Skip to content

Container Considerations

Java web containers such as Tomcat or Jetty ship with configurations that allow for fast startup, but don't always deliver the best performance.

Optimize your JVM

Set the following performance settings in the Java virtual machine (JVM) for your container. These settings are not specific to any container.

Option Description
-Xms128m By starting with a larger heap GeoServer will not need to pause and ask the operating system for more memory during heavy load. The setting -Xms128m will tell the virtual machine to acquire grab a 128m heap memory on initial startup.
-Xmx756M Defines an upper limit on how much heap memory Java will request from the operating system (use more if you have excess memory). By default, the JVM will use ¼ of available system memory. The setting -Xms756m allocates 756MB of memory to GeoServer.
-XX:SoftRefLRUPolicyMSPerMB=36000 Increases the lifetime of "soft references" in GeoServer. GeoServer uses soft references to cache datastore, spatial reference systems, and other data structures. By increasing this value to 36000 (which is 36 seconds) these values will stay in memory longer increasing the effectiveness of the cache.
-XX:+UseParallelGC This garbage collector pauses the application while using several threads to recover memory. Recommended if your GeoServer will be under light load and can tolerate pauses to clean up memory.
-XX:+UseParNewGC Enables use of the concurrent mark sweep (CMS) garbage collector uses multiple threads to recover memory while the application is running. Recommended for GeoServer under continuous use, with heap sizes of less than 6GB.
–XX:+UseG1GC The default garbage collector since Java 9. Enables use of the Garbage First Garbage Collector (G1) using background threads to scan memory while the application is running prior to cleanup. Recommended for GeoServer under continuous load and heap sizes of 6GB or more. Additionally you may experiment with -XX:+UseStringDeduplicationJVM to ask G1 to better manage common text strings in memory.

For more information about JVM configuration, see the article Performance tuning garbage collection in Java and The 4 Java Garbage Collectors.

Note

You can only use one garbage collector at a time. Please refrain from combining garbage collectors at runtime.

Note

If you're serving just vector data, you'll be streaming, so having more memory won't increase performance. If you're serving coverages, however, image processing will use a tile cache and benefit from more memory. As an administrator you can configure the portion of memory available as a tile cache (see the Server Config page in the Web administration interface section) - for example to use 0.75 to allocate 75% of the heap as a tile cache.

Note

You can try out memory settings on the command line to check settings/defaults prior to use.

To check settings use java -Xms128m -Xmx756m -XX:+PrintFlagsFinal -version | grep HeapSize:

uintx InitialHeapSize   := 134217728     {product}
uintx MaxHeapSize       := 792723456     {product}

Which when converted from bytes matches 128 MB initial heap size, and 756 MB max heap size.

Check defaults for your hardware using java -XX:+PrintFlagsFinal -version | grep HeapSize:

uintx InitialHeapSize   := 268435456     {product}
uintx MaxHeapSize       := 4294967296    {product}

The above results (from a 16 GB laptop) amount to initial heap size of 256m, and a max heap size of around 4 GB (or around ¼ of system memory).

Use newer Marlin rasterizer

To use a newer version of Marlin than that provided by your JVM, add the following to the JVM startup options:

-Xbootclasspath/a:$MARLIN_JAR
-Dsun.java2d.renderer=org.marlin.pisces.MarlinRenderingEngine

where $MARLIN_JAR is the location of the marlin*.jar file located in the geoserver/WEB-INF/lib directory or downloaded from the Marlin project.

The server status page shows which renderer is being used.

Enable CORS

Enable Cross-Origin Resource Sharing (CORS) to allow JavaScript applications outside of your own domain, or web browsers, to use GeoServer.

Enable CORS for Tomcat

The web archive distribution of GeoServer is tested with Tomcat. Use the following steps to enable CORS for Tomcat, more information on what this does and other options see the Tomcat CORS Filter documentation.

