Tomcat: Restrict access to localhost for /just one/ webapp

Question

I'm running Tomcat 6 to serve several web apps, most of which are public-facing. But I'd like to restrict access to just one webapp, allowing connections only from localhost.

I can restrict access for all webapps using a valve in context.xml, as described in:

• Tomcat Restrict access by IP address

But I can't figure out how to restrict access on a per-app basis. Is there a way to do this with my app's web.xml? Or by adding additional rules to context.xml?

Thanks,

-B

---

Recapping Solution:

$ cp /var/lib/tomcat6/conf/context.xml \ 
   /var/lib/tomcat6/conf/Catalina/localhost/my-app-name.xml

$ cat /var/lib/tomcat6/conf/Catalina/localhost/my-app-name.xml

<Context>
    <Valve className="org.apache.catalina.valves.RemoteHostValve" allow="localhost"/>
... {as previously} ...
</Context>

Answer 1

You can create an individual context.xml for you app.

This is an excerpt from Tomcat doc on context configuraion: Context elements may be explicitly defined:

• In the $CATALINA_HOME/conf/context.xml file: the Context element information will be loaded by all webapps. In the $CATALINA_HOME/conf/[enginename]/[hostname]/context.xml.default file: the Context element information will be loaded by all webapps of that host.
• In individual files (with a .xml extension) in the $CATALINA_HOME/conf/[enginename]/[hostname]/ directory. The name of the file (less the .xml) extension will be used as the context path. Multi-level context paths may be defined using #, e.g. foo#bar.xml for a context path of /foo/bar. The default web application may be defined by using a file called ROOT.xml.
• Only if a context file does not exist for the application in the $CATALINA_HOME/conf/[enginename]/[hostname]/; in an individual file at /META-INF/context.xml inside the application files. If the web application is packaged as a WAR then /META-INF/context.xml will be copied to $CATALINA_HOME/conf/[enginename]/[hostname]/ and renamed to match the application's context path. Once this file exists, it will not be replaced if a new WAR with a newer /META-INF/context.xml is placed in the host's appBase.