Preventing access to war file without using .htaccess / apache conf

Currently when I deploy a war file to Tomcat it can be downloaded from the URL via something like foo.com/myapp.war.

Most places recommend that you put an entry in a .htaccess file to prevent public access to any war files, or failing that an equivalent entry in your Apache config.

Unfortunately, my host does not provide access to the Apache config (although I can access Tomcat confs) and .htaccess files do not work for all Tomcat/Java related hosting environments开发者_StackOverflow社区. Pretty disappointing. They have been rather unhelpful in this respect.

Without resorting to something like "finding another host" (other than this issue they are fine - I'd rather stay here until my app grows too big), is there anything else I can do to prevent public users accessing my war files, yet still allow Tomcat to deploy the apps when it scans them?

For example, is it possible to specify one directory for Tomcat to scan for war files yet have it deploy the war into the public directories?

Thanks.

---

It is probably better to ask at https://serverfault.com/. It all boils down to how Tomcat is setup.

The vanilla setup will have a folder called webapps under CATALINE_HOME. You put your WAR archives there (they get auto-extracted and deployed). These folders will not be accessible from HTTP (you cannot download WAR archives from some URL like /webapps/my-test.war). These apps in webapps folder are deployed to some context roots. For example an application my-test.war will by default get deployed as yourhost.com/my-test/.

If you can download your WAR archives from foo.com/myapp.war maybe you can check out what does the CATALINA_HOME/webapp/ROOT app is doing. By default this is deployed under the foo.com. Ask from the host the Tomcat configuration files to figure what kind of custom configurations are they using.

---

You can place your .war files in any location Tomcat has access to. But you will have to tell Tomcat about it, so it picks them up. You can do this by placing a configuration XML file in

<CATALINA_HOME>/conf/Catalina/localhost/myWebapp.xml

There are samples on what to put into that file myWebapp.xml, e. g. here, step "4)". And of course, the official documentation.