# Server.xml Configuration in Tomcat 3.3

## General configuration

Tomcat 3.3 is implemented using a set of modules. Each module has a number of settable properties and implements one or more 'hooks', providing a piece of functionality.

The modules can be configured and assembled in several ways, but the default and most flexible mechanism uses XML files. Each module is described by an XML element, with attributes used to set module properties. The main configuration file is located in `TOMCAT_HOME/conf/server.xml`, used to configure the server. Additional `TOMCAT_HOME/conf/server-name.xml` files will be read after `server.xml`, allowing local configurations.

### Variable substitution

In Tomcat 3.3.1, each attribute value may use the ant-style variable substitution by using "${variable}" in the attribute string, i.e. attribute="text${variable}text". (Note: A bug prevented this from working in Tomcat 3.3.)

The variable must specify a ContextManager property or System property, with ContextManager properties taking precedence. If a matching property isn't found, the attribute string is left as is. Note that the properties are not the same as attributes, and attributes are not accessible via variable substitution.

There are two predefined ContextManager properties, "`tomcat.home`" and "`tomcat.install`". These correspond to the ContextManager `home` and `installDir` attributes, respectively. There are three methdos for setting additional ContextManager properties.

1. Include a `name="value"` specification on the ContextManager element in `server.xml`, where name doesn't correspond to a ContextManager attribute. For example:

           <ContextManager ... my.prop="myvalue" ... >

2. Include a `Property` element within the scope of the ContextManager element in `server.xml`. For example:

           <ContextManager ... >
               <Property name="my.prop" value="myvalue" />
               ...
           </ContextManager>

   This form of setting properties is logged if the ContextManager's debug level is one or greater.
3. Include "`-name value`" as command line arguments, where name doesn't match any of the arguments supported by the "start" task. For example:

           bin/startup -my.prop myvalue

Note: The property values may themselves use "variable substitution", provided the specified property is already defined.

### Common Parameters

All modules have the following common attributes:

Attribute | Description | Default
--- | --- | ---
debug | Display debug information on the module execution | 0

## Configuration Elements

Server.xml is an XML document. Most elements correspond to Tomcat modules, with Java setters being automatically associated with element attributes. The javadoc will contain most details, in this document we focus on the common and supported behaviors.

## Parent Configuration Elements

The purpose of the server.xml is to define the configuration of an instance of the Tomcat 3.3 web server. The parent configuration elements in the server.xml file represent that instance.

### Server

This is the main element in server.xml. It has a single child describing the tomcat configuration, ContextManager.

#### Examples

    <Server>
       <ContextManager >
          ... ( tomcat configuration )
       </ContextManager>
    </Server>

### ContextManager

#### Description

This is the main tag, used to set generic Tomcat options. The following are some of the childen it supports:

<module_name>
  Adds a module to the configuration. Module names are defined in modules.xml, where each tag is associated with a class name that implements the module. Each element attribute corresponds to a setter method in the implementing class.
<Context>
  Defines a web application. This is a legacy method of specifying a web application. It is included for backward compatibility with older Tomcats. As a rule, applications should be defined in separate config files, named apps-name.xml. This way you can configure your web applications without modifying your server.xml file.
<Property name="property_name" value="property_value">
  Adds arbitrary name/values to ContextManager. The properties can be used for variable substitutions, instead of attributes.
<module name="module_name" javaClass="full.class.name">
  Adds a module to the configuration. All modules included in the standard distribution are defined in modules.xml, but you can define additional tags and their associated class in server.xml. This behaves like taskdef in ant.

#### Attributes

Attribute | Description | Default
--- | --- | ---
installDir | Base directory for tomcat installation. It is typically guessed by the startup program, but you can override it here. | TOMCAT_HOME or one level above the location of the startup script or tomcat.jar (if "java -jar" is used for startup).
workDir | Directory where temporary files will be created. Relative paths are interpreted as relative to TOMCAT_HOME. | work
home | Base directory for the tomcat instance. While 'install' is used to find the libraries, 'home' is used to resolve almost all relative paths - webapps, work, etc. | TOMCAT_HOME or the value guessed by the startup program.

#### Example(s)

    <ContextManager install="/opt/tomcat" workDir="/var/tomcat" home="/var" />

## Module Configuration Elements

It is the set of modules and their configuration that control the behavior of the Tomcat web server. By specifying which modules and their attributes, you have a lot of flexibility in controlling the features of your instance of Tomcat.

Note that "interceptor" is a name that used in the past, prior to the adoption of the name "module". It should be considered synonomous with "module". "Interceptor" will appear various in places, especially in module names and their classes.

The list of modules below is in alphabetical order. Functionally, they may be grouped as follows:

- Access, Authentication, and Authorization
  - AccessInterceptor
  - CredentialsInterceptor
  - JDBCRealm
  - SimpleRealm
- Configuration
  - ApacheConfig
  - AutoDeploy
  - AutoWebApp
  - ContextXmlReader
  - IISConfig
  - JservConfig
  - LoaderInterceptor11
  - LogSetter
  - MxInterceptor
  - NSConfig
  - PolicyLoader
  - TrustedLoader
  - WorkDirSetup
- Generators
  - ErrorHandler
  - InvokerInterceptor
  - Jdk12Interceptor
  - StaticInterceptor
- Servlet 2.2 Facade
  - WebXmlReader
  - JspInterceptor
  - Servlet22Interceptor
  - LoadOnStartupInterceptor
  - TagPoolManagerInterceptor
- Loggers
  - AccessLogInterceptor
  - LogEvents
- Mappers
  - DecodeInterceptor
  - ReloadInterceptor
  - SimpleMapper1
- Server
  - CoyoteConnector
  - Http10Connector
  - JniConnector
  - Ajp12Connector
  - Ajp13Connector
- Session
  - SimpleSessionStore
  - SessionIdGenerator
  - SessionExpirer
  - SessionId

### AccessInterceptor

Type: Access, Authentication, and Authorization

#### Description

Determines if security constraints specified in the web.xml apply to a request and provides the handling for BASIC and FORM authentication if necessary.

#### Attributes

Attribute | Description | Default
--- | --- | ---
ignoreCase | Enables case insensitive operation when matching a request to a security constraint. | false on Unix based systems true on Windows based systems

#### Example(s)

    <AccessInterceptor />

### AccessLogInterceptor

Type: Loggers

#### Description

Creates log files in the style of the Apache servers "AccessLog".

#### Attributes

Attribute | Description | Default
--- | --- | ---
logFile | Name of the log file. | logs/AccessLog
format | A string describing the logfile format. Possible values are "combined" (Apache httpd combined format, default), "common" (Apache httpd common format) or a format string like
            '%h %l %u %t "%r" %>s %b "%{Referer}" "%{User-Agent}"'
            '%h %l %u %t "%r" %>s %b'
(The above examples are used when "combined" or "common" format is requested.) Possible patterns are:
%% | The percent character itself
%{var} | The value of `request.getHeader("var")` or empty string for null.
%b | The value of `response.getContentLength()`.
%h | The value of `request.getRemoteHost()`.
%l | Should be the remote users name, as indicated by an identd lookup. Currently it is always "-".
%r | First line of the request submitted by the client, for example
                  GET /index.html?frame=main HTTP/1.0
The first line is rebuilt from the values of `request.getMethod()`, `request.getRequestURI()`, `request.getQueryString()` and `request.getProtocol()`. It should probably better be recorded while reading the headers.
%s | The value of `response.getStatus()`.
%>s | The value of `response.getStatus()`. Should differ between different internal requests, as Apache httpd does, but this is currently not supported.
%t | The current time and date in the format
                  [20/Apr/2001:19:45:23 0200]
%u | The value of `request.getRemoteUser()` or "-" for null..
| "combined" format

#### Example(s)

    <AccessLogInterceptor format="common" />

### Ajp12Connector

Type: Server

#### Description

Handles incoming Ajp12 requests. Ajp12 is a protocol used by the mod_jk based web server connectors and the mod_jserv connector. Also, used for shutting down Tomcat.

