Chapter 17. Configuring the Web Server (Undertow)

The undertow subsystem allows you to configure the web server and servlet container settings. It implements the Java Servlet 3.1 Specification as well as websockets and supports HTTP Upgrade and using high performance non-blocking handlers in servlet deployments. The undertow subsystem also has the ability to act as a high performance reverse proxy which supports mod_cluster.

Within the undertow subsystem, there are five main components to configure:

Default Undertow Subsystem Configuration

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
  <buffer-cache name="default"/>
  <server name="default-server">
      <http-listener name="default" socket-binding="http" redirect-socket="https"/>
      <host name="default-host" alias="localhost">
          <location name="/" handler="welcome-content"/>
          <filter-ref name="server-header"/>
          <filter-ref name="x-powered-by-header"/>
      </host>
  </server>
  <servlet-container name="default">
      <jsp-config/>
      <websockets/>
  </servlet-container>
  <handlers>
      <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
  </handlers>
  <filters>
      <response-header name="server-header" header-name="Server" header-value="JBoss-EAP/7"/>
      <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
  </filters>
</subsystem>

The buffer cache is used to cache static resources. JBoss EAP enables multiple caches to be configured and referenced by deployments, allowing different deployments to use different cache sizes. Buffers are allocated in regions and are a fixed size. The total amount of space used can be calculated by multiplying the buffer size by the number of buffers per region by the maximum number of regions. The default size of a buffer cache is 10MB.

JBoss EAP provides a single cache by default:

Default Undertow Subsystem Configuration

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
  <buffer-cache name="default"/>
  ....
</subsystem>

Updating an Existing Buffer Cache

To update an existing buffer cache:

/subsystem=undertow/buffer-cache=default/:write-attribute(name=buffer-size,value=2048)

reload

Creating a New Buffer Cache

To create a new buffer cache:

/subsystem=undertow/buffer-cache=new-buffer:add

Deleting a Buffer Cache

To delete a buffer cache:

/subsystem=undertow/buffer-cache=new-buffer:remove

reload

For a full list of the attributes available for configuring buffer caches, please see the Undertow Subsystem Attributes section.

A server represents an instance of Undertow and consists of several elements:

The host element provides a virtual host configuration while the three listeners provide connections of that type to the Undertow instance.

JBoss EAP provides a server by default:

Default Undertow Subsystem Configuration

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
  <buffer-cache name="default"/>
  <server name="default-server">
      <http-listener name="default" socket-binding="http" redirect-socket="https"/>
      <host name="default-host" alias="localhost">
          <location name="/" handler="welcome-content"/>
          <filter-ref name="server-header"/>
          <filter-ref name="x-powered-by-header"/>
      </host>
  </server>
  ...
</subsystem>

Updating an Existing Server

To update an existing server:

/subsystem=undertow/server=default-server:write-attribute(name=default-host,value=default-host)

reload

Creating a New Server

To create a new server:

/subsystem=undertow/server=new-server:add

reload

Deleting a Server

To delete a server:

/subsystem=undertow/server=new-server:remove

reload

For a full list of the attributes available for configuring servers, see the Undertow Subsystem Attributes section.

A servlet container provides all servlet, JSP and websocket-related configuration, including session-related configuration. While most servers will only need a single servlet container, it is possible to configure multiple servlet containers by adding an additional servlet-container element. Having multiple servlet containers enables behavior such as allowing multiple deployments to be deployed to the same context path on different virtual hosts.

JBoss EAP provides a servlet container by default:

Default Undertow Subsystem Configuration

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
  <buffer-cache name="default"/>
  <server name="default-server">
    ...
  </server>
  <servlet-container name="default">
      <jsp-config/>
      <websockets/>
  </servlet-container>
...
</subsystem>

Updating an Existing Servlet Container

To update an existing servlet container:

/subsystem=undertow/servlet-container=default:write-attribute(name=ignore-flush,value=true)

reload

Creating a New Servlet Container

To create a new servlet container:

/subsystem=undertow/servlet-container=new-servlet-container:add

reload

Deleting a Servlet Container

To delete a servlet container:

/subsystem=undertow/servlet-container=new-servlet-container:remove

reload

For a full list of the attributes available for configuring servlet containers, see the Undertow Subsystem Attributes section.

