# Cis Tomcat101 10.7

> Turn off session facade recycling (Manual)

- Skill: `cyberstrikeus/cis-tomcat101-10-7` (Agent Skill)
- Install (CLI): `npx skillmds@latest add cyberstrikeus/cis-tomcat101-10-7`
- Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/cis-tomcat101-10-7/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/cyberstrikeus/cis-tomcat101-10-7

---


# 10.7 Turn off session facade recycling (Manual)

## Description

The `RECYCLE_FACADES` can specify if a new facade will be created for each request. If a new facade is not created there is a potential for information leakage from other sessions.

## Rationale

When `RECYCLE_FACADES` is set to `false`, Tomcat will recycle the session facade between requests which may result in information leakage.

## Audit Procedure

Ensure `-Dorg.apache.catalina.connector.RECYCLE_FACADES=true` is added to the startup script which, by default, is located at `$CATALINA_HOME/bin/catalina.sh`.

## Remediation

Start Tomcat with `RECYCLE_FACADES` set to `true`. Add `-Dorg.apache.catalina.connector.RECYCLE_FACADES=true` to your startup script.

## Default Value

The default value is `false`.

## References

1. https://tomcat.apache.org/tomcat-9.0-doc/config/systemprops.html
2. https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html

## CIS Controls

| Controls Version | Control                                                                                                                                                                                                                                                                                                                                                                                                                                        | IG 1 | IG 2 | IG 3 |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 16.7 Use Standard Hardening Configuration Templates for Application Infrastructure<br>Use standard, industry-recommended hardening configuration templates for application infrastructure components. This includes underlying servers, databases, and web servers, and applies to cloud containers, Platform as a Service (PaaS) components, and SaaS components. Do not allow in-house developed software to weaken configuration hardening. |      | ●    | ●    |
| v7               | 5.1 Establish Secure Configurations<br>Maintain documented, standard security configuration standards for all authorized operating systems and software.                                                                                                                                                                                                                                                                                       | ●    | ●    | ●    |

## Profile

Level 1