Turning off directory listings by default is a good security practice. I only
wait for the all the tomcat user questions of how to turn it on instead of off ;)
-Tim
Mark Thomas wrote:
------- Additional Comments From [EMAIL PROTECTED] 2005-11-08 23:45
-------
(In reply to comment #5)
The abstraction layer will make directory listings expensive (actually,
directory listings in Java are going to be expensive regardless), so I
don't see
how this can be optimized.
Looking at the profiler output, I agree that this will always be slow.
Closer inspection shows that at best I could reduce the time spent
generating the listing by about a third. Not enough to make a major
difference to this case.
Therefore, a warning in the docs is called for. Something like:
"Directory listings of directories containing many entries is an
expensive process. Multiple requests for large directory listings can
consume significant proportions of server resources. Use this option
with caution."
The only remaining question is whether we turn directory listings off by
default. Thoughts?
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
