This question is an ongoing discussion at work. Assume a Tomcat serving some web application and has all JMX and remote management stuff disabled. If you consider three scenarios:

  1. Tomcat serves directly to the internet.
  2. Apache Webserver serves to the internet, Tomcat is connected via AJP
  3. Apache Webserver acts as a proxy between Tomcat and the internet.

Which one would you consider the most secure and why?


My vote would be number 3, with number 2 as a close second. I suppose it depends on the rest of your infrastructure. To my knowledge, AJP doesn't support encryption between hosts.

Number 3 allows you to implement an N Tiered architecture. Ideally the Apache server would be parsing/URL filtering for malicious traffic and not blindly proxying all requests to the Tomcat server.

There is a fairly decent article (with comments) here: https://communities.bmc.com/community/bmcdn/bmc_atrium_and_foundation_technologies/bmc_remedy_ar_system/blog/2013/12/20/the-pulse-why-should-i-use-a-web-server-to-front-tomcat

Even with that being said, there still seems to be some confusion as to whether Tomcat is a Webserver, an Appserver, or both! There are conflicting answers for this question.

If it were me, I'd still choose number 3 based on the above.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.