#### Attributes

Attribute | Description | Default
--- | --- | ---
ajpidFile | File in which to record Ajp12 connector info and password. In Tomcat 3.3.1 this setting can be overridden by a ContextManager property named "ajpid12". Such a property would normally be set using command line arguments. | conf/ajp12.id
secret | The desired shutdown password. | not specified
tomcatAuthentication | Enables Tomcat's authentication, ignoring any authentication from the web server sending the requests. | true
useSecret | Enables use of a random number as the shutdown password. | false
Socket Properties |  |
address | Address to which the server socket binds. | null, bind on all addresses
backlog | Maximum length of the backlog queue for the server socket. | 100
port | Port on which to receive requests. | no default, must be specified
Thread Pool Properties |  |
maxThreads | Maximum number of threads in Thread pool. | 200
maxSpareThreads | Maximun number of spare threads. Unused threads will be terminated as needed to keep the number of spare threads under this number. | 50
minSpareThreads | Minimum number of spare threads. Additional threads will be created as needed to keep the number of spare threads up to this number. | 4
pools | Enables use of a Thread pool. | true

#### Example(s)

    <Ajp12Connector port="8007" ajpidFile="conf/ajp12_2.id" />

#### Additional note:

If using Ajp12Connector to shutdown Tomcat, the minimum of 2 threads have to be configured, or the shutdown will not be successful. Default configuration (no maxThreads) configures more then 2 threads and should work fine.

You need two threads since one is always supposed to be listening, and the other does the actual shutting down. Since the shutdown thread tries to unblock the listening thread, it hangs if there isn't anyone listening.

### Ajp13Connector

Type: Server

#### Description

Handles incoming Ajp13 requests. Ajp13 is a protocol used by the mod_jk based web server connectors.

In Tomcat 3.3.1, some attributes were added for supporting password protected shutdown using Ajp13. This feature is actived by setting the `shutdownEnable` to `true`, or setting a password using the `secret` or `useSecret` attributes. Also, if a password is set, authentication of Ajp13 connections can also be performed. This feature requires the `authenticateRequests` attribute be set `true` in addition to a password, and the mod_jk based connector support this feature. The connectors available with Tomcat 3.3.x do not support this feature. Connectors that do support this feature will be made available through the jakarta-tomcat-connectors project.

#### Attributes

Attribute | Description | Default
--- | --- | ---
ajpidFile [Tomcat 3.3.1] | File in which to record Ajp13 connector info and password. This setting can be overridden by a ContextManager property named "ajpid13". Such a property would normally be set using a command line argument. | conf/ajp13.id
authenticateConnection [Tomcat 3.3.1] | If true and a password has been set, password checking is performed on the first Ajp13 request of a newly opened connection. If the password doesn't match, the request is ignored and the connection closed. If they match, the connection is "authenticated" and the current and future requests on that connection are processed normally. If false or a password isn't set, password checking of the Ajp13 connection is disabled. The password is set using either the `secret` or `useSecret` attributes. This feature also requires a mod_jk based connector that supports sending the password. The connectors available with Tomcat 3.3.x do not support this feature. | false
secret [Tomcat 3.3.1] | The desired shutdown password. If set, the `shutDownEnable` attribute is automatically set `true`. The password can also be used for authentication of Ajp13 connections if supported by the mod_jk based connector. The connectors supplied with Tomcat 3.3.x do not support this feature. | not specified
shutDownEnable shutdownEnable [Tomcat 3.3.1] | Enable shutdown signal via this connector. This attribute is automatically set `true` if a password is set using the `secret` or `useSecret` attributes. | false
tomcatAuthentication | Enables Tomcat's authentication, ignoring any authentication from the web server sending the requests. This means that the user returned by HttpServletRequest.getRemoteUser() will be the user authenticated locally within Tomcat. If you are using Tomcat with a web server, such as Apache, and you want to use the user authenticated by the web server, set this attribute `false`. | true
useSecret [Tomcat 3.3.1] | Enables use of a random number as the shutdown password. If set, the `shutDownEnable` attribute is automatically set `true`. The password can also be used for authentication of Ajp13 requests if supported by the mod_jk based connector. The connectors supplied with Tomcat 3.3.x do not support this feature. | false
Socket Properties |  |
address | Address to which the server socket binds. | null, bind on all addresses
backlog | Maximum length of the backlog queue for the server socket. | 100
port | Port on which to receive requests. | no default, must be specified
Thread Pool Properties |  |
maxThreads | Maximum number of threads in Thread pool. | 200
maxSpareThreads | Maximun number of spare threads. Unused threads will be terminated as needed to keep the number of spare threads under this number. | 50
minSpareThreads | Minimum number of spare threads. Additional threads will be created as needed to keep the number of spare threads up to this number. | 4
pools | Enables use of a Thread pool. | true

#### Example(s)

    <Ajp13Connector port="8009" tomcatAuthentication="false" />

### ApacheConfig

Type: Configuration

#### Description

Generate configuration file for mod_jk to be included in Apache's httpd.conf.

For additional information on connecting Tomcat to Apache via mod_jk, see the Working with mod_jk document.

Important Note: The configuration files are not written as part of a normal startup of Tomcat. To generate the configuration files on demand, append:

        jkconf

or

        -jkconf

to the startup command. Tomcat will initialize sufficiently to write the configuration files and then exit. This may be done while Tomcat 3.3 is running. To generate the configuration files during normal startup, add:

        jkconf="true"

to the `<ContextManager ... >` element in the `server.xml` file.

