Restrict remote access to folder inside tomcat webapp folder - spring-boot

Question

I have Spring Boot micro-service based application hosted on Tomcat 9. So, I have multiple folders deployed in {{tomcat root dir}}/webapps folder. I want only one folder to be accessible from outside network (gateway service). Others folder should be accessible only from localhost.
So, how can I achieve this without adding context.xml? I know this can be achieved by adding context.xml but context.xml is getting overwritten after every war deployment.
So want to check if this can be achieved at more global level like modifying server.xml.

Answer 1

Valves must be defined in a <Context> section, but adding a META-INF/context.xml to your application is not the only way to define a context.
If you want to restrict most applications to localhost, the easiest way is to modify $CATALINA_BASE/conf/context.xml:
<Context>
...
<Valve className="org.apache.catalina.valves.RemoteAddrValve"
allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1"" />
</Context>
or $CATALINA_BASE/conf/<engine_name>/<host_name>/context.xml.default (usually $CATALINA_BASE/conf/Catalina/localhost/context.xml.default) if you wish the changes to apply only to a single host.
Every web application context will inherit the <Valve>s in the aforementioned files. Since you want to have a web application (let's say /pubApp) without these restrictions you need to create a file $CATALINA_BASE/conf/<engine_name>/<host_name>/pubApp.xml and set the override attribute to true:
<Context override="true">
<!-- Remember to copy all configuration values from `conf/context.xml`
and `conf/<engine_name>/<host_name>/context.xml.default`
that you wish to apply, since they will not be read anymore.
-->
...
</Context>