Apache Tomcat 9 Configuration Reference (9.0.117) - The Host Container

## The Host Container

### Table of Contents

- Introduction
- Attributes
  1. Common Attributes
  2. Standard Implementation
- Nested Components
- Special Features
  1. Logging
  2. Access Logs
  3. Automatic Application Deployment
  4. Host Name Aliases
  5. Lifecycle Listeners
  6. Request Filters
  7. Single Sign On
  8. User Web Applications
  9. Custom context.xml and web.xml

### Introduction

The Host element represents a virtual host, which is an association of a network name for a server (such as "www.mycompany.com") with the particular server on which Tomcat is running. For clients to be able to connect to a Tomcat server using its network name, this name must be registered in the Domain Name Service (DNS) server that manages the Internet domain you belong to - contact your Network Administrator for more information.

In many cases, System Administrators wish to associate more than one network name (such as `www.mycompany.com` and `company.com`) with the same virtual host and applications. This can be accomplished using the Host Name Aliases feature discussed below.

One or more Host elements are nested inside an Engine element. Inside the Host element, you can nest Context elements for the web applications associated with this virtual host. Exactly one of the Hosts associated with each Engine MUST have a name matching the `defaultHost` attribute of that Engine.

Clients normally use host names to identify the server they wish to connect to. This host name is also included in the HTTP request headers. Tomcat extracts the host name from the HTTP headers and looks for a Host with a matching name. If no match is found, the request is routed to the default host. The name of the default host does not have to match a DNS name (although it can) since any request where the DNS name does not match the name of a Host element will be routed to the default host.

The description below uses the variable name $CATALINA_BASE to refer the base directory against which most relative paths are resolved. If you have not configured Tomcat for multiple instances by setting a CATALINA_BASE directory, then $CATALINA_BASE will be set to the value of $CATALINA_HOME, the directory into which you have installed Tomcat.

### Attributes

#### Common Attributes

All implementations of Host support the following attributes:

Attribute | Description
--- | ---
`appBase` | The Application Base directory for this virtual host. This is the pathname of a directory that may contain web applications to be deployed on this virtual host. You may specify an absolute pathname, or a pathname that is relative to the `$CATALINA_BASE` directory. See Automatic Application Deployment for more information on automatic recognition and deployment of web applications. If not specified, the default of `webapps` will be used.
`xmlBase` | The XML Base directory for this virtual host. This is the pathname of a directory that may contain context XML descriptors to be deployed on this virtual host. You may specify an absolute pathname for this directory, or a pathname that is relative to the `$CATALINA_BASE` directory. See Automatic Application Deployment for more information on automatic recognition and deployment of web applications. If not specified the default of `conf/<engine_name>/<host_name>` will be used.
`createDirs` | If set to `true`, Tomcat will attempt to create the directories defined by the attributes `appBase` and `xmlBase` during the startup phase. The default value is `true`. If set to `true`, and directory creation fails, an error message will be printed out but will not halt the startup sequence.
`autoDeploy` | This flag value indicates if Tomcat should check periodically for new or updated web applications while Tomcat is running. If `true`, Tomcat periodically checks the `appBase` and `xmlBase` directories and deploys any new web applications or context XML descriptors found. Updated web applications or context XML descriptors will trigger a reload of the web application. The default is `true`. See Automatic Application Deployment for more information.
`backgroundProcessorDelay` | This value represents the delay in seconds between the invocation of the backgroundProcess method on this host and its child containers, including all contexts. Child containers will not be invoked if their delay value is not negative (which would mean they are using their own processing thread). Setting this to a positive value will cause a thread to be spawn. After waiting the specified amount of time, the thread will invoke the backgroundProcess method on this host and all its child containers. A host will use background processing to perform live web application deployment related tasks. If not specified, the default value for this attribute is -1, which means the host will rely on the background processing setting of its parent engine.
`className` | Java class name of the implementation to use. This class must implement the `org.apache.catalina.Host` interface. If not specified, the standard value (defined below) will be used.
`deployIgnore` | A regular expression defining paths to ignore when `autoDeploy` and `deployOnStartup` are set. This allows you to keep your configuration in a version control system, for example, and not deploy a `.svn`, `.git` or other configuration control system folder that happens to be in the `appBase`. This regular expression is relative to `appBase`. It is also anchored, meaning the match is performed against the entire file/directory name. So, `foo` matches only a file or directory named `foo` but not `foo.war`, `foobar`, or `myfooapp`. To match anything with "foo", you could use `.*foo.*`. See Automatic Application Deployment for more information.
`deployOnStartup` | This flag value indicates if web applications from this host should be automatically deployed when Tomcat starts. The default is `true`. See Automatic Application Deployment for more information.
`failCtxIfServletStartFails` | Set to `true` to have each child contexts fail its startup if any of its servlet that has load-on-startup >=0 fails its own startup. Each child context may override this attribute. If not specified, the default value of `false` is used.
`name` | Usually the network name of this virtual host, as registered in your Domain Name Service server. Regardless of the case used to specify the host name, Tomcat will convert it to lower case internally. One of the Hosts nested within an Engine MUST have a name that matches the `defaultHost` setting for that Engine. See Host Name Aliases for information on how to assign more than one network name to the same virtual host. The name can not contain a wildcard, this is only valid in an Alias.
`startStopThreads` | The number of threads this Host will use to start child Context elements in parallel. The same thread pool will be used to deploy new Contexts if automatic deployment is being used. As the thread pool is shared at the Server level, if more than one Host specifies this setting, only the maximum value will apply and will be used for all except for the special value 1. If not specified, the default value of 1 will be used. If 1 thread is used then rather than using an `ExecutorService` the current thread will be used.
`undeployOldVersions` | This flag determines if Tomcat, as part of the auto deployment process, will check for old, unused versions of web applications deployed using parallel deployment and, if any are found, remove them. This flag only applies if `autoDeploy` is `true`. If not specified the default value of `false` will be used.

