Tomcat Security

Security Configurations for Tomcat Applications

A Tomcat application can be protected by requiring user authentication, blocking selected client IP addresses, or applying both methods together.

In this article

Security Options

User authenticationRequires a valid username and password before the application can be opened.
IP address restrictionReturns an HTTP 403 response to clients whose addresses match the deny rule.
Combined protectionAuthentication and IP filtering can be enabled at the same time.

Configure User Authentication

1

Open Tomcat configuration

In the platform dashboard, click Config beside the Tomcat application server.

2

Add a Tomcat user

Open /opt/tomcat/conf/tomcat-users.xml and add the required username, password, and role.

<user username="test" password="test" roles="admin">
Tomcat users configuration
Add the Tomcat username, password, and role in tomcat-users.xml.
3

Add the security constraint

Open /opt/tomcat/conf/web.xml and define the protected URL pattern, permitted roles, authentication method, and realm name.

<security-constraint>
  <web-resource-collection>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>admin</role-name>
    <role-name>user</role-name>
  </auth-constraint>
</security-constraint>

<login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>Test Realm</realm-name>
</login-config>
Tomcat web.xml authentication configuration
Define the protected URL pattern and allowed roles in web.xml.
4

Save and restart Tomcat

Save both configuration files and restart the Tomcat application server.

Tomcat authentication prompt
Users are prompted for valid credentials before accessing the application.
!

Use strong credentials

Replace the example username and password with secure production values and assign only the roles required by the application.

Deny Client IP Addresses

1

Open the application context file

Click Config beside Tomcat and open /opt/tomcat/webapps/ROOT/META-INF/context.xml.

2

Add the IP deny rule

Add the Remote IP Valve and Remote Address Valve configuration, replacing {IP_address} with the client address to block.

<Context antiJARLocking="true" path="/">
  <Valve className="org.apache.catalina.valves.RemoteIpValve" />
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         deny="{IP_address}" />
</Context>
Tomcat context.xml IP deny configuration
Use RemoteAddrValve to block the specified client IP address.
✓

Public IP exception

When a public IP is attached directly to the environment, the RemoteIpValve line can be omitted.

3

Save and restart Tomcat

Save context.xml and restart the Tomcat server.

HTTP 403 access denied response
A blocked client receives an HTTP 403 access-denied response.

Expected Result

The Tomcat application requires valid credentials, rejects selected client IP addresses, or applies both controls according to the configured security policy.

Important Notes

  • Back up Tomcat configuration files before editing them.
  • Restart Tomcat after saving the changes.
  • Use strong passwords instead of the example credentials.
  • Keep role names consistent between tomcat-users.xml and web.xml.
  • Confirm whether traffic reaches Tomcat through a proxy or through a direct public IP before configuring RemoteIpValve.
  • Test security rules from an allowed and a blocked client before production use.

Common Issues and Solutions

Authentication prompt does not appearCheck the protected URL pattern, role names, XML syntax, saved files, and whether Tomcat was restarted.
Valid credentials are rejectedEnsure the user role in tomcat-users.xml matches one of the roles in web.xml.
Wrong IP is blockedReview proxy handling and confirm whether RemoteIpValve is required for the selected network path.
All visitors receive HTTP 403Check the deny pattern and replace broad or incorrect values with the intended client address.
Tomcat fails to startRestore the previous configuration and validate the XML structure for syntax errors.

Related Guides