How to avoid list files under jsp directory on Tomcat 4.x?

Michael Dean

Additional Info
How can I configure server.xml and/or web.xml file so that it can prevent user to explore my jsp directory when entering URL like: http://localhost:8080/jsp
In Tomcat 4.x, the Default Servlet serves static content. The Tomcat Functional Specifications require that implementations accept several parameters--including one that indicates whether to provide directory listings when a directory without welcome files is requested.

To suppress directory listings in Tomcat 4, set the value of the servlet's initialization parameter listings to false in Tomcat's default deployment descriptor ($CATALINA_HOME/conf/web.xml). Below is Tomcat's default definition for the default servlet with directory listings disabled:

Note, however, if you are using a separate web server (like Apache or IIS) with Tomcat, you will need to change the settings for the web server instead.

Note: for Tomcat 3.x, check this faq