How can I configure restriction for URL generated by opencms application on Apache Tomcat?

I tried

<Location "/cs/intranet">
order deny,allow
deny from all
allow from XXX.XXX.XXX.XXX

But folder does not exist physically, just url.



Something like this?

<RequireAll "/cs/intranet">
    Require all denied
    Require ip XXX.XXX.XXX.XXX
  • 1
    What you tried looks like configuration for Apache server, not for Tomcat. Tomcat configuration is pure XML as far as I know. Is your Tomcat server running as a backend behind an Apache reverse proxy? Commented Sep 30, 2019 at 16:01
  • @StephenOstermiller Yes, it is running as a backend behind an Apache reversy proxy.
    – genderbee
    Commented Sep 30, 2019 at 18:25
  • What version of Apache? The order and deny are for Apache 2.2 and earlier. Apache 2.4 and later should use the require keyword. See httpd.apache.org/docs/2.4/howto/access.html There is a backwards compatibility module for 2.4 but I've only gotten it to work in .htaccess. If you are making those changes in a .conf file under 2.4, you'll need the new syntax. Which file did you try that in? Commented Sep 30, 2019 at 18:53
  • @StephenOstermiller Server version: Apache/2.4.7 (Ubuntu). I don't understand how can I use Require for my issue? No .htaccess file is possible, just conf. See my edit. Thanks.
    – genderbee
    Commented Sep 30, 2019 at 20:03

2 Answers 2


It should be as simple as:

<Location "/cs/intranet">
    require ip XXX.XXX.XXX.XXX

The Upgrading to 2.4 from 2.2 - Apache HTTP Server Version 2.4 document gives a similar example of upgrading from:

Order Deny,Allow
Deny from all
Allow from example.org


Require host example.org

because the default under 2.4 if it doesn't meet the requirement, the request is denied.

Your use of <Location> is correct. According to the core documentation that is to match the URL, and not necessarily a directory in the file system.

  • Thanks, but seems it is not working. I tried various combinations and site is still accessible.
    – genderbee
    Commented Oct 1, 2019 at 7:24

At the end, ProxyMatch is the way to do it.

<ProxyMatch "/cs/interni" >
    Order Deny,Allow
    Deny from all
    Allow from XXX.XXX.XXX.XXX

Thanks to all.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.