JBoss EAP allows for two types of handlers to be configured:

File handlers serve static files. Each file handler must be attached to a location in a virtual host. Reverse-proxy handlers allow JBoss EAP to serve as a high performance reverse-proxy.

JBoss EAP provides a file handler by default:

Default Undertow Subsystem Configuration

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
  <buffer-cache name="default"/>
  <server name="default-server">
      ...
  </server>
  <servlet-container name="default">
      ...
  </servlet-container>
  <handlers>
      <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
  </handlers>
  ...
</subsystem>

Using WebDAV for Static Resources

Previous versions of JBoss EAP allowed for using WebDAV with the web subsystem, by way of the WebdavServlet, to host static resources and enable additional HTTP methods for accessing and manipulating those files. In JBoss EAP 7, the undertow subsystem does provide a mechanism for serving static files using a file handler, but the undertow subsystem does not support WebDAV. If you want to use WebDAV with JBoss EAP 7, you can write a custom WebDAV servlet.

Updating an Existing File Handler

To update an existing file handler:

/subsystem=undertow/configuration=handler/file=welcome-content:write-attribute(name=case-sensitive,value=true)

reload

Creating a New File Handler

To create a new file handler:

/subsystem=undertow/configuration=handler/file=new-file-handler:add(path="${jboss.home.dir}/welcome-content")

Deleting a File Handler

To delete a file handler

/subsystem=undertow/configuration=handler/file=new-file-handler:remove

reload

For a full list of the attributes available for configuring handlers, see the Undertow Subsystem Attributes section.

A filter enables some aspect of a request to be modified and can use predicates to control when a filter executes. Some common use cases for filters include setting headers or doing GZIP compression.

The following types of filters can be defined:

JBoss EAP provides two filters by default:

Default Undertow Subsystem Configuration

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
  <buffer-cache name="default"/>
  <server name="default-server">
    ...
  </server>
  <servlet-container name="default">
    ...
  </servlet-container>
  <handlers>
      ...
  </handlers>
  <filters>
      <response-header name="server-header" header-name="Server" header-value="JBoss-EAP/7"/>
      <response-header name="x-powered-by-header" header-name="X-Powered-By" header-value="Undertow/1"/>
  </filters>
</subsystem>

Updating an Existing Filter

To update an existing filter:

/subsystem=undertow/configuration=filter/response-header=server-header:write-attribute(name=header-value,value="JBoss-EAP")

reload

Creating a New Filter

To create a new filter:

/subsystem=undertow/configuration=filter/response-header=new-response-header:add(header-name=new-response-header,header-value="My Value")

Deleting a Filter

To delete a filter:

/subsystem=undertow/configuration=filter/response-header=new-response-header:remove

reload

For a full list of the attributes available for configuring filters, see the Undertow Subsystem Attributes section.

JBoss EAP includes a default Welcome application, which displays at the root context on port 8080 by default.

There is a default server preconfigured in Undertow that serves up the welcome content.

Default Undertow Subsystem Configuration

<subsystem xmlns="urn:jboss:domain:undertow:3.1">
  ...
  <server name="default-server">
      <http-listener name="default" socket-binding="http" redirect-socket="https"/>
      <host name="default-host" alias="localhost">
          <location name="/" handler="welcome-content"/>
          <filter-ref name="server-header"/>
          <filter-ref name="x-powered-by-header"/>
      </host>
  </server>
  ...
  <handlers>
      <file name="welcome-content" path="${jboss.home.dir}/welcome-content"/>
  </handlers>
  ...
</subsystem>

The default server (default-server) has a default host (default-host) configured. The default host is configured to handle requests to the server’s root, using the <location> element, with the welcome-content file handler. The welcome-content handler serves up the content in the location specified in the path property.

This default Welcome application can be replaced with your own web application. This can be configured in one of two ways:

You can also disable the welcome content.

Changing the welcome-content File Handler

Modify the existing welcome-content file handler’s path to point to the new deployment.