#### Standard Implementation

The standard implementation of Host is org.apache.catalina.core.StandardHost. It supports the following additional attributes (in addition to the common attributes listed above):

Attribute | Description
--- | ---
`copyXML` | Set to `true` if you want a context XML descriptor embedded inside the application (located at `/META-INF/context.xml`) to be copied to `xmlBase` when the application is deployed. On subsequent starts, the copied context XML descriptor will be used in preference to any context XML descriptor embedded inside the application even if the descriptor embedded inside the application is more recent. The default is `false`. Note if deployXML is `false`, this attribute will have no effect.
`deployXML` | Set to `false` if you want to disable parsing the context XML descriptor embedded inside the application (located at `/META-INF/context.xml`). Security conscious environments should set this to `false` to prevent applications from interacting with the container's configuration. The administrator will then be responsible for providing an external context configuration file, and putting it in the location defined by the xmlBase attribute. If this flag is `false`, a descriptor is located at `/META-INF/context.xml` and no descriptor is present in xmlBase then the context will fail to start in case the descriptor contains necessary configuration for secure deployment (such as a RemoteCIDRValve) which should not be ignored. The default is `true` unless a security manager is enabled when the default is `false`. When running under a security manager this may be enabled on a per web application basis by granting the `org.apache.catalina.security.DeployXmlPermission` to the web application. The Manager and Host Manager applications are granted this permission by default so that they continue to work when running under a security manager.
`errorReportValveClass` | Java class name of the error reporting valve which will be used by this Host. The responsibility of this valve is to output error reports. Setting this property allows to customize the look of the error pages which will be generated by Tomcat. This class must implement the `org.apache.catalina.Valve` interface. If none is specified, the value `org.apache.catalina.valves.ErrorReportValve` will be used by default. if set to an empty string, the error report will be disabled.
`unpackWARs` | Set to `true` if you want web applications that are placed in the `appBase` directory as web application archive (WAR) files to be unpacked into a corresponding disk directory structure, `false` to run such web applications directly from a WAR file. The default is `true`. See Automatic Application Deployment for more information. Note: If Tomcat expands the WAR file then it will add a file (`/META-INF/war-tracker`) to the unpacked directory structure which it uses to detect changes in the WAR file while Tomcat is not running. Any such change will trigger the deletion of the expanded directory and the deployment of the updated WAR file when Tomcat next starts. Note: Running with this option set to `false` will incur a performance penalty. To avoid a significant performance penalty, the web application should be configured such that class scanning for Servlet 3.0+ pluggability features is not required. Users may also wish to consider the ExtractingRoot Resources implementation.
`workDir` | Pathname to a scratch directory to be used by applications for this Host. Each application will have its own sub directory with temporary read-write use. Configuring a Context workDir will override use of the Host workDir configuration. This directory will be made visible to servlets in the web application by a servlet context attribute (of type `java.io.File`) named `javax.servlet.context.tempdir` as described in the Servlet Specification. If not specified, a suitable directory underneath `$CATALINA_BASE/work` will be provided.

### Nested Components

You can nest one or more Context elements inside this Host element, each representing a different web application associated with this virtual host.

You can nest at most one instance of the following utility components by nesting a corresponding element inside your Host element:

- Realm - Configure a realm that will allow its database of users, and their associated roles, to be shared across all Contexts nested inside this Host (unless overridden by a Realm configuration at a lower level).

### Special Features

#### Logging

A host is associated with the `org.apache.catalina.core.ContainerBase.[engine_name].[host_name]` log category. Note that the brackets are part of the name, don't omit them.

#### Access Logs

When you run a web server, one of the output files normally generated is an access log, which generates one line of information for each request processed by the server, in a standard format. Catalina includes an optional Valve implementation that can create access logs in the same standard format created by web servers, or in any number of custom formats.

You can ask Catalina to create an access log for all requests processed by an Engine, Host, or Context by nesting a Valve element like this:

    <Host name="localhost" ...>
      ...
      <Valve className="org.apache.catalina.valves.AccessLogValve"
             prefix="localhost_access_log" suffix=".txt"
             pattern="common"/>
      ...
    </Host>

See Access Logging Valves for more information on the configuration attributes that are supported.

#### Automatic Application Deployment

If you are using the standard Host implementation with default settings then applications in the appBase or with context files in the configBase are automatically deployed when Tomcat starts (the `deployOnStartup` property defaults to `true`) and reloaded or redeployed (as appropriate) when a change is detected while Tomcat is running (the `autoDeploy` attribute also defaults to `true`).

`deployOnStartup` and `autoDeploy` trigger execution of exactly the same code so the behaviour is very similar. However, there is one key difference. When Tomcat starts it has no knowledge of which files are the same, which have been changed and which are new. It therefore treats all files as new. While Tomcat is running, it can differentiate between unchanged, modified and new files. This leads to some differences in behaviour between files being modified while Tomcat is running and files being modified while Tomcat is stopped.

When you use automatic deployment, related files (a web application may have a context.xml file, a WAR and a directory) that exist in the Host's appBase and/or configBase must conform to the expected naming convention. In short, this means files for the same web application must share the same base name.

The automatic deployment process identifies new and/or modified web applications using the following search order:

1. Web applications with a context.xml file located in the Host's configBase.
2. Web applications with a WAR file located in the Host's appBase that have not already been identified during the scan for context.xml files.
3. Web applications with a directory located in the Host's appBase that have not already been identified during the scans for context.xml and/or WAR files.

When `autoDeploy` is `true`, the automatic deployment process will monitor the deployed web applications for changes. Depending on exactly what changes, the web application will either be re-deployed or reloaded. Re-deployment involves the creation of a new web application and, if using the standard session manager, user sessions will not be retained. Reloading uses the existing web application but re-parses the web.xml and reloads any classes. If using the standard session manager, user sessions will be persisted.

Users may add to the files that the automatic deployment process monitors for reloading (i.e. any change to one of these files triggers a reload of the web application) by adding a WatchedResources element to the context.xml file. See the Context documentation for further details.

When using automatic deployment, the `docBase` defined by an XML Context file should be outside of the `appBase` directory. If this is not the case, difficulties may be experienced deploying the web application or the application may be deployed twice. The `deployIgnore` attribute can be used to avoid this situation.

Note that if you are defining contexts explicitly in server.xml, you should probably turn off automatic application deployment or specify `deployIgnore` carefully. Otherwise, the web applications will each be deployed twice, and that may cause problems for the applications.

There are many possible combinations of settings, new files, changed files and deleted files. A separate page describes the expected behaviour of the automatic deployment process in many of these scenarios.

#### Host Name Aliases

In many server environments, Network Administrators have configured more than one network name (in the Domain Name Service (DNS) server), that resolve to the IP address of the same server. Normally, each such network name would be configured as a separate Host element in `conf/server.xml`, each with its own set of web applications.

However, in some circumstances, it is desirable that two or more network names should resolve to the same virtual host, running the same set of applications. A common use case for this scenario is a corporate web site, where it is desirable that users be able to utilize either `www.mycompany.com` or `company.com` to access exactly the same content and applications.

This is accomplished by utilizing one or more Alias elements nested inside your Host element. For example:

    <Host name="www.mycompany.com" ...>
      ...
      <Alias>mycompany.com</Alias>
      ...
    </Host>

In order for this strategy to be effective, all of the network names involved must be registered in your DNS server to resolve to the same computer that is running this instance of Catalina.

Aliases may also use the wildcard form (`*.domainname`), unlike for the name attribute of a Host.

