...
Despite
| Jira | ||||||
|---|---|---|---|---|---|---|
|
| Jira | ||||||
|---|---|---|---|---|---|---|
|
OOTB the Tomcat default values are used as recommended by https://tomcat.apache.org/tomcat-9.0-doc/config/ajp.html#Introduction
This is in relation with https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31
and https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Connectors
But OOTB secretRequired value must be false because secret value is empty. Else a notifying message appears in log saying that AJP is not available.
Long story short, with OOTB configuration only localhost works.
So if you want to use AJP you need to set the values depending on your configuration. Using
".*" to allowedRequestAttributesPattern put you at risk.