#### Attributes

Attribute | Description | Default
--- | --- | ---
configHome | Default parent directory for the following paths. Ignored whenever any of the following paths is absolute. | TOMCAT_HOME
jkConfig | Path to use for writing Apache mod_jk configuration file. | conf/auto/mod_jk.conf
workersConfig | Path to workers.properties file used by mod_jk. | conf/jk/workers.properties
modJk | Path to Apache mod_jk plugin file. | Windows: modules/mod_jk.dll Netware: modules/mod_jk.nlm Unix and all others: libexec/mod_jk.so
jkLog | Path to log file to be used by mod_jk. | logs/mod_jk.log
jkDebug | JK Loglevel setting. May be debug, info, error, or emerg. | emerg
jkWorker | The desired worker. Must be set to one of the workers defined in the workers.properties file. "ajp12", "ajp13" or "inprocess" are the workers found in the default workers.properties file. | Defaults to "ajp13" if an Ajp13Connector is in use, otherwise it defaults to "ajp12".
forwardAll | If `true`, forward all requests to Tomcat. This helps ensure that all the behavior configured in the web.xml file functions correctly. If `false`, let Apache serve static resources. Warning: When `false`, some configuration in the web.xml may not be duplicated in Apache. Review the mod_jk configuration file to see the actual configuration being set in Apache. | true
noRoot | If `true`, the root context is not mapped to Tomcat. If `false` and forwardAll is `true`, all requests to the root context are mapped to Tomcat. If `false` and forwardAll is `false`, only JSP and servlets requests to the root context are mapped to Tomcat. When `false`, to correctly serve Tomcat's root context in the default host you must also modify the DocumentRoot setting in Apache's httpd.conf file to point to Tomcat's root context directory. Otherwise some content, such as Apache's index.html, will be served by Apache before mod_jk gets a chance to claim the request and pass it to Tomcat. If a root context is assigned to a virtual host, then the DocumentRoot is automatically included in the configuration for that virtual host. | true

#### Example(s)

    <ApacheConfig forwardAll="true" noRoot="false" />

### AutoDeploy

Type: Configuration

#### Description

Automatically expands WAR files on startup.

Note: If the `redeploy` attribute is `true` and a ReloadInterceptor is present, then WAR files will re-deploy automatically while Tomcat 3.3 is running.

#### Attributes

Attribute | Description | Default
--- | --- | ---
source | Directory where ".war" files are located. | ${tomcat.home}/webapps
target | Directory where .war files will be expanded | ${tomcat.home}/webapps
redeploy | Check if the .war file is changed and re-deploy. This works in the same way as reloading. | false

#### Example(s)

    <AutoDeploy source="webapps" target="webapps" />

### AutoWebApp

Type: Configuration

#### Description

Automatically adds web application contexts from a directory.

#### Attributes

Attribute | Description | Default
--- | --- | ---
dir | Directory from which to load the web applictions. Relative paths are interpreted as relative to TOMCAT_HOME. | webapps
flat | Each dir will be treated as a webapp in the same host. If `false`, each dir will be treated as a host name and its subdirs as web applications. You can add apps to multiple virtual hosts. | true
host | Virtual host into which each application will be deployed. Note: If this attribute is specified in `server.xml`, the handling for `hostChar` and `hostDotChar` is disabled. | DEFAULT
hostChar [Tomcat 3.3.1] | Character used to designate the end of the host portion of the directory name. For example, a directory named "mydomain@myapp" would deploy to virtual host "mydomain" as the "/myapp" context. Deriving a host name from the directory name is disabled if the `host` attribute is specified in `server.xml`. Also see the `hostDotChar` attribute for including periods in the host name. Note: This attribute was implemented, but not configurable in Tomcat 3.3. However, a bug in Tomcat 3.3 makes this feature unusable. The '@' character is incorrectly included in the context name. This bug has been corrected in Tomcat 3.3.1. | @
hostDotChar [Tomcat 3.3.1] | Character used as a substitute for periods in the host portion of the directory name. For example, a directory named "www_mydomain_com@myapp" would deploy to virtual host "www.mydomain.com" as the "/myapp" context. Also see the `hostChar` attribute for designating the end of the host name. Note: This attribute was implemented, but not configurable in Tomcat 3.3. However, a bug in the handing for `hostChar` in Tomcat 3.3 makes this feature unusable. It is fully funtional in Tomcat 3.3.1. | _
ignoreDot | Ignore dirs starting with '.' | true
pathSlashChar [Tomcat 3.3.1] | Character used as a substitute for slashes in the context path portion of the directory name. For example, a directory named "my_app" would deploy to the default host as the "/my/app" context. Note: This attribute was implemented, but not configurable in Tomcat 3.3. | _
prefix [Tomcat 3.3.1] | Prefix to add to the context path for each deployed web application. The context path will consist of the prefix followed subdirectory name. | empty string
reloadable | If true, reloading will be enabled by default for each context. If false, reloading will be disabled by default for each context. This setting, enabled or disabled, may be overridden in an explicit context declaration. | true

Note: The special directory name handling controlled by `hostChar`, `hostDotChar`, and `pathSlashChar` is always enabled. If you wish to include '_' characters in a web application directory name, disable the feature by redefining the `pathSlashChar` to an empty string.

#### Example(s)

      <AutoWebApp dir="webapps" host="DEFAULT" />
      <AutoWebApp dir="myhost" host="myhost.com" />
      <AutoWebApp dir="webapps" pathSlashChar="" />

### ContextXmlReader

Type:Configuration

#### Description

Reads the XML files that define contexts to be served by Tomcat. You specify a single file to read. However, in addition to that file, all other files in the same directory will be read that match the pattern "base-*.xml", where base is the base name (i.e. name without extension) of the file you specified. Each file may configure one or more contexts. Where the context matches a context automatically created by the AutoWebApp module, the configuration file will override the default context settings.

For details on the syntax of the context configuration file, refer to the Adding and Customizing Contexts section of the Tomcat 3.3 Users Guide.

Note: In Tomcat 3.3.1, ant-style variable substitution is supported in the XML files. Details are included in the "Adding and Customizing Contexts" section mentioned above.

#### Attributes

Attribute | Description | Default
--- | --- | ---
config | Context configuration file to read. It may configure one or more contexts. | conf/server.xml

#### Example(s)

      <ContextXmlReader config="conf/myapps.xml" />

### CredentialsInterceptor

Type: Access, Authentication, and Authorization

#### Description

Extracts the user name and password from a request and makes the information available for another module to perform the authentication. It currently supports extracting user name and passwords from BASIC and FORM based authetication.

This module must appear prior to the "realm" module that performs the authentication.

#### Attributes

This module has no user settable attributes.

#### Example(s)

    <CredentialsInterceptor />

### DecodeInterceptor

Type: Mappers

#### Description

Handles the task of establishing the encoding of a request. It also handles optionally normalizing the request and optionally checking the request for unsafe escape sequences.

#### Attributes

Attribute | Description | Default
--- | --- | ---
defaultEncoding | Server wide default encoding to use. When set, all requests will default to this encoding if the encoding can't be determined or an appropriate guess isn't available. If `null`, a request's internal default of ISO-8859-1 remains in effect. | null, which indirectly defaults to ISO-8859-1
useSessionEncoding | Enables use of the encoding of the response as default for the next request. This parameter if `true` can affect the value returned by ServletRequest.getCharacterEncoding(). If the encoding hasn't been previously specified, a request attribute corresponding to charsetAttribute has not been found, and a session is available, then getCharacterEncoding() will return the character encoding of the last response sent for this session. | true
charsetAttribute | The name of the URL attribute to use for two alternate ways of specifying character encoding. First, you may specify the encoding by including ";charsetAttribute=encoding in the URL. For example, "http://localhost:8080/myapp/index.jsp;charset=UTF-8" would specify the encoding as `UTF-8`. The special attribute is removed from the URI, so it is not visible to normal request handling. Second, if the encoding has not been previously specified, then handing for ServletRequest.getCharacterEncoding() will check for a request attribute with the charsetAttribute name and return that encoding if found. | charset
normalize | Normalize the request URI to remove occurrences of "//", "/./", and "/x/../". Also remove ending "/." and "/x/.." | true
safe | Enables checking for unsafe encodings. These are %25 ('%'), %2E ('.'), %2F ('/'), and %5C ('\'). If any are found in the URI, the request is considered "unsafe" and a 403 Forbidden error is returned. | true
saveOriginal | If `true`, a copy of the original request URI is saved before it is decoded. This saved copy is later used as the return value HttpServletRequest.getRequestURI(). If `false`, then HttpServletRequest.getRequestURI() returns a re-encoded version of the decoded request URI. Setting this attribute to `true` most closely follows the Servlet 2.2 spec. However, `false` is the default because `true` can't be implemented when Tomcat is connected to Netscape Web Server 4.1 or earlier. The original un-escaped request URI isn't made available to the connector. Also, the IIS connector that shipped with Tomcat 3.3(a) did not support passing the original request URI, though the current one does, using the `uri_select` setting. | false

#### Example(s)

    <DecodeInterceptor useSessionEncoding="true" >

### ErrorHandler

Type: Generator

#### Description

Handles response generation when a request encounters an error. Calls the appropriate error handler if specified, or generates the default error response if not specified.

