I need to protect a certain folder within a web application of mine from access from outside of an defined IP range.

With O'Reilly's Tomcat Tips I figured that:

<Context path="/path/to/secret_files" ...>
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="" deny=""/>

Is the way to go?

I'm not that much into tomcat configuration so I'm dazzled a little as to where to put these restrictions. Do I put this Within my web.xml or is this a thing I need to add to some general tomcat conf file?


If we want to restrict ip adresses irrespective of the context path we should add the following line in server.xml( Engine name)

 <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow=""/>

This will deny all the ip adresses except

If you want to aloow multiple ip's use the following

<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow=",,10.132.12"/>

And if you want to deny from only one ip and allow all other ip's use the following

 <Valve className="org.apache.catalina.valves.RemoteAddrValve" deny=""/>

For multiple ip's

<Valve className="org.apache.catalina.valves.RemoteAddrValve" deny=",,10.132.12"/>
  • 1
    It looks like you forgot to include what changes need to be made, you only made reference to them. – Scott Pack Nov 19 '11 at 0:10

This SO question solved my problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.