  1. Uncomment the following <filter> in webapps/geoserver/WEB-INF/web.xml:

    <?xml version="1.0" encoding="UTF-8"?>
    <web-app
            xmlns="http://xmlns.jcp.org/xml/ns/javaee"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
            metadata-complete="false"
            version="3.1">
        <display-name>GeoServer</display-name>
    
        <context-param>
            <param-name>serviceStrategy</param-name>
            <!-- Meaning of the different values :
    
                 PARTIAL-BUFFER2
                 - Partially buffers the first xKb to disk. Once that has buffered, the the
                   result is streamed to the user. This will allow for most errors to be caught
                   early.
    
                 BUFFER
                 - stores the entire response in memory first, before sending it off to
                   the user (may run out of memory)
    
                 SPEED
                 - outputs directly to the response (and cannot recover in the case of an
                   error)
    
                 FILE
                 - outputs to the local filesystem first, before sending it off to the user
              -->
            <param-value>PARTIAL-BUFFER2</param-value>
        </context-param>
    
        <context-param>
            <!-- see comments on the PARTIAL-BUFFER strategy -->
            <!-- this sets the size of the buffer.  default is "50" = 50kb -->
    
            <param-name>PARTIAL_BUFFER_STRATEGY_SIZE</param-name>
            <param-value>50</param-value>
        </context-param>
    
        <!--Can be true or false (defaults to: false). -->
        <!--When true the JSONP (text/javascript) output format is enabled -->
        <!--
        <context-param>
          <param-name>ENABLE_JSONP</param-name>
          <param-value>true</param-value>
        </context-param>
        -->
        <!--
        <context-param>
          <param-name>PROXY_BASE_URL</param-name>
          <param-value>http://82.58.146.45/geoserver</param-value>
        </context-param>
         -->
    
        <!--
       <context-param>
          <param-name>GEOSERVER_DATA_DIR</param-name>
           <param-value>C:\eclipse\workspace\geoserver_trunk\cite\confCiteWFSPostGIS</param-value>
       </context-param>
      -->
    
        <!-- pick up all spring application contexts -->
        <context-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath*:/applicationContext.xml classpath*:/applicationSecurityContext.xml</param-value>
        </context-param>
    
        <filter>
            <filter-name>FlushSafeFilter</filter-name>
            <filter-class>org.geoserver.filters.FlushSafeFilter</filter-class>
        </filter>
    
        <filter>
            <filter-name>Set Character Encoding</filter-name>
            <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
            <init-param>
                <param-name>encoding</param-name>
                <param-value>UTF-8</param-value>
            </init-param>
        </filter>
    
        <filter>
            <filter-name>SessionDebugger</filter-name>
            <filter-class>org.geoserver.filters.SessionDebugFilter</filter-class>
        </filter>
    
        <filter>
            <filter-name>filterChainProxy</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        </filter>
    
        <filter>
            <filter-name>xFrameOptionsFilter</filter-name>
            <filter-class>org.geoserver.filters.XFrameOptionsFilter</filter-class>
        </filter>
    
        <filter>
            <filter-name>GZIP Compression Filter</filter-name>
            <filter-class>org.geoserver.filters.GZIPFilter</filter-class>
            <init-param>
                <!-- The compressed-types parameter is a comma-separated list of regular expressions.
                     If a mime type matches any of the regular expressions then it will be compressed.
                     -->
                <param-name>compressed-types</param-name>
                <param-value>text/.*,.*xml.*,application/json,application/x-javascript</param-value>
            </init-param>
        </filter>
    
        <filter>
            <filter-name>Advanced Dispatch Filter</filter-name>
            <filter-class>org.geoserver.platform.AdvancedDispatchFilter</filter-class>
            <!--
            This filter allows for a single mapping to the spring dispatcher. However using /* as a mapping
            in a servlet mapping causes the servlet path to be "/" of the request. This causes problems with
            library like wicket and restlet. So this filter fakes the servlet path by assuming the first
            component of the path is the mapped path.
            -->
        </filter>
    
        <filter>
            <filter-name>Spring Delegating Filter</filter-name>
            <filter-class>org.geoserver.filters.SpringDelegatingFilter</filter-class>
            <!--
            This filter allows for filters to be loaded via spring rather than
            registered here in web.xml.  One thing to note is that for such filters
            init() is not called. INstead any initialization is performed via spring
            ioc.
            -->
        </filter>
    
