...
| Info |
|---|
Unix/ Linux installation: these instructions guide you to setting up tomcat to run as a service under the classic init mechanism on unix/ linux (System V) since this will be available on all platforms, but you should consider using Upstart, a more modern init mechanism that will be available on most modern unix/ linux distributions. Installation using upstart is widely covered on the web. Further, at some versions of tomcat, on certain unix/ linux versions, a complete tomcat installation can be performed using a few simple package commands. Before you begin, a web search for tomcat installation at the desired version of tomcat, on the installed version of your unix/ linux distribution, may give you a much simpler installation method. However you install tomcat, please note the settings that are needed under configuring tomcat |
Download
The System Administrator should have set up a linked directory structure like [c:]/opt/tomcat. The details of this may differ between installations so from this point on, the “root” tomcat directory will be referred to as $TOMCAT.
...
| Note | ||
|---|---|---|
You do not need to read this note to complete the tomcat configuration; these notes are provided for a reference of why we have recommended certain settings in the connection configuration. Compression
Turning compression on reduces the amount of data passed between a client (i.e. a web browser on someone's computer), so this setting should improve the performance of the PhixFlow front end, especially if users are going to access the front end over a slow connection. |
web.xml: Session timeout, secure flag on cookies
The default session timeout period is 30 minutes. You can change this to a different period e.g. 12 hours (720 minutes) by doing the following:
...
| Code Block | ||
|---|---|---|
| ||
<session-config>
<session-timeout>720</session-timeout>
</session-config> |
If you are going to set up an encypted connection to PhixFlow, i.e. access via HTTPS (see Configure tomcat for HTTPS), you may also want to set the secure flag on cookies. This is a further security measure that reduces the risk of the cookies that PhixFlow creates being maliciously used to gain unauthorised access, and is a commonly used setting for web applications (https://www.owasp.org/index.php/SecureFlag). To do this, add a <cookie-config> block to the <session-config> block in the web.xml file, as in the example below:
| Code Block |
|---|
<session-config>
<session-timeout>720</session-timeout>
<cookie-config>
<http-only>true</http-only>
<secure>true</secure>
</cookie-config>
</session-config> |
Pre-installed Web Applications
...