#### Attributes

Attribute | Description | Default
--- | --- | ---
defaultRedirectStatus | Sets the default status code for use by the RedirectHandler if as status code has not already been set. It may be set to "301" or "302". This primarily affects the status code used when the StaticInterceptor module redirects a "directory" URL that doesn't end with a '/' and redirects to welcome files. | 301
showDebugInfo | Enables the inclusion of extra information in the default error output, such as stack traces. This extra information can expose data about the internal operation of Tomcat. It should be disabled in production environments. | true

#### Example(s)

    <ErrorHandler showDebugInfo="false" />

### CoyoteConnector

Type: Server

#### Description

Handles incoming AJP13 and HTTP, or optionally HTTPS, requests. [Tomcat 3.3.2]

#### Attributes

Attribute | Description | Default
--- | --- | ---
socketCloseDelay | Specifies the number of milliseconds to delay before closing the socket after processing a request. If negative, the delay is disabled. Setting a value greater or equal to zero is intended to help with diagnosing client errors resulting from unread data in the body of the HTTP request. If this unread data arrives just before or during the closing of the socket, the client may see a "Connection aborted by peer" error. | -1
processorClassName | The Coyote processor class to use. The values are `org.apache.coyote.http11.Http11Processor` for the HTTP/1.1 connector, and `org.apache.jk.server.JkCoyoteHandler` for the AJP13 connector. | org.apache.coyote.http11.Http11Processor
HTTP/1.1 Connection Properties |  |
disableUploadTimeout | If `true` then use the same timeout for uploads and for keep-alives. | true
maxKeepAliveRequests | The maxiumum number of keep-alive requests to allow on the same socket connection. | 100
secure | Enables use of a SSL socket factory and act as an HTTPS server. | false
keystoreFile | Keystore containing the Server certificate | PureTLS: server.pem JSSE: .keystore in directory specified by the user.home System property
keypass | Password to the keystore. | changeit
clientauth | Enables requirement for client authentication. | false
Socket Properties |  |
address | Address to which the server socket binds. | null, bind on all addresses
backlog | Maximum length of the backlog queue for the server socket. | 100
port | Port on which to receive requests. | no default, must be specified
SSLImplementation | Class which implements the `org.apache.tomcat.util.net.SSLImplementation` interface. This setting controls which SSL support is used by secure connections. Currently supported are: PureTLS - specify `org.apache.tomcat.util.net.PureTLSImplementation` JSSE - specify `org.apache.tomcat.util.net.JSSEImplementation` | not set default behavior will detect PureTLS and JSSE and choose the one available, or PureTLS if both are available.
timeout | Socket read timeout in seconds. | 300
Thread Pool Properties |  |
maxThreads | Maximum number of threads in Thread pool. | 200
maxSpareThreads | Maximun number of spare threads. Unused threads will be terminated as needed to keep the number of spare threads under this number. | 50
minSpareThreads | Minimum number of spare threads. Additional threads will be created as needed to keep the number of spare threads up to this number. | 4

Note: You may specify attributes that do not appear in the list above. These attribute settings will be saved in a list and made available to the secure socket factory when `secure` is set `true`. Supported attributes are:

#### PureTLS

Attribute | Description | Default
--- | --- | ---
rootfile | File containing root certificates. | root.pem
randomfile | File to initialize random number generation. | random.pem

#### JSSE

Attribute | Description | Default
--- | --- | ---
algorithm | Algorithm used to encode the certificate. | SunX509
keystoreType | Type of keystore. | JKS
keystorePass | Password to Keystore file. | defaults to keypass setting
protocol | Protocol for the SSL. | TLS

#### Example(s)

    <CoyoteConnector port="8080" timeout="60" />

### Http10Connector

Type: Server

#### Description

Handles incoming HTTP, or optionally HTTPS, requests.

#### Attributes

Attribute | Description | Default
--- | --- | ---
reportedname | Specifies the string to use for the "Server" header | null, use default Tomcat server string
socketCloseDelay [Tomcat 3.3.1] | Specifies the number of milliseconds to delay before closing the socket after processing a request. If negative, the delay is disabled. Setting a value greater or equal to zero is intended to help with diagnosing client errors resulting from unread data in the body of the HTTP request. If this unread data arrives just before or during the closing of the socket, the client may see a "Connection aborted by peer" error. | -1
Connection Properties |  |
secure | Enables use of a SSL socket factory and act as an HTTPS server. | false
keystore | Keystore containing the Server certificate | PureTLS: server.pem JSSE: .keystore in directory specified by the user.home System property
keypass | Password to the keystore. | changeit
clientauth | Enables requirement for client authentication. | false
Socket Properties |  |
address | Address to which the server socket binds. | null, bind on all addresses
backlog | Maximum length of the backlog queue for the server socket. | 100
port | Port on which to receive requests. | no default, must be specified
SSLImplementation [Tomcat 3.3.1] | Class which implements the `org.apache.tomcat.util.net.SSLImplementation` interface. This setting controls which SSL support is used by secure connections. Currently supported are: PureTLS - specify `org.apache.tomcat.util.net.PureTLSImplementation` JSSE - specify `org.apache.tomcat.util.net.JSSEImplementation` | not set default behavior will detect PureTLS and JSSE and choose the one available, or PureTLS if both are available.
timeout | Socket read timeout in seconds. | 300
Thread Pool Properties |  |
maxThreads | Maximum number of threads in Thread pool. | 200
maxSpareThreads | Maximun number of spare threads. Unused threads will be terminated as needed to keep the number of spare threads under this number. | 50
minSpareThreads | Minimum number of spare threads. Additional threads will be created as needed to keep the number of spare threads up to this number. | 4
pools | Enables use of a Thread pool. | true

Note: In Tomcat 3.3.1 and later, you may specify attributes that do not appear in the list above. These attribute settings will be saved in a list and made available to the secure socket factory when `secure` is set `true`. Supported attributes are:

#### PureTLS

Attribute | Description | Default
--- | --- | ---
rootfile | File containing root certificates. | root.pem
randomfile | File to initialize random number generation. | random.pem

#### JSSE

Attribute | Description | Default
--- | --- | ---
algorithm | Algorithm used to encode the certificate. | SunX509
keystoreType | Type of keystore. | JKS
keystorePass | Password to Keystore file. | defaults to keypass setting
protocol | Protocol for the SSL. | TLS

#### Example(s)

    <Http10Interceptor port="8080" timeout="60" />

### IISConfig

Type: Configuration

#### Description

Generate configuration files for isapi_redirect.dll to be used for connecting IIS to Tomcat. In Tomcat 3.3, two files will be generated, `iis_redirect.reg` and `uriworkermap.properties`. Both files will be written to `conf/auto` relative to TOMCAT_HOME. The `iis_redirect.reg` contains the needed registry entries for the `iis_redirect.dll`. You may enter the settings into the registry by double-clicking on this file in Windows Explorer. The `uriworkermap.properties` file will be read by the `isapi_redirect.dll` to get the mappings that determine which requests should be passed to Tomcat.

