This question is an ongoing discussion at work. Assume a Tomcat serving some web application and has all JMX and remote management stuff disabled. If you consider three scenarios:
- Tomcat serves directly to the internet.
- Apache Webserver serves to the internet, Tomcat is connected via AJP
- Apache Webserver acts as a proxy between Tomcat and the internet.
Which one would you consider the most secure and why?