title: Forcing SSL on websockets and Tomcat With Spring using Safari bug
body: <p>We have an app using websockets with Spring on Tomcat 8.5</p>
  
  <p>We are seeing problems using this combination of things</p>
  
  <ul>
  <li>Forcing SSL connection in tomcat using <code>&lt;security-constraint&gt;</code> in context.xml</li>
  <li>Using spring 4.2.6+</li>
  <li>browsing from Safari.</li>
  </ul>
  
  <p>The problem we're running into is this one.</p>
  
  <p><a href="https://stackoverflow.com/questions/34679134/websocket-safari-9-invalid-utf-8-sequence-in-header-value">WebSocket - Safari 9 - Invalid UTF-8 sequence in header value</a></p>
  
  <p>Essentially Safari is getting an empty Expires header sent to it.  The reason why it is empty is due to SPR-14053 which introduced resetting the Expires Header when caching is configured. </p>
  
  <p><a href="https://github.com/spring-projects/spring-framework/issues/18625" rel="nofollow noreferrer">https://github.com/spring-projects/spring-framework/issues/18625</a></p>
  
  <p>What is happening is that in Tomcat when using  and not disabledProxyCaching, Tomcat sets and Expires Header</p>
  
  <p><a href="https://github.com/apache/tomcat/blob/8.5.x/java/org/apache/catalina/authenticator/AuthenticatorBase.java#L508" rel="nofollow noreferrer">https://github.com/apache/tomcat/blob/8.5.x/java/org/apache/catalina/authenticator/AuthenticatorBase.java#L508</a></p>
  
  <p>I believe because the Header was previously set by Tomcat, instead of removing the Expire header from the response, it's simply set to blank, which causes the problems in safari.</p>
  
  <p>I know i can workaround this, my question is, where should the fix for this lie?  Should this be filed against Safari, Spring or Tomcat's bug list?</p>