In Tomcat 3.3.1, an additional file is written. The default is to write an `isapi_redirect.properties` file to the same directory as the `iis_redirect.reg` file. It contains the same configuration information as the `iis_redirect.reg`, and offers an alternative method of configuring the redirector instead of relying on the registry. See the document mentioned in the next paragraph for details on its use.

For additional information on connecting Tomcat to IIS, see the Tomcat IIS HowTo document.

Important Note: The configuration files are not written as part of a normal startup of Tomcat. To generate the configuration files on demand, append:

        jkconf

or

        -jkconf

to the startup command. Tomcat will initialize, write the configuration files, and then shutdown. This may be done while Tomcat 3.3 is running. To generate the configuration files during normal startup, add:

        jkconf="true"

to the `<ContextManager ... >` element in the `server.xml` file.

#### Attributes

Attribute | Description | Default
--- | --- | ---
configHome | Default parent directory for the following paths. Ignored whenever any of the following paths is absolute. | TOMCAT_HOME
regConfig | Path to use for writing the registry settings configuration file. | conf/auto/iis_redirect.reg
uriConfig | Path to use for writing the URI worker map configuration file. | conf/auto/uriworkermap.properties
workersConfig | Path to workers configuration file. | conf/jk/workers.properties
isapiRedirector [Tomcat 3.3.1] | Name of the ISAPI connector DLL. This setting controls the name of the redirector DLL used in the configuration settings. This setting appears in the registry settings configuration file specified by the `regConfig` attribute. It is also written to a file with the same name as the DLL, but with a ".properties" extension. The "properties" file will be written to the same directory as the registry settings configuration file. Note: This "properties" file may be placed in the same directory as the Tomcat redirector plugin DLL being used by IIS. Provided its base name is the same as the DLL (e.g. isapi_redirect.dll and isapi_redirect.properties) the configuration settings in the file will be used instead of settings found in the registry. | isapi_redirect.dll
jkLog | Path to log file to be used by `isapi_redirect.dll`. | logs/iis_redirect.log
jkDebug | JK Loglevel setting. May be debug, info, error, or emerg. | emerg
jkWorker | The desired worker. Must be set to one of the workers defined in the workers.properties file. "ajp12", "ajp13" or "inprocess" are the workers found in the default workers.properties file. | Defaults to "ajp13" if an Ajp13Connector is in use, otherwise it defaults to "ajp12".
forwardAll | If `true`, forward all requests to Tomcat. This helps ensure that all the behavior configured in the web.xml file functions correctly. If `false`, let IIS serve static resources. Warning: When `false`, some configuration in the web.xml may not be duplicated in IIS. Review the configuration files to see the actual configuration being set in IIS. | true
noRoot | If true, the root context is not mapped to Tomcat. If `false` and forwardAll is `true`, all requests to the root context are mapped to Tomcat. If `false` and forwardAll is `false`, only JSP and servlets requests to the root context are mapped to Tomcat. | true

#### Example(s)

    <IISConfig forwardAll="true" noRoot="false" />

### InvokerInterceptor

Type: Generator

#### Description

Provides support for the "/servlet/class name" legacy method of invoking servlets.

#### Attributes

This module has no user settable attributes.

#### Example(s)

    <InvokerInterceptor />

### JDBCRealm

Type: Access, Authentication, and Authorization

#### Description

Authenticates the user if required for a request. The authentication occurs using data from "user" and "user roles" tables accessed using a JDBC connection.

#### Attributes

Attribute | Description | Default
--- | --- | ---
driverName | JDBC driver to use. | must be specified
connectionURL | URL to use to connect to the database. | must be specified
connectionName | User name to use to connect to the database. The connectionPassword must also be specified before the user name and password will be used. | not used
connectionPassword | Password to use to connect to the database. The connectionName must also be specified before the user name and password will be used. | not used
userTable | Table that holds the user data. | must be specified
userNameCol | Column in the user table that holds the user's name. | must be specified
userCredCol | Column in the user table that holds the user's credentials. | must be specified
userRoleTable | Table that holds the relation of users to their roles | must be specified
roleNameCol | Column in the user role table that names a role. | must be specified
connectOnInit | Enables establishing JDBC connection when Tomcat starts. Otherwise, establish JDBC connection on first use. | false

#### Example(s)

    <JDBCRealm driverName="sun.jdbc.odbc.JdbcOdbcDriver"
                  connectionURL="jdbc:odbc:TOMCAT"
                  userTable="users"
                  userNameCol="user_name"
                  userCredCol="user_pass"
                  userRoleTable="user_roles"
                  roleNameCol="role_name" />

### Jdk12Interceptor

Type: Generator

#### Description

Ensures that the proper context classloader is in effect during servlet execution.

#### Attributes

This module has no user settable attributes.

#### Example(s)

    <Jdk12Interceptor />

### JniConnector

Type: Server

#### Description

Handles requests processed by Tomcat running in-process. It has no effect if Tomcat was not started in-process by the Tomcat connector.

#### Attributes

Attribute | Description | Default
--- | --- | ---
exitIfNoLib | Causes Tomcat to exit if the native libary is not successfully loaded. | true
nativeLibrary | Name of the native library to load. If the name specified is not absolute, it tries loading the library using the name as is. If that fails, it will try loading it from `TOMCAT_HOME/bin/native`. | Windows: jni_connect.dll Netware: jni_connect.nlm Unix and all others: jni_connect.so

#### Example(s)

    <JniConnector nativeLibrary="bin/jni_connect.so" />

### JservConfig

Type: Configuration

#### Description

Generate configuration file for mod_jserv to be included in Apache's httpd.conf.

For additional information on connecting Tomcat to Apache via mod_jserv, see the Tomcat Apache HowTo document.

Important Note: The most stable and robust connector for connecting Tomcat 3.3 to Apache is mod_jk. Its use is recommended over mod_jserv. Also, unlike the `ApacheConfig`, `IISConfig`, and `NSConfig` modules, `JservConfig` does not participate in the "jkcont" startup option. Instead, the configuration file is written each time Tomcat is started.

