Tomcat 11: Lenient vs Strict Defaults, Side by Side
A side-by-side comparison of legacy Tomcat defaults and the strict defaults in Tomcat 11, showing which behaviors change and what to verify before you upgrade a Java web tier.
Loading post…
Red HatJeff BeckExplainer
Upgrading to Red Hat JBoss Web Server 7: Key changes & impacts
Summary
Red Hat JBoss Web Server 7, based on Apache Tomcat 11 and Jakarta EE 11, requires Java 17 as the new minimum and drops support for Java 11. Jakarta EE 11 does not require another import rename but adds a RecordELResolver for records and an OptionalELResolver for optionals. Tomcat 11 changes parameter parsing to throw exceptions on malformed requests, reduces maxParameterCount to 1,000 from 10,000, removes FailedRequestFilter and HTTP/2 push, and retains quotes in cookie values per RFC 6265. The Java SecurityManager is removed, UBI 8 images are discontinued for UBI 9, Prometheus is no longer bundled, and Red Hat recommends container isolation as replacement. Teams must confirm Java 17 readiness, check for SecurityManager usage, update their base image pipeline, and note that Spring Boot 4 on JWS 7 is unsupported.
Context
Upgrading to Red Hat JBoss Web Server 7, which is based on Apache Tomcat 11 and Jakarta EE 11, with Java 17 as baseline. The post details behavioral changes, removed features, and prerequisites for the upgrade.
Takeaways
Jakarta EE 11 does not require another import rename; the javax to jakarta migration was completed in JWS 6.0. New resolvers for records and optionals are added.
Tomcat 11 changes parameter parsing to throw exceptions on malformed requests instead of returning null, and maxParameterCount defaults to 1,000 (down from 10,000), which can break large forms.
The Java SecurityManager is removed in JWS 7; Red Hat recommends container isolation as a replacement, which changes deployment topology.
FAQ
What are the key changes in parameter parsing in Tomcat 11?
Tomcat 11 now throws a runtime exception when a request body is malformed or exceeds size limits, instead of returning null. Additionally, maxParameterCount defaults to 1,000, down from 10,000, making large forms more likely to trigger failures.
Is the javax to jakarta rename required again for JWS 7?
No, that rename was done in JWS 6.0. Jakarta EE 11 does not rename imports again. Instead, it adds new resolvers like RecordELResolver and OptionalELResolver.
What replaces the Java SecurityManager in JWS 7?
The SecurityManager is removed. Red Hat recommends container isolation, running one web application per JWS instance in its own container or VM, which changes deployment topology and resource footprint.
Source and freshness
- Source
- developers.redhat.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
Visual explainers
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.