This question is an ongoing discussion at work. Assume a Tomcat serving some web application and has all JMX and remote management stuff disabled. If you consider three scenarios:

  1. Tomcat serves directly to the internet.
  2. Apache Webserver serves to the internet, Tomcat is connected via AJP
  3. Apache Webserver acts as a proxy between Tomcat and the internet.

Which one would you consider the most secure and why?

1 Answer 1


My vote would be number 3, with number 2 as a close second. I suppose it depends on the rest of your infrastructure. To my knowledge, AJP doesn't support encryption between hosts.

Number 3 allows you to implement an N Tiered architecture. Ideally the Apache server would be parsing/URL filtering for malicious traffic and not blindly proxying all requests to the Tomcat server.

There is a fairly decent article (with comments) here: https://communities.bmc.com/community/bmcdn/bmc_atrium_and_foundation_technologies/bmc_remedy_ar_system/blog/2013/12/20/the-pulse-why-should-i-use-a-web-server-to-front-tomcat

Even with that being said, there still seems to be some confusion as to whether Tomcat is a Webserver, an Appserver, or both! There are conflicting answers for this question.

If it were me, I'd still choose number 3 based on the above.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .