Question: I want to restrict access to certain URLs in my Tomcat webapp. 
Only 3 known IP addresses should be allowed access to URLs that fit a certain pattern.

e.g. `http://example.com:1234/abc/personId`

How can I achieve this?

Answer: 
You can use something like this to block ips and if you are behind proxy:

```
<Context path="/manager" docBase="manager" reloadable="true" privileged="true" >
  <Valve className="org.apache.catalina.valves.RemoteIpValve"/>
  <Valve className="org.apache.catalina.valves.RemoteHostValve" allow="<your IP regex>"/>
</Context>

```
I wouldn't restrict access by IP address, for the following reasons:

* Doing so on say internal addresses, e.g. 10.0.0.0/24, means you implicitly trust this entire range. What happens if it is compromised?
* Not all of your customers can or will be able to get static IP addresses - assuming you might want to allow some customers access.
* Customers behind gateway devices where proxies do not support `x-forwarded-for` headers are going to just have the IP of the gateway device; trusting that IP trusts *everyone* behind the gateway, again assuming you might want to give some customers access.

Instead, if you need to run a system where some calls are only accessible to certain users, I'd use authentication - SSL client side certificates work quite well for this purpose. Alternatively, you could use something like [OAuth](http://oauth.net/).