#### Attributes

Attribute | Description | Default
--- | --- | ---
configHome | Default parent directory for the following paths. Ignored whenever any of the following paths is absolute. | TOMCAT_HOME
jservConfig | Path to use for writing Apache tomcat-apache.conf configuration file. | conf/auto/tomcat-apache.conf
modJserv | Path to Apache mod_jserv plugin file. | Windows: modules/ApacheModuleJserv.dll Unix and all others: libexec/mod_jserv.so
jservLog | Path to log file to be used by mod_jserv. | logs/mod_jserv.log
jservDebug | JServ Loglevel setting. May be debug, info, notice, warn, error, crit, alert, or emerg. | emerg
forwardAll | If `true`, forward all requests to Tomcat. This helps ensure that all the behavior configured in the web.xml file functions correctly. If `false`, let Apache serve static resources. Warning: When `false`, some configuration in the web.xml may not be duplicated in Apache. Review the tomcat-apache.conf configuration file to see the actual configuration being set in Apache. | true
noRoot | If `true`, the root context is not mapped to Tomcat. If `false` and forwardAll is `true`, all requests to the root context are mapped to Tomcat. If `false` and forwardAll is `false`, only JSP and servlets requests to the root context are mapped to Tomcat. If a root context is assigned to a virtual host, then the DocumentRoot is automatically included in the configuration for that virtual host. | true

#### Example(s)

    <JservConfig forwardAll="true" noRoot="false" />

### JspInterceptor

Type: Servlet 2.2 Facade

#### Description

Handles turning a JSP page into a loaded servlet for execution. Execution for the loaded servlet is handled the same as any other servlet. It uses Jasper for translating the JSP to a Java file, then performs compilation to a class file directly rather than using Jasper for the class compilation.

There is support for using Sun's `javac` Java compiler as well as IBM's `Jikes` Java compiler.

#### Attributes

Attribute | Description | Default
--- | --- | ---
| JSP Translation Options |
keepGenerated | Keep the translated Java file. If `false`, the Java file is deleted after being compiled to a class file. | true
largeFile | Writes the HTML text from a JSP to a separate file with a ".dat" extension. This text is read when the JSP servlet initializes. The makes the class file smaller. If `false`, "out.print()" statements are generated with the HTML text is embedded as a literal. | false
mappedFile | Generate "out.print()" for each HTML text line in the JSP file. If `false`, the HTML text from multiple lines are concatenated and output in one "out.print()". This option is ignored if `largeFile` is `true`. | false
IEClassId | The Microsoft Internet Explorer "classid" to be used by the `jsp:plugin` tag. | clsid:8AD9C840-044E-11D1-B3E9-00805F499D93
scratchdir | Destination directory for the JSP's Java file. | context's work directory
| Options for JSP Java Compilation |
classDebugInfo | Enables compiling the class file with debugging information. | false
javaCompiler | Jasper class for invoking the Java compiler. For using Sun's `javac` Java compiler in process, specify `org.apache.jasper.compiler.SunJavaCompiler`. To use IBM's Jikes Java compiler out of process, specify `org.apache.jasper.compiler.JikesJavaCompiler` or just `jikes` which is a supported shortcut. | org.apache.jasper.compiler.SunJavaCompiler
useWebAppCL | If true, Java compilation with "sun.tools.javac.Main" will be performed using the web application classloader instead of using the "container" classloader. This was added as a workaround for problems encountered on some HP-UX systems. | false
| Options for Jikes Complier |
jspCompilerPath | Path to Java compiler executable. Used only with Jikes as the Java compiler. If not specified, the Jikes executable must be in the `PATH` environment variable. | empty
jikesClasspath | Extra classpath entries to pass to the Jikes compiler. This would typically include extension jars found in the `jre/lib/ext` directory of a Java 2 SDK. By default, the `jre/lib/rt.jar` file is automatically included so it does not need to be present in this setting. Classes from `WEB-INF/classes` and jars from `WEB-INF/lib` are also automatically included. | empty
| Options for JSP Runtime |
pageContextPoolSize | Sets pool size of JSP PageContexts. If zero, disables pooling. | 100
| Options for Jasper JSP servlet - The attributes other than `useJspServlet` are ignored if `useJspServlet` is `false`. |
useJspServlet | Enables use of Jaspers JspServlet for translating, compiling, and loading JSP pages. Provided for backward compatibility with earlier Tomcat implementations. | false
jspServlet | The JSP servlet class. | org.apache.jasper.servlet.JspServlet
classPath | Classpath passed to the Java compiler when compiling to a class file. | empty

#### Example(s)

    <JspInterceptor keepGenerated="false" />
    <JspInterceptor javaCompiler="jikes" />

### LoaderInterceptor11

Type: Configuration

#### Description

This module constructs and sets the classloader for each context. It supports the Servlet 2.2 spec by including `WEB-INF/classes` and the Jars in `WEB-INF/lib` in the classloader. The available attributes allow control over the context classloader's parent. With the default attributes, "trusted" contexts get the Server Classloader as their parent and "untrusted" contexts get the Apps Classloader as their parent.

#### Attributes

Attribute | Description | Default
--- | --- | ---
additionalJars [Tomcat 3.3.1] | List of jars to be added to each web application separated by the specified `jarSeparator`. If not an absolute path, the path is assumed to be relative to `TOMCAT_HOME/lib/container`. | none
jarSeparator [Tomcat 3.3.1] | String containing the character to be used as a jar separator. This separator is used by the `additionalJars` and `jaxpJars` lists. | :
jaxp | Enables providing a default XML parser to web applications that don't already have one. If the `javax.xml.parsers.SAXParserFactory` class is found in a web application, it is assumed to already contain an XML parser and no action is taken for that web application. | true
jaxpDir | Directory where Jaxp jars are located. | lib/container
jaxpJars | List of jars to be added. The list is separated by colons in Tomcat 3.3, or by `jarSeparator` in Tomcat 3.3.1 and later. | jaxp.jar:crimson.jar:xalan.jar:xerces.jar
useNoParent | If `true`, sets the context classloader's parent to `null`. If `false`, then contexts which are "trusted" will get the Server Classloader as the parent. The parent classloader for contexts which are not "trusted" are controlled by the `useApplicationLoader` attribute. | false
useApplicationLoader | If `true`, when `useNoParent` is `false`, sets the context classloader's parent to the Apps Classloader. If `false`, when `useNoParent` is `false`, sets the context classloader's parent to the Server Classloader. | true
use11Loader [Tomcat 3.3.1] | If `true`, use the SimpleClassLoader (normally used in JDK 1.1.8 environments) even under Java2. Otherwise the default URLClassLoader is used when running with Java2. The primary reason for this attribute is as a workaround for known jar reloading problems in the URLClassLoader of some JVM's. If you have problems with reloading web applications after updating jars, try setting this attribute true. This provides compatiblity with Tomcat 3.2.x. with respect to jar reloading. | false

#### Example(s)

    <LoaderInterceptor11 jaxp="true" />
    <LoaderInterceptor11 jaxp="true" use11Loader="true"/>

#### Additional Note

For Tomcat 3.3.1 and later, LoaderInterceptor11 also supports an `additionalJars` Context property that works the same as the module's `additionalJars` attribute for that context only. If `additionalJars` is specified as a Context property and as a LoaderInterceptor11 attribute, both lists are added. For information on setting Context properties, see Adding and Customizing Contexts in the Tomcat 3.3 User's Guide.

### LoadOnStartupInterceptor

Type: Servlet 2.2 Facade

#### Description

Handles pre-loading of servlets specified as <load-on-startup> in a Context's web.xml file.

#### Attributes

This module has no user settable attributes.

