title: tomcat 8.5 "socket write error" with spring-security and CXF
body: <p>I have a web app which is CXF SOAP service, secured by spring security using basic auth.</p>
  
  <p>Security config:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          .authorizeRequests()
          .anyRequest().authenticated()
          .and().httpBasic()
          .and().csrf().ignoringAntMatchers("/ws/**");
  }
  </code></pre>
  
  <p>App is deployed on tomcat 8.5.11, authentication is OK, SOAP service is OK but I noticed that, if request body is larger (2MB), client (SOAPUI) does not get server's response but it throws:</p>
  
  <pre><code>ERROR:java.net.SocketException: Connection reset by peer: socket write error
  java.net.SocketException: Connection reset by peer: socket write error
  </code></pre>
  
  <p>Problem is if basic authentication is not performed preemptively. If request hasn't got BASIC auth header, tomcat breaks instead of sending 401 response. If BASIC auth header is present, everything is OK, request is processed and response is sent. It looks like problem is in negotiating auth method - client first try without auth then server replies it expects basic auth then client sends appropriate auth header. It works for small payloads but if payload is more then 2MB (roughly), tomcat breaks on the first (unauthenticated) request, silently without any trace in logs.</p>
  
  <p>It is interesting that the same app works in Jetty maven plugin.</p>
  
  <p>Is there any config in the Tomcat that could control this behavior? Tomcat should reply 401 if there is no BASIC auth header regardless of the request size. As it is now, tomcat tries to read entire request body even if the request is not authenticated. </p>