How to fix Tomcat Manager 403 Access Denied

Why you get a 403

The Manager and Host Manager applications contain a rule (a RemoteAddrValve) that allows only 127.0.0.1 and ::1. A request from your office or home is refused with "403 Access Denied". The page tells you the same: "By default the Manager is only accessible from a browser running on the same machine as Tomcat."

Exposing Manager on the public internet is dangerous. Attackers scan for it all the time and try common passwords. A weak password lets them upload their own WAR and run code on your server.

The safe way: an SSH tunnel

On your own computer run:

ssh -L 8080:127.0.0.1:8080 youruser@your-server

Keep that session open and browse to http://localhost:8080/manager/html. The request reaches Tomcat from 127.0.0.1, so the rule lets it through. Nothing changes on the server. If your local port 8080 is busy, use -L 9090:127.0.0.1:8080 and open port 9090.

Create a user

Manager also needs a login. In tomcat-users.xml (/etc/tomcat10/ on Debian and Ubuntu, conf/ in a tarball install) add, inside <tomcat-users>:

<role rolename="manager-gui"/>
<user username="admin" password="USE-A-LONG-RANDOM-PASSWORD" roles="manager-gui"/>

Generate the password with openssl rand -base64 24. Restart Tomcat. A missing role gives a 403 too, but with a different page: "You are not authorized to view this page". On Debian and Ubuntu the web application itself is a separate package, sudo apt install tomcat10-admin.

If it still shows 403 through the tunnel

• You are behind a proxy that makes requests appear to come from another address. Open Tomcat's port directly through the tunnel, not through the public site.
• IPv6 on localhost: use 127.0.0.1 in the URL, not localhost, or allow ::1 in the rule.
• Find the rule: sudo find / -name context.xml -path "*manager*" 2>/dev/null and /etc/tomcat10/Catalina/localhost/manager.xml on Debian packages.

Do you need Manager at all?

For a single application, copying the WAR with scp and running a deploy command is simpler and smaller in attack surface. See Deploy a WAR file to Tomcat. If you must open Manager to a fixed office address, change the rule's allow pattern to that one address and put the site behind HTTPS. Never allow .*.

Last updated October 29, 2026.