Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a Tomcat 6.0.35 service with a SOAP based webapp protected by Digest Authentication. We are seeing issues with various users getting repeated 401 responses since we upgraded to 6.0.35. Additionally we are getting the following entries in Catalina log:

WARNING: A valid entry has been removed from client nonce cache to make room for 
new entries. A replay attack is now possible. To prevent the possibility of 
replay attacks, reduce nonceValidity or increase cnonceCacheSize. Further 
warnings of this type will be suppressed for 5 minutes.

Any idea what is going on?

share|improve this question

The "Digest Authenticator Valve" for Tomcat 6.0.35 supported the following attribute:

cnonceCacheSize -> To protect against replay attacks, the DIGEST authenticator tracks client nonce and nonce count values. This attribute controls the size of that cache. If not specified, the default value of 1000 is used.

Tomcat 6.0.36 (released on Oct 19, 2012) contains the following changes regarding Digest Authentication (extracted from Tomcat changelog):

Various improvements to the DIGEST authenticator including 52954, the disabling caching of an authenticated user in the session by default, tracking server rather than client nonces and better handling of stale nonce values.

I'd suggest you give Tomcat 6.0.36 a try, since it includes varios improvements related to Digest authentication. Also take a look at the "Digest Authenticator Valve" configuration options.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.