Tomcat日志出现HTTP请求头解析错误，求修复方案

错误日志 #

2024-03-05 11:22:02.633 [http-nio-8081-exec-1] INFO  [] o.a.coyote.http11.Http11Processor@log(175) - 解析HTTP请求头出错
注意：后续的HTTP请求解析错误将以DEBUG级别记录。
java.lang.IllegalArgumentException: 在方法名称中发现无效字符 [0x160x030x010x01,0x010x000x01(0x030x030x940xb7e0xc70xd4X=0xe10xfa0x900xb5A0xf7I0xb60xeb0xaf|0x130xe50xa70x04zo0x0dIy0xb80xc9=0x15p0x000x000xaa0xc000xc0,0xc0(0xc0$0xc00x140xc00x0a0x000xa50x000xa30x000xa10x000x9f0x00k0x00j0x00i0x00h0x0090x0080x0070x0060x000x880x000x870x000x860x000x850xc020xc0.0xc0*0xc0&0xc00x0f0xc00x050x000x9d0x00=0x0050x000x840xc0/0xc0+0xc0'0xc0#0xc00x130xc00x090x000xa40x000xa20x000xa00x000x9e0x00g0x00@0x00?0x00>0x0030x0020x0010x0000x00E0x00D0x00C0x00B0xc010xc0-0xc0)0xc0%0xc00x0e0xc00x040x000x9c0x00<0x00/0x000x070xc00x110xc00x070xc00x0c0xc00x020x000x050x000x040xc00x120xc00x080x000x160x000x130x000x100x000x0d0xc00x0d0xc00x030x000x0a0x000x150x000x120x000x0f0x000x0c0x000x090x000xff0x010x000x00U0x000x0b0x000x040x030x000x010x020x000x0a0x000x1c0x000x1a0x000x170x000x190x000x1c0x000x1b0x000x180x000x1a0x000x160x000x0e0x000x0d0x000x0b0x000x0c0x000x090x000x0a0x00#0x000x000x000x0d0x00 ]。HTTP方法名称必须是合法令牌
    at org.apache.coyote.http11.Http11InputBuffer.parseRequestLine(Http11InputBuffer.java:407)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:264)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:896)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1744)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
    at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.base/java.lang.Thread.run(Thread.java:1583)

错误原因 #

日志里的0x16是TLS握手协议的起始标识，说明客户端向Tomcat的HTTP端口（此处为8081）发送了HTTPS请求。Tomcat的HTTP端口仅能处理明文HTTP请求，无法解析加密的HTTPS流量，因此抛出请求头解析错误。

修复方案 #

• 修正客户端请求地址：检查发起请求的客户端，确认是否误将http://写成https://（比如访问https://xxx:8081），改成http://xxx:8081即可解决问题。
• 配置Tomcat的HTTPS端口：如果业务需要该端口支持HTTPS，需在Tomcat的conf/server.xml中配置SSL Connector，示例配置如下：

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

配置完成后，客户端通过https://xxx:8443访问即可，同时确保已生成有效的SSL证书并配置正确的keystore路径。

• 临时兼容（不推荐，有安全风险）：如果只是临时需要绕过解析限制，可在HTTP Connector中添加relaxedQueryChars或relaxedPathChars参数，但这无法解决HTTPS请求打HTTP端口的核心问题，且可能引入安全隐患，不建议长期使用。

内容的提问来源于stack exchange，提问作者Nunyet Calçada