Tomcat Referrer Lockdown

Question

I know using referrer is a bad idea but I need a quick fix to lockdown content inside a folder on a tomcat application this is just the temp fix until we can get a long term one in place.

I would like to use the referrer header to block off site linking to one directory. I need to do this directly in Tomcat if possible.

Thanks for any help.

Answer 1

The HTTP Referer header is spoofable, trivially, I might add. I would advise against this approach. A better (more secure) way to lock down access to a folder in your web application is to add a <security-constraint> in your WEB-INF/web.xml.

If you want to restrict by client IP address, you could use the Remote Address Filter Valve.