Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to protect a certain folder within a web application of mine from access from outside of an defined IP range.

With O'Reilly's Tomcat Tips I figured that:

<Context path="/path/to/secret_files" ...>
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="" deny=""/>

Is the way to go?

I'm not that much into tomcat configuration so I'm dazzled a little as to where to put these restrictions. Do I put this Within my web.xml or is this a thing I need to add to some general tomcat conf file?

share|improve this question

If we want to restrict ip adresses irrespective of the context path we should add the following line in server.xml( Engine name)

 <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow=""/>

This will deny all the ip adresses except

If you want to aloow multiple ip's use the following

<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow=",,10.132.12"/>

And if you want to deny from only one ip and allow all other ip's use the following

 <Valve className="org.apache.catalina.valves.RemoteAddrValve" deny=""/>

For multiple ip's

<Valve className="org.apache.catalina.valves.RemoteAddrValve" deny=",,10.132.12"/>
share|improve this answer
It looks like you forgot to include what changes need to be made, you only made reference to them. – Scott Pack Nov 19 '11 at 0:10

This SO question solved my problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.