
111+
#server.tomcat.max-part-count=500
112+
#server.tomcat.max-part-header-size=512
113+
#server.tomcat.max-connections=250
113114

114115
## Other webapps to be deployed, most commonly to deliver a set of static files. The context path to deploy into is the
115116
## property name after the "context.additionalWebapps." prefix, and the value is the location of the webapp on disk

‎server/embedded/src/org/labkey/embedded/LabKeyServer.java

Lines changed: 38 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515

1616
import java.io.File;
1717
import java.util.ArrayList;
18+
import java.util.HashMap;
1819
import java.util.List;
1920
import java.util.Map;
2021

@@ -66,36 +67,43 @@ public static void main(String[] args)
6667

6768
SpringApplication application = new SpringApplication(LabKeyServer.class);
6869
application.addListeners(new ApplicationPidFileWriter("./labkey.pid"));
69-
application.setDefaultProperties(Map.of(
70-
"server.tomcat.basedir", ".",
71-
"server.tomcat.accesslog.directory", logHome,
72-
73-
// Enable HTTP compression for response content
74-
"server.compression.enabled", "true",
75-
76-
"server.tomcat.accesslog.enabled", "true",
77-
"server.tomcat.accesslog.pattern", "%h %l %u %t \"%r\" %s %b %D %S %I \"%{Referer}i\" \"%{User-Agent}i\" %{LABKEY.username}s %{X-Forwarded-For}i",
78-
"jsonaccesslog.pattern", "%h %t %m %U %s %b %D %S \"%{Referer}i\" \"%{User-Agent}i\" %{LABKEY.username}s %{X-Forwarded-For}i",
79-
80-
// Issue 52415: Omit stack traces from Tomcat error pages by default, but propagate error messages
81-
"server.error.include-stacktrace", "never",
82-
"server.error.include-message", "always",
83-
84-
// A strong report-only Content Security Policy that reports violations to this server
85-
"csp.report", """
86-
default-src 'self' ;
87-
connect-src 'self' ${CONNECTION.SOURCES} ;
88-
object-src 'none' ;
89-
style-src 'self' 'unsafe-inline' ${STYLE.SOURCES} ;
90-
img-src 'self' data: ${IMAGE.SOURCES} ;
91-
font-src 'self' data: ${FONT.SOURCES} ;
92-
script-src 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ;
93-
base-uri 'self' ;
94-
frame-ancestors 'self' ;
95-
frame-src 'self' ${FRAME.SOURCES} ;
96-
report-uri ${context.contextPath:}/admin-contentSecurityPolicyReport.api?cspVersion=r11&${CSP.REPORT.PARAMS}
97-
"""
98-
));
70+
application.setDefaultProperties(new HashMap<>()
71+
{{
72+
put("server.tomcat.basedir", ".");
73+
put("server.tomcat.accesslog.directory", logHome);
74+
75+
// Boost limits imposed by Tomcat v10.1.42
76+
put("server.tomcat.max-part-count", 500);
77+
put("server.tomcat.max-part-header-size", 512);
78+
put("server.tomcat.max-connections", 250);
79+
80+
// Enable HTTP compression for response content
81+
put("server.compression.enabled", "true");
82+
83+
put("server.tomcat.accesslog.enabled", "true");
84+
put("server.tomcat.accesslog.pattern", "%h %l %u %t \"%r\" %s %b %D %S %I \"%{Referer}i\" \"%{User-Agent}i\" %{LABKEY.username}s %{X-Forwarded-For}i");
85+
put("jsonaccesslog.pattern", "%h %t %m %U %s %b %D %S \"%{Referer}i\" \"%{User-Agent}i\" %{LABKEY.username}s %{X-Forwarded-For}i");
86+
87+
// Issue 52415: Omit stack traces from Tomcat error pages by default, but propagate error messages
88+
put("server.error.include-stacktrace", "never");
89+
put("server.error.include-message", "always");
90+
91+
// A strong report-only Content Security Policy that reports violations to this server
92+
put("csp.report", """
93+
default-src 'self' ;
94+
connect-src 'self' ${CONNECTION.SOURCES} ;
95+
object-src 'none' ;
96+
style-src 'self' 'unsafe-inline' ${STYLE.SOURCES} ;
97+
img-src 'self' data: ${IMAGE.SOURCES} ;
98+
font-src 'self' data: ${FONT.SOURCES} ;
99+
script-src 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ;
100+
base-uri 'self' ;
101+
frame-ancestors 'self' ;
102+
frame-src 'self' ${FRAME.SOURCES} ;
103+
report-uri ${context.contextPath:}/admin-contentSecurityPolicyReport.api?cspVersion=r11&${CSP.REPORT.PARAMS}
104+
""");
105+
}}
106+
);
99107
application.setBannerMode(Banner.Mode.OFF);
100108
application.run(args);
101109
}

0 commit comments

Comments
 (0)