How to avoid list files under jsp directory on Tomcat 4.x?

Created Oct 31, 2002

Michael Dean

Additional Info
How can I configure server.xml and/or web.xml file so that it can prevent user to explore my jsp directory when entering URL like: http://localhost:8080/jsp
In Tomcat 4.x, the Default Servlet serves static content. The Tomcat Functional Specifications require that implementations accept several parameters--including one that indicates whether to provide directory listings when a directory without welcome files is requested.

To suppress directory listings in Tomcat 4, set the value of the servlet's initialization parameter listings to false in Tomcat's default deployment descriptor ($CATALINA_HOME/conf/web.xml). Below is Tomcat's default definition for the default servlet with directory listings disabled: 


    <servlet>
        <servlet-name>default</servlet-name>
        <servlet-class>
          org.apache.catalina.servlets.DefaultServlet
        </servlet-class>
        <init-param>
            <param-name>debug</param-name>
            <param-value>0</param-value>
        </init-param>
        <init-param>
            <param-name>listings</param-name>
            <param-value>false</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
Note, however, if you are using a separate web server (like Apache or IIS) with Tomcat, you will need to change the settings for the web server instead.

Note: for Tomcat 3.x, check this faq

Comment and Contribute

 

 

 

 

 


(Maximum characters: 1200). You have 1200 characters left.