Restrict access to Tomcat 9 manager

To prevent access to the Tomcat 9 Manager to all IPs except those authorized, it is necessary to configure the file context.xml of the manager application.

The file should be found in the following path:


Edit the file and add the “Valve” node inside the “Context” node specifying the IP you are allowed to access (allow attribute), like this:

<?xml version="1.0" encoding="UTF-8"?>

<Context antiResourceLocking="false" privileged="true" >
  <Valve className="org.apache.catalina.valves.RemoteAddrValve"
         allow="||321.321.321.321" />
  <Manager sessionAttributeValueClassNameFilter="java\.lang\.(?:Boolean|Integer|Long|Number|String)|org\.apache\.catalina\.filters\.CsrfPreventionFilter\$LruCache(?:\$1)?|java\.util\.(?:Linked)?HashMap"/>

Leave a Comment

Your email address will not be published. Required fields are marked *