Apache readies Tomcat Java servlet container upgrade

Scalability and security to be enhanced in Tomcat 7; Apache also is set to take over the Subversion software configuration management project

By Paul Krill, InfoWorld, 11/05/09

 Start a discussion    Print article

 Comments (1)    Print article

The Apache Software Foundation for open source projects is readying an upgrade to its Tomcat Java servlet container, with improvements eyed in areas such as scalability and security, Apache personnel said on Wednesday afternoon.

Related links

Story tools

Sponsored by:

E-Mail article
Print article
Contact author
AIM article	del.icio.us
Reddit	Digg
Stumble	Slashdot It!

Version 7 of Tomcat is due in alpha release around the Christmas/New Year's timeframe, said Mark Thomas, an Apache member, Tomcat committer and senior software engineer at VMware-owned SpringSource.

[ See InfoWorld's report on what has happened with Java in the two years since it was open sourced. ]

Tomcat is used for deploying Web sites and serves as the basis for such products as the SpringSource tc Server for running Java and Spring applications. Tomcat is used in at least 75 percent of Java- based Web sites, said Jim Jagielski, chairman of the Apache board of directors and a senior staff engineer and chief open source officer at VMware. Apache officials discussed Tomcat at the ApacheCon US 2009 conference in Oakland, Calif.

Plans for Tomcat 7 include backing for the still-unfinished Java Servlet 3.0 specification. Featured in Tomcat 7 and Servlet 3.0 are asynchronous processing capabilities to improve scalability, Apache officials said.

Dynamic configuration also is planned for Tomcat 7 as part of Servlet 3.0 support. "You can programmatically set up the configuration of your Web apps," Thomas said.

Among security improvements planned for Tomcat 7 is protection against cross-site request forgeries.  Version 7 will use HTTP POST requests to make it harder for an attacker to construct an attack. A nonce request identifier also is used as a unique identifier to stifle these attackers.

The Manager application in Tomcat 7 features multiple roles for access control. "It gives system administrators more fine-grained control over who's allowed to do what," Thomas said.

Version 7 also is set to make it easier to embed Tomcat in applications and endorses generic programming objects, enabling programming errors to be found earlier in the process, at compilation time rather than run time.

For more enterprise computing news, visit InfoWorld. Story copyright InfoWorld Media Group, Inc.

Featured White Papers

• Hey, Can I Borrow Your Keys? I'd Like to Trash the Kingdom