tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Christopher Schultz <ch...@christopherschultz.net>
Subject Re: Tomcat5,Apache2,mod_ssl and mod_jk
Date Thu, 16 Nov 2006 14:10:30 GMT
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Marx,

Marx wrote:
> One more information, everything works ok if I use directive <Location>,
> bu I want to be more secure and I want to use <Directory>
> Marx

This isn't going to work for you. You can't rely on Apache httpd's
<directory> protections to protect directories what Tomcat is reading.
Since Tomcat is intercepting the request, Apache httpd cannot check the
directory where the JSP is being loaded from, etc.

You have two choices: either use <Location> from within Apache httpd, or
implement cert-based authorization in Tomcat for those URLs you want to
protect.

- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFXHFV9CaO5/Lv0PARAjLjAKCgELL7a5MzcxIcoxHkkjoVeFFvYACeIucI
kQHIxRKArAMnMzE4jVYnWNw=
=+05X
-----END PGP SIGNATURE-----

---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Mime
View raw message