Tomcat4/Apache2 are allowing unwanted requests to come through....!?!?!

vous · 03-26-2005, 07:16 AM

Hello All,

I want to prevent Tomcat from displaying the file system contents, BUT I want it to be able to path to a webapp called /counter.

So what I mean is that I would like people to access the webapp: /counter, but I DON'T want to them to be able to type in their browser:

http://<servername>/counter/images

and get to see all the images from the file system. Obviously I want to be able to serve the images that tomcat will use to build the pages...just not straight from the URL as requested by an external user.

--->This is my setup:

My setup is:

Apache2 ---> Apache/TomcatJK2 Connector---> Tomcat4

So either answer, be it from the Apache2 Gurus or the Tomcat4 Gurus can help...

1) How can I block this from within Apache2?

2) How can I block this from within Tomcat4?

...and yet a 3rd option...

3) How can I block this from the JK2 connector (workers2.properties)?

Any thoughts?

vous · 03-26-2005, 08:29 AM

I have included this in the Apache conf:

<Directory />
AllowOverride None
</Directory>

<Directory />
Order Deny,Allow
Deny from all
</Directory>

Which prevents entry to the file system, BUT the connectors config has to allow entry to the /counter webapp:

[uri:/counter]
info=Counter webapp
context=/counter
debug=0

[uri:/counter/servlet/*]
info=Prefix mapping

[uri:/counter/*.jsp]
info=Extension mapping

[uri:/counter/*]
info=Map the whole counter webapp

So how do I prevent them from navigating through the whole /counter dir?

megaspaz · 03-26-2005, 09:31 AM

why don't you just put in an index.html file in that image directory? that way, if someone types in the url like you showed, that webpage will show up instead. you can't really expect much though, as someone can still get to your images by viewing the source of whatever page tomcat shows up, but it will stop tomcat from doing an index listing of the contents of the directory.

vous · 04-09-2005, 12:55 PM

There has to be a more professional/technical way to solve this problem?

Any other thoughts??

phil.d.g · 04-09-2005, 02:05 PM

Code:

<Directory /path/to/picture/dir>
  Options -Indexes
</Directory

Alternatively you can put

Code:

Options -Indexes

In .htaccess file if your server is set up to allow .htaccess files

If they go to that directory they will get a "you don't have permission to access this directory"