Documented: Possible authenticated attack related to Tomcat CVE-2020-1938
Explains that the current AJP config works only for localhost
@@ -82,6 +82,7 @@ under the License.
https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31
and
https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Connectors
+ Long story short, with this configuration only locahost works...
-->
<!-- <property name="secretRequired" value="false"/>
<property name="allowedRequestAttributesPattern" value=".*"/> -->
