Tomcat is not redirecting to 400 bad request custom error page

Question

We have tomcat 9 web server in production. The problem we are facing is we want to show the custom error page for our application if tomcat receives any malformed URL as follows

http://URL/|

or

http://URL/[

I have added error page tag in web.xml of tomcat application server as follows

<error-page>
   <error-code>400</error-code>
   <location>/error.html</location>
 </error-page>
 <error-page>
   <error-code>404</error-code>
   <location>/error.html</location>
 </error-page>

and we have error.html in our application ROOT folder in webapps directory of tomcat.

Whenever the user tries to request any nonexistent webpage he receives error page correctly corresponding to 404 error code as specified above.

Real Problem is tomcat not able to redirect to error.html when the user enters malformed URL in the browser like http://URL/|

Tomcat is showing the default 400 bad request error page instead of the custom error page.

Answer 1

This is not a bug, it is a configuration issue.

Tomcat 9 has improved the error handling so that more errors, particularly those those occur before request processing starts, are passed to the standard error handling mechanism rather than just returning an error code.

In the case of malformed URIs, it is not possible for Tomcat to parse the URI hence the URI cannot be mapped to a web application. Tomcat is, therefore, unable to trigger the application level error handling because it cannot identify an application. In this case, the error is handled by the ErrorReportValve which can be configured in server.xml.

A recent(ish) addition to the ErrorReportValve is the ability to define static web pages (i.e. no Servlets or JSPs, just HTML) per status code and/or Exception type in a similar manner to the per web application error page configuration.

Example Error Report Valve:

<Valve className="org.apache.catalina.valves.ErrorReportValve"
        errorCode.400="webapps/ROOT/error400.html"
        errorCode.0="webapps/ROOT/errorOthers.html"
        showReport="false"
        showServerInfo="false" />

Answer 2

Below is sample configuration that follows https://stackoverflow.com/a/55702749/2532710 to save someone else time. In server.xml inside Host tag:

  <Valve className="org.apache.catalina.valves.ErrorReportValve"
        errorCode.400="webapps/ROOT/error400.html"
        errorCode.0="webapps/ROOT/errorOthers.html"
        showReport="false"
        showServerInfo="false" />

Put static html error400.html ... errorOthers.html in webapps/ROOT of CATALINA_BASE.

Answer 3

Previous solutions were not working in my case.

According to the Tomcat doc, the valve component can put be into the container Engine, Host, or Context. Tried everything without success regarding this specific error 400 (while others errors are handled as expected).

Finally I found the missing element in that enigma:

To be efficient, oddly enough, the Error Report Valve has to be put in the host container defined as the defaultHost of the catalina engine, even if it is not the targeted host.

server.xml example: handle error 400 Bad requests for "some-cats.com" and "some-dogs.com" as well

<Engine name="Catalina" defaultHost="www.some-dogs.com">
    <!--     NO EFFECT ON ERROR PAGE 400
    <Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false" /> 
    -->
    <Host name="www.some-cats.com">      
        <!--     NO EFFECT ON ERROR PAGE 400
        <Valve className="org.apache.catalina.valves.ErrorReportValve" showReport="false" showServerInfo="false" /> 
        -->
        ...
    </Host>
    <Host name="www.some-dogs.com">
        <!--  HERE IS THE RIGHT PLACE FOR ERROR PAGE 400-->
        <Valve className="org.apache.catalina.valves.ErrorReportValve" errorCode.0="path/error.html" showReport="false" showServerInfo="false" />
        ...
    </Host>
</Engine>

Tested on tomcat 8.5.84 and 9.0.70

Of course if you just have one host, you don't have this problem.

Answer 4

You can write your own error page https://aspiresoftware.in/blog/catalinatomcat-custom-error-report-valve-to-handle-errors-exceptions/

You have to put your jar in tomcat lib.