Tomcat: Enable/Disable Directory Listing

Tomcat directory listing feature allows the users to see a list of files and directories when they navigate to a directory without a default file (like index.html). By default, the directory listing is enabled in Tomcat. However, for security reasons or user experience, we may want to disable this feature.

Let’s see how you can enable or disable directory listing in the Tomcat server.

1. Enabling Directory Listing for ALL Webapps

To enable directory listing for all the web applications, you could modify the <CATALINA_HOME>\conf\web.xml, by changing “listings” from “false” to “true” for the “default” servlet, as follows:

<!-- The default servlet for all web applications, that serves static     -->
<!-- resources.  It processes all requests that are not mapped to other   -->
<!-- servlets with servlet mappings.                                      -->
<servlet>
  <servlet-name>default</servlet-name>
  <servlet-class>org.apache.catalina.servlets.DefaultServlet</servlet-class>
  <init-param>
    <param-name>debug</param-name>
    <param-value>0</param-value>
  </init-param>
  <init-param>
    <param-name>listings</param-name>
    <param-value>true</param-value>  <!-- This enables directory listing -->
  </init-param>
  <load-on-startup>1</load-on-startup>
</servlet>
     
<!-- The mapping for the default servlet -->
<servlet-mapping>
  <servlet-name>default</servlet-name>
  <url-pattern>/</url-pattern>
</servlet-mapping>
    
<!-- ==================== Default Welcome File List ===================== -->
<!-- When a request URI refers to a directory, the default servlet looks  -->
<!-- for a "welcome file" within that directory and, if present,          -->
<!-- to the corresponding resource URI for display.  If no welcome file   -->
<!-- is present, the default servlet either serves a directory listing,   -->
<!-- or returns a 404 status, depending on how it is configured.          -->
<welcome-file-list>
  <welcome-file>index.html</welcome-file>
  <welcome-file>index.htm</welcome-file>
  <welcome-file>index.jsp</welcome-file>
</welcome-file-list>

The above configuration maps URL “\” (root directory of the web context) to the Java class DefaultServlet. We enable directory listing by changing the servlet’s initialization parameter listings to true.

If a user requests for a directory, and the directory listing is enabled and it contains one of the files in the <welcome-file> list, the welcome file will be served; otherwise, the directory listing will be served. On the other hand, if a directory request is received and the directory listing is not enabled, the server returns an error “404 Page Not Found”.

2. Enabling Directory Listing for a Particular Webapp

If you wish to allow directory listing of a particular web application only, you could disable the directory listing in “<CATALINA_HOME>\conf\web.xml” globally, and define the following <servlet> and <servlet-mapping> in your application-specific WEB-INF\web.xml, as follows:

<servlet>
  <servlet-name>DirectoryListing</servlet-name>
  <servlet-class>com.package.MyServlet</servlet-class>
  <init-param>
    <param-name>debug</param-name>
    <param-value>0</param-value>
  </init-param>
  <init-param>
    <param-name>listings</param-name>
    <param-value>true</param-value>  <!-- This enables directory listing -->
  </init-param>
</servlet>
    
<servlet-mapping>
  <servlet-name>DirectoryListing</servlet-name>
  <url-pattern>/</url-pattern>
</servlet-mapping>

Please note that enabling directory listing is handy for the test server but NOT desired for the production server.

Also, restarting Tomcat is necessary to apply the configuration changes.

Happy Learning !!