English

How To: Disable Directory Listing for Apache Tomcat Context (Virtual Directory)

Summary

Instructions provided describe how to disable Directory Listing (Directory Browsing) in Apache Tomcat Context (Virtual Directory).

Procedure

When Apache Tomcat is installed, directory listing is enabled by default. This can be a very useful debugging tool, but for production deployments, this should be turned off.

Note:
Apache Tomcat uses the term Directory Listing instead of Directory Browsing as in Microsoft Internet Information Services (IIS), and it uses the term Context instead of Virtual Directory.

  • Method 1

    Create a blank index.html file and put this index.html file in the docBase folder, which prevents the directory from appearing.

  • Method 2

    Edit the global web.xml file to turn off the option.

    Warning:
    This is the global web.xml file, which means that any changes here will affect ALL Web applications deployed by that Tomcat instance. If more granular control is desired, like turning it off for certain applications but not for others, the first method of creating index.html files should be implemented.

    The parameter for this Directory Listing is in the web.xml definition of the default servlet, which is what is generating those directory listings. The default web.xml file is in the conf directory.

    1. Edit the following file with a text editor, such as Notepad.

    <CATALINA_HOME>\conf\web.xml

    2. Search for the following tag:

    Code:
    <init-param>
    <param-name>listings</param-name>
    <param-value>true</param-value>
    </init-param>


    3. Change the param-value associated with the init-param named listings from true to false. The new tag should look like the tag below:

    Code:
    <init-param>
    <param-name>listings</param-name>
    <param-value>false</param-value>
    </init-param>


    4. Restart Tomcat.

Related Information