Confluence upgrade 6.9.1 to 6.10

[Michal Sukupčák]

Hello support, I`m trying to figure out our upgrade. We have upgraded confluence as usually we are making it. But we have issue that when we access confluence url we are getting HTTP status 400 - Bad request on tomcat 9.0.8 (build in confluence).

We are behind nginx ssl proxy, with letsenc certificates. Everything was working fine before this upgrade. When we access the IP address on port 8090 confluence is up and running. I`m not able to figure out where can be issue. Or what can cause issues with bad requests. We have tried multiple devices, with multiple browser, still without any success.

We are running it in on ubuntu 16.04 server TLS, database is postgresql 9.5. Here is nginx config:

upstream confluence_tomcat {
server 127.0.0.1:8090 fail_timeout=0;
}

upstream confluence_synchrony {
server 127.0.0.1:8091 fail_timeout=0;
}

server {
listen 443 default_server ssl http2;
listen [::]:443 default_server ssl http2;

server_name confluence.wds.sk;
server_name www.confluence.wds.sk;

ssl_certificate /etc/nginx/ssl/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
ssl_ciphers EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
ssl_dhparam /etc/nginx/ssl/dhparam.pem;

location / {
#try_files $uri $uri/ =404;
#include proxy_params;
client_max_body_size 100m;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://confluence_tomcat/;
}

location /synchrony {
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_pass http://confluence_synchrony/synchrony;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
}

location ~ /\.ht {
deny all;
}

error_log /var/log/nginx/confluence-error.log warn;
access_log /var/log/nginx/confluence-access.log;

}

And here is server.xml:

<Connector port="8090" connectionTimeout="20000" redirectPort="8443"
maxThreads="48" minSpareThreads="10"
enableLookups="false" acceptCount="10" debug="0" URIEncoding="UTF-8"
protocol="org.apache.coyote.http11.Http11NioProtocol"
scheme="https" proxyName="confluence.wds.sk" proxyPort="443"/>

<Engine name="Standalone" defaultHost="localhost" debug="0">
<Host name="localhost" debug="0" appBase="webapps" unpackWARs="true" autoDeploy="false" startStopThreads="4">
<Context path="" docBase="../confluence" debug="0" reloadable="false" useHttpOnly="true">
<!-- Logging configuration for Confluence is specified in confluence/WEB-INF/classes/log4j.properties -->
<Manager pathname=""/>
<Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="60"/>
</Context>

<Context path="${confluence.context.path}/synchrony-proxy" docBase="../synchrony-proxy" debug="0"
reloadable="false" useHttpOnly="true">
<Valve className="org.apache.catalina.valves.StuckThreadDetectionValve" threshold="60"/>
</Context>
</Host>
</Engine>

Thank you for help.

[Nikita Loginov]

As I understood Nginx is rewriting Host header before passing data to the proxied host. According to RFC 952 we can't use underscore in host names and new version of the Tomcat in Confluence 6.10 is very strict about that.

So we have two options to fix this issue - 

a) Replace upstream name "confluence_tomcat" with name without underscore.

b) Prevent Nginx from rewriting the Host header by adding "proxy_set_header Host $host;" directive.

[Igor M.]

Hello,

Can you please provide events from catalina.out at the time you are trying to establish connection?

[Michal Sukupčák]

Thank you very much for your reply, after this SR submit I was digging in the configuration and examples and noticed one thing:

In server.xml in Context Path tag was directive useHttpOnly="true", after I have removed this one, everything is working well.

So this tag before change:

<Context path="" docBase="../confluence" debug="0" reloadable="false" useHttpOnly="true">

and after change:

<Context path="" docBase="../confluence" debug="0" reloadable="false">

Im not using /confluence so there fore path is "". 

So maybe it helps someone, with same issues. 

Have a nice day.

[Nikita Loginov]

Hi support,

We are having the same issue after upgrade 6.9.1 to 6.10.0! Removing "useHttpOnly="true"" from server.xml doesn't help in our case.

Our configuration is very similiar to Michal's, only difference we are running on Windows server 2012R2 and database is MS SQL server 2014.