#### Example(s)

    <LoadOnStartupInterceptor />

### LogEvents

Type: Configuration

#### Description

This module enables logging of when module methods are called. The log output goes to the ContextManager's log channel. Event logging is automatically enabled if the ContextManager's debug level is set greater than 5.

#### Attributes

Attribute | Description | Default
--- | --- | ---
enabled | If `true`, enables logging of when module methods are called. | false

#### Example(s)

    <LogEvents enabled="true" />

### LogSetter

Type: Configuration

#### Description

Configures a log channel.

#### Attributes

Attribute | Description | Default
--- | --- | ---
name | Name of the log channel. | null
path | Path to the desired log file. You may embed a `java.text.SimpleDateFormat` string enclosed within "${}" to create a path that encorporates the current date and/or time. | null, log output goes to stderr
verbosityLevel | Verbosity level for the log. Accepted values are: `FATAL`, `ERROR`, `WARNING`, `INFORMATION`, and `DEBUG`. | INFORMATION
timestamps | If `true`, a timestamp is included at the beginning of each line in the log output. | true
timestampFormat | Format for timestamp, if enabled. | yyyy-MM-dd HH:mm:ss

#### Example(s)

    <LogSetter name="tc_log" verbosityLevel="DEBUG" />
    <LogSetter name="servlet_log" timestamps="true"
        verbosityLevel="INFORMATION" path="logs/servlet-${yyyyMMdd}.log" />

### MxInterceptor

Type: Configuration

#### Description

JMX MBeans support has been added to Tomcat 3.3.2, which allow you to manage Tomcat from any JMX console (JRMP) or via a simple browser by the build in HTTP Adaptor

To enable JMX, you should add the optional JmxSupport module to the $TOMCAT_HOME/modules directory.

To also activate the HTTP/JRMP Adaptor you should at least define the port

#### Attributes

Attribute | Description | Default
--- | --- | ---
type | indicate what kind of adapter you want to use, HTTP or JRMP. | HTTP
port | port where the JMX HTTP/JRMP adaptor will listen to, no adaptor will be loaded if not set | no adaptor
host | host/ip where the JMX HTTP/JRMP Adaptor will listen to, only available when using `MX4J` implementation | null
authentication | authentication used by the JMX HTTP Adaptor, only available when using `MX4J` HTTP Adaptor, it could be `none`, `basic`, `digest` | none
user | the user account which to be used with authentication | none, should be set to enable authentication
password | the password which to be used with authentication | none, should be set to enable authentication

#### Example(s)

    <MxInterceptor type="HTTP" port="8999" host="mysystem" authentication="basic" user="admin" password="changeillico" />

### NSConfig

Type: Configuration

#### Description

Generate configuration files for nsapi_redirect.dll to be used for connecting Netscape Web Server to Tomcat. An `obj.conf` will be written to `conf/auto` relative to TOMCAT_HOME. The contents of this `obj.conf` will need to be merged with the `obj.conf` file being used for the disired server.

For additional information on connecting Tomcat to Netscape, see the Tomcat Netscape HowTo document.

Important Note: The configuration files are not written as part of a normal startup of Tomcat. To generate the configuration files on demand, append:

        jkconf

or

        -jkconf

to the startup command. Tomcat will initialize, write the configuration files, and then shutdown. This may be done while Tomcat 3.3 is running. To generate the configuration files during normal startup, add:

        jkconf="true"

to the `<ContextManager ... >` element in the `server.xml` file.

#### Attributes

Attribute | Description | Default
--- | --- | ---
configHome | Default parent directory for the following paths. Ignored whenever any of the following paths is absolute. | TOMCAT_HOME
nsapiJk | Path to Netscape mod_jk plugin file. | Windows: bin/nsapi_redirect.dll Netware: bin/nsapi_rd.nlm Unix and all others: bin/nsapi_redirector.so
objConfig | Path to use for writing the Netscape obj.conf configuration file. | conf/auto/obj.conf
objectName | Name of the Object to execute the requests. | servlet
workersConfig | Path to workers configuration file. | conf/jk/workers.properties
jkLog | Path to log file to be used by `nsapi_redirect.dll`. | logs/nsapi_redirect.log
jkDebug | JK Loglevel setting. May be debug, info, error, or emerg. | emerg
jkWorker | The desired worker. Must be set to one of the workers defined in the workers.properties file. "ajp12", "ajp13" or "inprocess" are the workers found in the default workers.properties file. | Defaults to "ajp13" if an Ajp13Connector is in use, otherwise it defaults to "ajp12".
forwardAll | If `true`, forward all requests to Tomcat. This helps ensure that all the behavior configured in the web.xml file functions correctly. If `false`, let Netscape serve static resources. Warning: When `false`, some configuration in the web.xml may not be duplicated in Netscape. Review the configuration files to see the actual configuration being set in Nescape. | true
noRoot | If true, the root context is not mapped to Tomcat. If `false` and forwardAll is `true`, all requests to the root context are mapped to Tomcat. If `false` and forwardAll is `false`, only JSP and servlets requests to the root context are mapped to Tomcat. | true

#### Example(s)

    <NSConfig forwardAll="true" noRoot="false" objectName="tomcat" />

### PolicyLoader

Type: Configuration

#### Description

Installs a security manager and/or a policy file if Tomcat is started with "sandbox" enabled. This module has no effect if you specify a "-Djava.security.policy=..." in the startup command for the Java VM. Setting the policy on the command line is the preferred method.

#### Attributes

Attribute | Description | Default
--- | --- | ---
securityManagerClass | Customize the security manager | java.lang.SecurityManager
policyFile | Policy file to be used by the security manager. | conf/tomcat.policy
sandbox | Force the use of a sandbox, regardless of command line. | false

#### Example(s)

    <PolicyLoader securityManagerClass="java.lang.SecurityManager"
        policyFile="conf/tomcat.policy" />

### ReloadInterceptor

Type: Mappers

#### Description

Handles reloading of servlets and contexts.

#### Attributes

Attribute | Description | Default
--- | --- | ---
fullReload | Enables restarting of the context whenever a change is detected. This is the cleanest form of reload. If `false`, it only reloads the servlets. | true

#### Example(s)

    <ReloadInterceptor fullReload="true" />

### Servlet22Interceptor

Type: Servlet 2.2 Facade

#### Description

Handles some miscellaneous tasks that help implement behavior related to the Servlet 2.2 specification.

#### Attributes

This module has no user settable attributes.

#### Example(s)

    <Servlet22Interceptor />

### SessionExpirer

Type: Session

#### Description

Handles actual descruction of expired sessions.

#### Attributes

Attribute | Description | Default
--- | --- | ---
checkInterval | How often to check for expired sessions, in seconds. | 60

#### Example(s)

    <SessionExpirer checkInterval="120" />

### SessionId

Type: Session

#### Description

Handles associating sessions with requests and responses.

