What Is New in Apache Tomcat 4.1
This release builds upon the Catalina servlet container and Coyote connector foundation, focusing on stability and standards compliance. It's a maintenance release that consolidates numerous fixes and minor enhancements.
| Category | Summary of Changes |
|---|---|
| New Features | Added support for Servlet 2.3 and JSP 1.2 specifications. Introduced the Manager and Admin web applications. |
| Improvements | Enhanced performance and stability of the HTTP connector. Improved JSP compilation and class loading. |
| Bug Fixes | Addressed a significant number of issues across the board, including memory leaks, request parsing, and JSP handling. |
| Security | Patched vulnerabilities related to HTTP request smuggling and cross-site scripting (XSS). |
How did servlet and JSP support evolve?
Tomcat 4.1 is a full implementation of the Servlet 2.3 and JSP 1.2 specifications. This was a major step up, providing developers with a more powerful and standardized API for building web applications.
In practice, this meant better support for filters, application lifecycle events, and enhanced JSP tag libraries. This solidified Tomcat's position as a production-ready servlet container.
What are the key connector and performance updates?
The Coyote HTTP/1.1 connector saw significant optimizations for handling persistent connections and request parsing. This directly improved throughput and reduced resource consumption under heavy load.
We also fixed several edge-case bugs that could cause request headers to be parsed incorrectly or connections to hang. These are the kind of fixes that make a system noticeably more robust in production.
What management tools were introduced?
This release included the Manager web application, which allowed for dynamic deployment and undeployment of applications. The Admin web application provided a way to configure Tomcat instances via a web UI.
While many shops eventually moved to purely configuration-file-based management, these tools were incredibly useful for development and prototyping environments.
Were there any notable JSP engine changes?
Yes, the Jasper JSP compiler was updated to comply with JSP 1.2. This included fixes for how it handled whitespace and generated Java servlet code from JSP pages.
We squashed bugs that could cause compilation failures for certain valid JSP syntax constructs. This matters because it made the development process smoother and more predictable.
FAQ
Is Tomcat 4.1 a suitable upgrade from 4.0?
Absolutely. The 4.1 branch is focused on stabilizing the major architectural changes introduced in 4.0. You get all the benefits of the new Catalina architecture with far fewer bugs and better performance.
Does this version fix the memory leaks known in earlier releases?
Yes, a number of specific memory leak issues were identified and patched in this release, particularly related to class loaders and application reloading.
What is the most important security fix in this release?
One critical fix addressed HTTP request smuggling vulnerabilities, where a maliciously crafted request could potentially bypass security constraints or affect other users' sessions.
Can I use the Manager app to deploy WAR files remotely?
Yes, the Manager application supports remote deployment via HTTP commands, which is useful for automating deployment scripts in development and staging environments.
How is JSP 1.2 support different from previous versions?
JSP 1.2 added better support for tag libraries (with the new .tld descriptor format) and improved XML compliance. It also provided a more robust environment for developing custom tags.