How to avoid directory listing?

[Jeppe Sommer]

If the users types in an url for a directory ( like http://www.myDomain.com/myApp/dir/ ) tomcat displays the directory listing.

How can I deny permission for the users to see the directory listing. Is it possible to control it in the server.xml?

[Gerardo Tasistro]

It is done in the web.xml. Go to conf/web.xml in your tomcat install. Looke for the following code and replace true for false

       
  <init-param>
 
            <param-name>listings</param-name>
 
            <param-value>true</param-value>
  </init-param>
  

As shown below

  
    <servlet>
 
        <servlet-name>default</servlet-name>
 
        <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
 
        <init-param>
 
            <param-name>debug</param-name>
 
            <param-value>0</param-value>
 
        </init-param>
 
        <init-param>
 
            <param-name>listings</param-name>
 
            <param-value>false</param-value>
 
        </init-param>
 
        <load-on-startup>1</load-on-startup>
 
    </servlet>
 
  

[Jason Moors]

You need to change the Default servlet listing parameter in $CATALINA_HOME/conf/web.xml

    
    <servlet>
        <servlet-name>default</servlet-name>
        <servlet-class>
          org.apache.catalina.servlets.DefaultServlet
        </servlet-class>
        <init-param>
            <param-name>debug</param-name>
            <param-value>0</param-value>
        </init-param>
        <init-param>
            <param-name>listings</param-name>
            <param-value>[B]false[/B]</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

[Jeppe Sommer]

Thank you. That works :-)