Spring-boot: Upgrade to tomcat 8.5.x

[Polve]

Today has been released the first stable release of the tomcat 8.5 branch : 8.5.3.
The release notes explicitly states to use this branch in preference to 8.0

[wilkinsona]

Historically, new major or minor versions of Tomcat have taken a little while to bed down and to be ready for production usage.

@markt-asf Boot 1.4 RC1 is scheduled for 23/6. Would you recommend moving to Tomcat 8.5 for 1.4?

[Polve]

8.5 branch is not a major release (that will be version 9, now in development).
An extract from the release notes:

The Apache Tomcat team announces the immediate availability of Apache
Tomcat 8.5.3.

This is the first stable release of the 8.5.x branch. Tomcat 8.x users
should now use 8.5.x releases in preference to 8.0.x releases.

Apache Tomcat 8.5.x is intended to replace 8.0.x and includes new
features pulled forward from the 9.0.x branch.

[markt-asf]

I would.
The last regular 8.0.x release is likely to be in September 2016. After that, there might be the odd release to address security issues but the focus for 8 will be on 8.5.x.
Generally, 8.5.x should be a drop-in replacement for 8.0.x. The Tomcat community isn't guaranteeing that will be the case for all use cases but if you spot a problem, let us know and we'll take a look.

[wilkinsona]

@markt-asf Thanks. The fact that the last regular 8.0.x release will be in September is a very compelling reason to jump to 8.5.

[wilkinsona]

@markt-asf There appears to be a number of breaking changes in 8.5.3 (upgrading from 8.0.33):

1. Maven artifact org.apache.tomcat.embed:tomcat-embed-logging-juli no longer exists
2. Class org.apache.tomcat.util.net.ServerSocketFactory no longer exists
3. Class org.apache.tomcat.util.net.jsse.JSSESocketFactory no longer exists
4. Method JSSEImplementaton.getServerSockerFactory(AbstractEndpoint) no longer exists
5. Method JSSEImplementaton.getSSLUtil(AbstractEndpoint) no longer exists
6. Http11NioProtocol.getEndpoint() is no longer visible
7. Field org.apache.tomcat.util.scan.Constants.MERGED_WEB_XML no longer exists
8. AbstractHttp11Protocol.setCompressableMimeTypes no longer exists

It may be possible for us to add several reflective hacks to avoid some, and perhaps even all, of these problems, but it would be a lot easier if 8.5.x was indeed a drop-in replacement for 8.0.x.

[philwebb]

Looks like ServerSocketFactory was removed in this commit. That will have an impact on TomcatEmbeddedJSSEImplementation which was added to support non file KeyStore options (#5208).

[markt-asf]

1 is only required to enable container logging via log4j 1.x and that version is no longer supported by the log4j community. log4j 2.x can be used for container logging without any extra libraries.

2-6 are side effects of the connector refactoring in 8.5.x / 9.0.x. They are all low-level internal APIs that I'm a little surprised to find boot is using.

7 was part of the mechanism used to pass web.xml to Jasper for processing. It was removed as it was no longer required as of Servlet 3.0 as all the necessary information was available via the standard Servlet API.

8 That was some API clean-up. That one could be restored fairly easily for 8.5.x.

So in summary, 1 doesn't look like an issue, 2 to 7 probably depend on what boot was using them for and 8 is potentially fixable if fixing it is useful.

[wilkinsona]

Thanks, @markt-asf.

@philwebb Do we want to keep support for embedded Tomcat 7? This would be significantly easier if we went 8.5 only.

[wilkinsona]

@markt-asf We have a StandardContext subclass in Boot. Without tomcat-embed-logging-juli it fails to compile in Eclipse:

The type org.apache.juli.logging.Log cannot be resolved. It is indirectly referenced from required .class files

We also have a WebappClassLoader subclass. It too fails to compile, this time because WebappClassLoaderBase implements WebappProperties which was in tomcat-embed-logging-juli.

[markt-asf]

Let me check on the packaging. I may have got something wrong.

[markt-asf]

Yep. I got the removal of the log4j stuff wrong. As a work around you can probably use the tomcat-embed-logging-juli jar from 8.5.2. This affects 9.0.x as well. I'll get working on a fix.

[markt-asf]

Fixed for 8.5.x and 9.0.x. Let me know if you need snapshot of either of these made available.

[philwebb]

@wilkinsona The only problem with dropping 7 is that we're upping the minimum Java version required. Having said that, I can't think why anyone would run in embedded mode and not use Java 8. I think we should remove it.

[spencergibb]

@philwebb how will that affect downstream projects like spring cloud?

[wilkinsona]

@spencergibb It would mean that Spring Could users wouldn't be able to use Tomcat 7 with Spring Boot 1.4. I can't see why anyone would want to do that, though. Tomcat 8 has been the default since Boot 1.2 and I'd really like to think that anyone using Spring Cloud isn't stuck on Java 6.

[spencergibb]

OK, when I saw phil's comment about minimum java version, I worried that it was java 8, not 7. Hadn't thought of java 6 :-). Thanks for reassuring me.

[wilkinsona]

I think I might have figured out a way to keep support for Tomcat 8.0.x and 7.0.x. Needs some more testing, though...

[philwebb]

Nice work @wilkinsona !!

[yvs3]

I have upgraded to 8.5.3, i'm facing session problem in IE browser (11.0.4).

• When i login into application and close the browser with out logout and open the browser and give the same URL it is going into login page.
• With Tomcat 8.0.* application is working fine in IE
• Spring 3.1.3

[wilkinsona]

@yvs3 Sorry to hear you're having trouble with Tomcat 8.5.3, but it doesn't sound like it has anything to do with Spring Boot. You could try posting on Stack Overflow or the Tomcat Users mailing list.

[yvs3]

ok @wilkinsona. Thank you

[benneq]

I can't add an additional Connector for TomcatEmbeddedServletContainerFactory:

@Bean
public EmbeddedServletContainerFactory servletContainer() {
    TomcatEmbeddedServletContainerFactory tomcat = new TomcatEmbeddedServletContainerFactory();
    Connector ajpConnector = new Connector("AJP/1.3");
    ajpConnector.setProtocol("AJP/1.3");
    ajpConnector.setPort(9999);
    ajpConnector.setSecure(false);
    ajpConnector.setAllowTrace(false);
    ajpConnector.setScheme("http");
    tomcat.addAdditionalTomcatConnectors(ajpConnector);
    return tomcat;
}

This won't work, because there's no Connector class available anywhere.

Any workaround?

[wilkinsona]

The Connector class is still there. See our multi-connector Tomcat sample, for example.

@benneq If you are still having trouble, please post on Stack Overflow. GitHub issues aren't the best place to get this sort of help.

[benneq]

Sorry, my fault. Maven did download a corrupt tomcat-embed-core.. Though you can delete my comments.
Thanks anyway.