I have had my new web application online for just about a week and have seen a host of attacks run against it already. Of all the attacks that I have logged, 75% of them are using the IP address of the server and not the domain name. Can I configure tomcat to listen to www.mydomain.com and mydomain.com (through an alias) such that all other requests are dropped?
What does tomcat normally do with unmatched requests?
I simply want to only server content to legitimate traffic request.getServerName().indexOf("mydomain.com") >= 0.
I can write a servlet filter no problem, just don't want to add extra junk that is already implemented and just needs enabled/configured.
Can I do that with Tomcat?
I remember that with Apache, you can set a default virtual host, but I don't ever remember dropping requests that didn't match any of the virtual hosts listed in the configuration.