I have a spring boot web app deployed on Tomcat 7.0.75 that we recently secured with https, having the following server.xml:
<Connector port ="8443" protocol ="HTTP/1.1" SSLEnabled ="true" maxThreads ="50" server ="web" allowTrace ="false" keystoreFile ="/app/certs/keystore.jks" keystorePass ="wouldntYouLikeToKnow" scheme ="https" secure ="true" clientAuth ="false" sslProtocol ="TLS" sslEnabledProtocols ="TLSv1.1,TLSv1.2" ciphers ="TLS_...SHA" maxSwallowSize ="-1" connectionTimeout ="20000" maxKeepAliveRequests ="100" socket.soKeepAlive ="true"/>When we went to https, requests having large (multiple MB) json response bodies started yielding an odd warning message in Chrome after reporting a 200 OK response code. IE also fails to download the response fully.
It just keeps showing that warning forever and never completes the download. Small requests work fine. From a client perspective, the request has not yet completed, since neither the success function nor the error function for the https call executes. As shown, the time to first byte (TTFB) is relatively fast, but a large amount of the time is spent during download and it never leaves that phase. Tomcat evidently has kept the http connection open and the client is still expecting data, because when I close the browser, Tomcat reports a socket closed error. Does anyone have an idea of what is going on and why the large response download never completes over https, but works fine over http?
Edit 1Here is the curl command and response invoked from Linux.
curl -X GET https://host.com/context -H 'accept: application/json,text/plain, */*' -H 'cache-control: no-cache' -H 'token: 12acdee7-ef76-4147-98d2-d90e4414d4e6' -H 'user-name: vn62253' -H 'user-security-id: 1'-k -IHTTP/1.1 200 OKAccess-Control-Allow-Origin: *Access-Control-Allow-Credentials: trueAccess-Control-Allow-Methods: POST, PUT, GET, HEAD, OPTIONS, DELETEAccess-Control-Expose-Headers: Content-disposition, Content-TypeAccess-Control-Allow-Headers: Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, User-Security-Id, Token, User-Name, Client-TZ-OffsetX-Application-Context: Compliance_WS:8765Content-Type: application/json;charset=UTF-8Transfer-Encoding: chunkedVary: Accept-EncodingDate: Tue, 29 Aug 2017 14:33:47 GMTServer: web