Agenda

Jakarta EE 11

Jakarta Servlet

Jakarta Pages

Jakarta WebSocket

Jakarta Expression Language

Jakarta Authentication

Jakarta Annotations

Tomcat specific changes

Jakarta EE 11

42 individual specifications - Tomcat implements 6

Platform specification - Tomcat implements relevant sections

Minimum of Java 21

No SecurityManager support

Testing and Compatibility Kits (TCKs) are being refactored

First milestones due end of November

Final release June/July 2024

Jakarta Servlet - 6.1

No major changes

Clarification

Clean-up

Various improvements

Jakarta Servlet - Headers

Calls using null for a header name will be NO-OPs

Using null when setting a header value will remove all current values

Calls using null when adding a header value will be NO-OPs

The empty string is a valid value for a header

Any method that sets a header is a NO-OP once the response is committed

Align getDateHeader() and getIntHeader() with getHeader() for multiple values

Jakarta Servlet - Async

dispatch() and complete() close non-blocking output streams

write(), print(), println() and flush() are "write operations"

Jakarta Servlet - Redirects

Status code can be specified

Response body can be specified

Relative redirects are allowed

Jakarta Servlet - Security

Clarify that all ServletContext methods that accept a path bypass security constraints

Remove sensitive HTTP headers from TRACE responses

Jakarta Servlet - Parameters

Invalid parameters will always trigger an Exception

Jakarta Servlet - Miscellaneous I

Update HTTP RFC references to latest versions

HTTPS support is now mandatory

New constants for status codes 308, 421, 422 and 426

New request attribute jakarta.servlet.error.query_string

Add ByteBuffer support to ServletInputStream and ServletOutputStream

Charset support for setCharacterEncoding()

Jakarta Servlet - Miscellaneous II

Context root mapping occurs with or without the trailing '/'

Clarify when leading '/' is omitted in HttpServletMapping.getMatchValue()

Clarify multi-part config sizes are in bytes

Clarify expected behaviour for CONNECT requests

Deprecate and make optional support for HTTP/2 server push

Jakarta Servlet - In Progress

HttpSession access for WebSocket

Require error dispatches to use GET

Clarify behaviour of various methods for include / forward

Support for 1xx responses - particularly early hints

Jakarta Pages - 4.0

Deprecated classes and methods have been removed

Updated ErrorData to support the new request attribute jakarta.servlet.error.query_string

Jakarta WebSocket - 2.2

Clarified the responsibility for sending Ping messages

Added getSession() method to SendResult

Expression Language - 6.0

Remove all deprecated classes and methods

Dependency on JavaBeans API is now optional

Added support for java.util.Optional via OptionalELResolver

Annotations - 3.0?

ManagedBean is deprecated

Jakarta Authentication - 3.1?

TBD

Tomcat 11

No major changes

Specification / RFC updates

Generally stricter with invalid input

Enhancements and improvements

32-bit Windows no longer supported (no JRE)

Tomcat 11 - Security I

BASIC authentication uses UTF-8 by default

Update DIGEST auth to RFC 7616

Documentation web application is only accessible from localhost by default

Examples web application is only accessible from localhost by default

Tomcat 11 - Security II

rejectIllegalHeader hard-coded to true

allowHostHeaderMismatch hard-coded to false

Align AJP connector handling of invalid HTTP headers with HTTP connector

Added RateLimitFilter

HTTP/2

RFC 9218 - HTTP/2 priority frame support

Support for server push has been removed

Virtual threads

Virtual thread support - useVirtualThreads on the Connector

Some internal refactoring

TLS

Log TLS cert info on startup

Dedicated loggers for detailed TLS configuration info

Added TLSCertificateReloadListener

Miscellaneous

Expose the utility executor to web applications

Tomcat no longer sets java.protocol.handler.pkgs when starting

Added PropertiesRoleMappingListener

Added ContextNamingInfoListener

Add support for loading configuration resources from the web application