/subsystem=undertow/configuration=handler/file=welcome-content:write-attribute(name=path,value="/path/to/content")

/subsystem=undertow/configuration=handler/file=NEW_FILE_HANDLER:add(path="/path/to/content")
/subsystem=undertow/server=default-server/host=default-host/location=\/:write-attribute(name=handler,value=NEW_FILE_HANDLER)

Reload the server for the changes to take effect.

reload

Changing the default-web-module

Map a deployed web application to the server’s root.

/subsystem=undertow/server=default-server/host=default-host:write-attribute(name=default-web-module,value=hello.war)

Reload the server for the changes to take effect.

reload

Disabling the Default Welcome Web Application

Disable the welcome application by removing the location entry (/) for the default-host.

/subsystem=undertow/server=default-server/host=default-host/location=\/:remove

Reload the server for the changes to take effect.

reload

For more details on configuring HTTPS for use with both web applications as well as the management interfaces please see the How to Configure Server Security Guide.

The HTTP session timeout defines the period of inactive time needed to declare an HTTP session invalid. For example, a user accesses an application deployed to JBoss EAP which creates an HTTP session. If that user then attempts to access that application again after the HTTP session timeout, the original HTTP session will be invalidated and the user will be forced to create a new HTTP session. This may result in the loss of unpersisted data or the user having to re-authenticate.

The HTTP session timeout is configured in an application’s web.xml file, but a default HTTP session timeout can be specified within JBoss EAP. The server’s timeout value will apply to all deployed applications, but an application’s web.xml will override the server’s value.

The server value is specified in the default-session-timeout property which is found in the servlet-container section of the undertow subsystem. The value of default-session-timeout is specified in minutes and the default 30.

Configuring the Default Session Timeout

To configure the default-session-timeout:

/subsystem=undertow/servlet-container=default:write-attribute(name=default-session-timeout, value=60)

reload

Session management cookies can be accessed by both HTTP APIs and non-HTTP APIs such as JavaScript. JBoss EAP offers the ability to send the HttpOnly header as part of the Set-Cookie response header to the client, usually a browser. In supported browsers, enabling this header tells the browser that it should prevent accessing session management cookies through non-HTTP APIs. Restricting session management cookies to only HTTP APIs can help to mitigate the threat of session cookie theft via cross-site scripting attacks. To enable this behavior, the http-only attribute should be set to true.

The http-only attribute is set in two places in the undertow subsystem:

Configuring host-only for the Servlet Container Session Cookie

To configure the host-only property for the servlet container session cookie:

/subsystem=undertow/servlet-container=default/setting=session-cookie:add

/subsystem=undertow/servlet-container=default/setting=session-cookie:write-attribute(name=http-only,value=true)

reload

Configuring host-only for the Host Single Sign-On

To configure the host-only property for the host single sign-on:

/subsystem=undertow/server=default-server/host=default-host/setting=single-sign-on:add

/subsystem=undertow/server=default-server/host=default-host/setting=single-sign-on:write-attribute(name=http-only,value=true)

reload

Undertow allows for the use of the HTTP/2 standard, which reduces latency by compressing headers and multiplexing many streams over the same TCP connection. It also provides the ability for a server to push resources to the client before it has requested them, leading to faster page loads. Undertow is also compatible with SPDY, the predecessor to HTTP/2, in order to support clients that have not yet updated to the new specification.

/subsystem=undertow/server=default-server/http-listener=default:write-attribute(name=enable-http2,value=true)

java -version

JAVA_OPTS="$JAVA_OPTS -Xbootclasspath/p:$JBOSS_HOME/bin/alpn-boot-$ALPN_VERSION.jar"

/subsystem=undertow/server=default-server/https-listener=https:write-attribute(name=enable-http2,value=true)

The RequestDumping handler (io.undertow.server.handlers.RequestDumpingHandler) logs the details of a request and corresponding response objects handled by Undertow within JBoss EAP.

You can configure a RequestDumping handler at either at the server level directly in JBoss EAP or within an individual application.

/subsystem=undertow/configuration=filter/expression-filter=requestDumperExpression:add(expression="dump-request")

/subsystem=undertow/server=default-server/host=default-host/filter-ref=requestDumperExpression:add

dump-request

path(/test) -> dump-request