#### Attributes

Attribute | Description | Default
--- | --- | ---
cookiesFirst | Enables checking cookies first for determining if a request has an associated session, followed by checking for ";jsessionid" in the URL. If `false`, ";jsessionid" is checked for first. | true
noCookies | If true, no session cookies are added to the response. Instead you must use HttpServletResponse.encodeURL() to embed URL's in the response that contain the session id. If `false`, the session id will be added to the response as a cookie. You may still use HttpServletResponse.encodeURL() if you want your sessions to work with browsers that have cookies turned off. | false
checkSSLSessionId [Tomcat 3.3.1] | If `true`, Tomcat session will be verified against SSL session to prevent (malicious) use of other users' sessions. In order for this to work, SSL has to be enabled (through Apache) and SSL Session ID has to be known to Tomcat. More information can be found in mod_jk documentation. | false
secureCookie [Tomcat 3.3.2] | If `true`, then Tomcat will mark the Session ID cookie as as "Secure" if the session is created over a SSL connection. A conforming browser will only send the cookie back to a page that is using SSL. The effect is that if a session is created from a SSL page, than it is not available to any non-SSL pages. | true

#### Example(s)

    <SessionId cookiesFirst="true" noCookies="false" />
    <SessionId noCookies="true" />
    <SessionId noCookies="true" checkSSLSessionId="true"/>

### SessionIdGenerator

Type: Session

#### Description

Creates new session IDs when needed for a request. If the `randomFile` is not available, the class specified by `randomClass` will be used. In this case, initialization of class occurs on the first request requiring a session.

Note: The initialization for the `java.security.SecureRandom` class can take a relatively long time. For development purposes, you may speed this up by specifying `java.util.Random` as the `randomClass` setting. This should be done only for development since the random sequence generated by java.util.Random is predictable.

#### Attributes

Attribute | Description | Default
--- | --- | ---
randomClass | Class for creating a random number use in session ID creation when `randomFile` isn't available. | java.security.SecureRandom
randomFile | A special "device" available on some Unix based operating systems. Used for obtaining a random number used in session ID creation. If available, overrides use of the `randomClass` setting. | /dev/urandom

#### Example(s)

    <SessionIdGenerator randomClass="java.security.SecureRandom"
        randomFile="/dev/urandom" />

### SimpleMapper1

Type: Mapper

#### Description

Handles the mapping of requests to the appropriate context.

#### Attributes

Attribute | Description | Default
--- | --- | ---
mapCache | Enables creating a cache map of the full request URI to its associated context. This speeds the mapping operation for subsequent requests. This feature is considered experimental. | false
ignoreCase | Enables case insensitive operation when mapping a request to a context. | false on Unix based systems true on Windows based systems

#### Example(s)

    <SimpleMapper1 />

### SimpleRealm

Type: Access, Authentication, and Authorization

#### Description

Authenticates the user if required for a request. It compares the user name and password information provided by the CredentialsInterceptor against data in memory obtained from an XML file.

Since passwords are stored in text form, you should not use this module when security is important. Replace this module with a more secure one, such as the JDBCRealm.

This module must follow the CredentialsInterceptor.

#### Attributes

Attribute | Description | Default
--- | --- | ---
filename | File containing the user names, passwords, and roles. A leading '/' is optional. | /conf/users/tomcat-users.xml

#### Example(s)

    <SimpleRealm filename="conf/users/users.xml" />

XML file format:

    <tomcat-users>
      <user name="user name" password="password" roles="role[,role]" />
    </tomcat-users>

### SimpleSessionStore

Type: Session

#### Description

Creates, stores, and maintains session objects in a simple in-memory pool.

Note: This module must follow the SessionId module.

#### Attributes

Attribute | Description | Default
--- | --- | ---
maxActiveSessions | Maximum number of active sessions allowed. Attempts to create sessions beyond this limit will fail. If set to "-1", then there is no limit to the number of active sessions. | -1

#### Example(s)

    <SimpleSessionStore maxActiveSessions="-1" />

### StaticInterceptor

Type: Generator

#### Description

Generates the response for requests that map to static files or directories. The display of directory listings may be disabled.

In Tomcat 3.3.1, some additional attributes were added to allow control of locale and character encoding of directory listings.

#### Attributes

Attribute | Description | Default
--- | --- | ---
listings | Enables the display of directory listings when requested. | true
useAcceptLanguage [Tomcat 3.3.1] | Enables the use of an Accept-Language header in the request to determine the locale. If `false`, then the system default locale (i.e. Locale.getDefault()) is used. | true
useCharset [Tomcat 3.3.1] | Specifies the desired character set to use for encoding the directory listings. If unset, the default ISO-8859-1 is used. If set to "locale", then the locale established by the `useAcceptLanguage` attribute is used. | not specified
useInternal [Tomcat 3.3.2] | Controls how to handle welcome pages for URLs ending in "/". If `true`, then the welcome page is served via an internal sub-request. If `false` than it returns an external redirect to the actual welcome page URL. | false
strict23Welcome [Tomcat 3.3.2] | Controls how to handle welcome pages for mapped servlets If `true`, then the mapped servlets are checked for a possible match. If `false` than only physical files are checked. | false

#### Example(s)

    <StaticInterceptor listing="false" />
    <StaticInterceptor listing="true"
            useAcceptLanguag="true" useCharset="locale"/>
    <StaticInterceptor listing="true"
            useAcceptLanguag="true" useCharset="UTF-8"/>
    <StaticInterceptor listing="true"
            useAcceptLanguag="false" useCharset="locale"/>

### TagPoolManagerInterceptor

Type: Servlet 2.2 Facade

#### Description

Handles an enhancement to tag libary support by managing a pool tag objects. Tag objects will be created the first time a JSP page runs. After use the tag objects are placed in a pool. The next time the JSP page runs, the tag objects are retrieved from the pool rather than recreated.

If this module is not present, tag objects can't be retrieved from the pool and tag objects are created for each use.

#### Attributes

This module has no user settable attributes.

#### Example(s)

    <TagPoolManagerInterceptor />

### TrustedLoader

Type: Configuration

#### Description

Provides special handling for "trusted" contexts which have a `interceptors.xml` file in their `WEB-INF` directory. This file can specify modules to be added to the server as if they were specified in the `server.xml` file.

#### Attributes

This module has no user settable attributes.

#### Example(s)

    <TrustedLoader />

### WebXmlReader

Type: Servlet 2.2 Facade

#### Description

Reads the `WEB-INF/web.xml` file for each context.

#### Attributes

Attribute | Description | Default
--- | --- | ---
validate | Enables validation of the `web.xml` when read. After the first validation, a `webxmlval.txt` file is written to the context's work directory. On subsequent startups of Tomcat, validation is skipped if the `webxmlval.txt` remains newer than the `web.xml` file. | true

#### Example(s)

    <WebXmlReader validate="false" />

### WorkDirSetup

Type: Configuration

#### Description

Set the "work" directory for contexts which don't have the "work" directory specified explicitly.

#### Attributes

Attribute | Description | Default
--- | --- | ---
cleanWorkDir | Deletes context "work" directories as each context is started and shutdown. It is recommended that you only set this `true` during development if it serves a purpose. | false
useWebInf | If `true`, defaults the "work" directory to `WEB-INF/TOMCAT_WORKDIR`. If `false`, defaults the "work" directory to `workDirBase/host/context path`, where `host` is the context's virtual host name, or "DEFAULT" if a virtual host name isn't set. If the virtual host name is an IP address, the colons will be replaced with '_'. | false
workDirBase | The base directory for work directories when `useWebInf` is `false`. | ContextManager's `work` setting which defaults to "work"

#### Example(s)

    <WorkDirSetup cleanWorkDir="false" workDirBase="work" />