        <filter>
            <filter-name>Thread locals cleanup filter</filter-name>
            <filter-class>org.geoserver.filters.ThreadLocalsCleanupFilter</filter-class>
            <!--
            This filter cleans up thread locals Geotools is setting up for concurrency and performance
            reasons
            -->
        </filter>
    
        <!-- Uncomment following filter to enable CORS in Jetty. Do not forget the second config block further down. -->
        <!--    
        <filter>
           <filter-name>cross-origin</filter-name>
           <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class>
           <init-param>
             <param-name>chainPreflight</param-name>
             <param-value>false</param-value>
           </init-param>
           <init-param>
             <param-name>allowedOrigins</param-name>
             <param-value>*</param-value>
           </init-param>
           <init-param>
             <param-name>allowedMethods</param-name>
             <param-value>GET,POST,PUT,DELETE,HEAD,OPTIONS</param-value>
           </init-param>
           <init-param>
             <param-name>allowedHeaders</param-name>
             <param-value>*</param-value>
           </init-param>
         </filter>
         -->
    
        <!-- Uncomment following filter to enable CORS in Tomcat. Do not forget the second config block further down. -->
        <!--    
        <filter>
           <filter-name>cross-origin</filter-name>
           <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
           <init-param>
             <param-name>cors.allowed.origins</param-name>
             <param-value>*</param-value>
           </init-param>
           <init-param>
             <param-name>cors.allowed.methods</param-name>
             <param-value>GET,POST,PUT,DELETE,HEAD,OPTIONS</param-value>
           </init-param>
           <init-param>
             <param-name>cors.allowed.headers</param-name>
             <param-value>*</param-value>
           </init-param>
        </filter>
        -->
    
        <!--
          THIS FILTER MAPPING MUST BE THE FIRST ONE, otherwise we end up with ruined chars in the input from the GUI
          See the "Note" in the Tomcat character encoding guide:
          http://wiki.apache.org/tomcat/FAQ/CharacterEncoding
        -->
        <filter-mapping>
            <filter-name>Set Character Encoding</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!-- Uncomment following filter-mapping to enable CORS -->
        <!--
        <filter-mapping>
            <filter-name>cross-origin</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
        -->
    
        <filter-mapping>
            <filter-name>FlushSafeFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>SessionDebugger</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>GZIP Compression Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>xFrameOptionsFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!--
          If you want to use your security system comment out this one too
        -->
        <filter-mapping>
            <filter-name>filterChainProxy</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>Advanced Dispatch Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>Spring Delegating Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>Thread locals cleanup filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!-- general initializer, should be first thing to execute -->
        <listener>
            <listener-class>org.geoserver.GeoserverInitStartupListener</listener-class>
        </listener>
    
        <!-- logging initializer, should execute before spring context startup -->
        <listener>
            <listener-class>org.geoserver.logging.LoggingStartupContextListener</listener-class>
        </listener>
    
        <!--  spring context loader -->
        <listener>
            <listener-class>org.geoserver.platform.GeoServerContextLoaderListener</listener-class>
        </listener>
    
        <!--  http session listener proxy -->
        <listener>
            <listener-class>org.geoserver.platform.GeoServerHttpSessionListenerProxy</listener-class>
        </listener>
    
        <!-- request context listener for session-scoped beans -->
        <listener>
            <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
        </listener>
    
        <!-- spring dispatcher servlet, dispatches all incoming requests -->
        <servlet>
            <servlet-name>dispatcher</servlet-name>
            <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        </servlet>
    
        <!-- single mapping to spring, this only works properly if the advanced dispatch filter is
             active -->
        <servlet-mapping>
            <servlet-name>dispatcher</servlet-name>
            <url-pattern>/*</url-pattern>
        </servlet-mapping>
    
        <session-config>
            <cookie-config>
                <http-only>true</http-only>
                <!-- The Secure flag should be set on session cookies but is commented out by default since it -->
                <!-- will break non-HTTPS web UI access and may cause problems with some proxy configurations. -->
                <!-- Uncomment the following line to add the Secure flag to session cookies. -->
                <!-- <secure>true</secure> -->
            </cookie-config>
            <tracking-mode>COOKIE</tracking-mode>
        </session-config>
    
