Which is more secure: Tomcat standalone or Tomcat behind Apache?
Update 2021:
I dont like my old answer. I am not changing it. But I don't like it.
Before update 2010:
What would make Tomcat + Apache less secure?
- Larger surface of attack. More code is parsing the request. So there is larger chance that a security bug is encountered/exploited.
- More fixes to install, More configuration files to get correct and more security setting to get right. Greater chance to human error.
What would make Tomcat + Apache more secure?
Don't know.