#### Lifecycle Listeners

If you have implemented a Java object that needs to know when this Host is started or stopped, you can declare it by nesting a Listener element inside this element. The class name you specify must implement the `org.apache.catalina.LifecycleListener` interface, and it will be notified about the occurrence of the corresponding lifecycle events. Configuration of such a listener looks like this:

    <Host name="localhost" ...>
      ...
      <Listener className="com.mycompany.mypackage.MyListener" ... >
      ...
    </Host>

Note that a Listener can have any number of additional properties that may be configured from this element. Attribute names are matched to corresponding JavaBean property names using the standard property method naming patterns.

#### Request Filters

You can ask Catalina to check the IP address, or host name, on every incoming request directed to the surrounding Engine, Host, or Context element. The remote address or name will be checked against configured "accept" and/or "deny" filters, which are defined using `java.util.regex` Regular Expression syntax. Requests that come from locations that are not accepted will be rejected with an HTTP "Forbidden" error. Example filter declarations:

    <Host name="localhost" ...>
      ...
      <Valve className="org.apache.catalina.valves.RemoteHostValve"
             allow=".*\.mycompany\.com|www\.yourcompany\.com"/>
      <Valve className="org.apache.catalina.valves.RemoteCIDRValve"
             deny="192.168.1.0/24"/>
      ...
    </Host>

See Remote Address Filter and Remote Host Filter for more information about the configuration options that are supported.

#### Single Sign On

In many environments, but particularly in portal environments, it is desirable to have a user challenged to authenticate themselves only once over a set of web applications deployed on a particular virtual host. This can be accomplished by nesting an element like this inside the Host element for this virtual host:

    <Host name="localhost" ...>
      ...
      <Valve className="org.apache.catalina.authenticator.SingleSignOn"/>
      ...
    </Host>

The Single Sign On facility operates according to the following rules:

- All web applications configured for this virtual host must share the same Realm. In practice, that means you can nest the Realm element inside this Host element (or the surrounding Engine element), but not inside a Context element for one of the involved web applications.
- As long as the user accesses only unprotected resources in any of the web applications on this virtual host, they will not be challenged to authenticate themselves.
- As soon as the user accesses a protected resource in any web application associated with this virtual host, the user will be challenged to authenticate himself or herself, using the login method defined for the web application currently being accessed.
- Once authenticated, the roles associated with this user will be utilized for access control decisions across all of the associated web applications, without challenging the user to authenticate themselves to each application individually.
- As soon as the user logs out of one web application (for example, by invalidating the corresponding session if form based login is used), the user's sessions in all web applications will be invalidated. Any subsequent attempt to access a protected resource in any application will require the user to authenticate himself or herself again.
- The Single Sign On feature utilizes HTTP cookies to transmit a token that associates each request with the saved user identity, so it can only be utilized in client environments that support cookies.

#### User Web Applications

Many web servers can automatically map a request URI starting with a tilde character ("~") and a username to a directory (commonly named `public_html`) in that user's home directory on the server. You can accomplish the same thing in Catalina by using a special Listener element like this (on a Unix system that uses the `/etc/passwd` file to identify valid users):

    <Host name="localhost" ...>
      ...
      <Listener className="org.apache.catalina.startup.UserConfig"
                directoryName="public_html"
                userClass="org.apache.catalina.startup.PasswdUserDatabase"/>
      ...
    </Host>

On a server where `/etc/passwd` is not in use, you can request Catalina to consider all directories found in a specified base directory (such as `c:\Homes` in this example) to be considered "user home" directories for the purposes of this directive:

    <Host name="localhost" ...>
      ...
      <Listener className="org.apache.catalina.startup.UserConfig"
                directoryName="public_html"
                homeBase="c:\Homes"
                userClass="org.apache.catalina.startup.HomesUserDatabase"/>
      ...
    </Host>

If a user home directory has been set up for a user named `craigmcc`, then its contents will be visible from a client browser by making a request to a URL like:

    http://www.mycompany.com:8080/~craigmcc

Successful use of this feature requires recognition of the following considerations:

- Each user web application will be deployed with characteristics established by the global and host level default context settings.
- It is legal to include more than one instance of this Listener element. This would only be useful, however, in circumstances where you wanted to configure more than one "homeBase" directory.
- The operating system username under which Catalina is executed MUST have read access to each user's web application directory, and all of its contents.

#### Custom context.xml and web.xml

You can override the default values found in `conf/context.xml` and `conf/web.xml` files from `$CATALINA_BASE` for each virtual host. Tomcat will look for files named `context.xml.default` and `web.xml.default` in the directory specified by `xmlBase` and merge the files into those found in the default ones.