        <mime-mapping>
            <extension>xsl</extension>
            <mime-type>text/xml</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>sld</extension>
            <mime-type>text/xml</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>json</extension>
            <mime-type>application/json</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>yaml</extension>
            <mime-type>text/plain</mime-type>
        </mime-mapping>
    
        <welcome-file-list>
            <welcome-file>index.html</welcome-file>
        </welcome-file-list>
    
    </web-app>
    
  2. Uncomment the following <filter-mapping>:

        <filter-mapping>
            <filter-name>FlushSafeFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>SessionDebugger</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>GZIP Compression Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>xFrameOptionsFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!--
          If you want to use your security system comment out this one too
    
        <listener>
            <listener-class>org.geoserver.GeoserverInitStartupListener</listener-class>
        </listener>
    
        <!-- logging initializer, should execute before spring context startup 
        <listener>
            <listener-class>org.geoserver.platform.GeoServerContextLoaderListener</listener-class>
        </listener>
    
        <!--  http session listener proxy 
        <listener>
            <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
        </listener>
    
        <!-- spring dispatcher servlet, dispatches all incoming requests 
        <servlet-mapping>
            <servlet-name>dispatcher</servlet-name>
            <url-pattern>/*</url-pattern>
        </servlet-mapping>
    
        <session-config>
            <cookie-config>
                <http-only>true</http-only>
                <!-- The Secure flag should be set on session cookies but is commented out by default since it 
                <!-- Uncomment the following line to add the Secure flag to session cookies. 
            </cookie-config>
            <tracking-mode>COOKIE</tracking-mode>
        </session-config>
    
        <mime-mapping>
            <extension>xsl</extension>
            <mime-type>text/xml</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>sld</extension>
            <mime-type>text/xml</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>json</extension>
            <mime-type>application/json</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>yaml</extension>
            <mime-type>text/plain</mime-type>
        </mime-mapping>
    
        <welcome-file-list>
            <welcome-file>index.html</welcome-file>
        </welcome-file-list>
    
    </web-app>
    
  3. Restart

Enable CORS for Jetty / binary installer

The standalone distributions of GeoServer include the Jetty application server. Use the following steps to enable CORS for Jetty, for more information on what this does and other options see the Jetty Cross Origin Filter documentation

  1. Uncomment the following <filter> in webapps/geoserver/WEB-INF/web.xml:

    <?xml version="1.0" encoding="UTF-8"?>
    <web-app
            xmlns="http://xmlns.jcp.org/xml/ns/javaee"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
            metadata-complete="false"
            version="3.1">
        <display-name>GeoServer</display-name>
    
        <context-param>
            <param-name>serviceStrategy</param-name>
            <!-- Meaning of the different values :
    
                 PARTIAL-BUFFER2
                 - Partially buffers the first xKb to disk. Once that has buffered, the the
                   result is streamed to the user. This will allow for most errors to be caught
                   early.
    
                 BUFFER
                 - stores the entire response in memory first, before sending it off to
                   the user (may run out of memory)
    
                 SPEED
                 - outputs directly to the response (and cannot recover in the case of an
                   error)
    
                 FILE
                 - outputs to the local filesystem first, before sending it off to the user
              -->
            <param-value>PARTIAL-BUFFER2</param-value>
        </context-param>
    
        <context-param>
            <!-- see comments on the PARTIAL-BUFFER strategy -->
            <!-- this sets the size of the buffer.  default is "50" = 50kb -->
    
            <param-name>PARTIAL_BUFFER_STRATEGY_SIZE</param-name>
            <param-value>50</param-value>
        </context-param>
    
        <!--Can be true or false (defaults to: false). -->
        <!--When true the JSONP (text/javascript) output format is enabled -->
        <!--
        <context-param>
          <param-name>ENABLE_JSONP</param-name>
          <param-value>true</param-value>
        </context-param>
        -->
        <!--
        <context-param>
          <param-name>PROXY_BASE_URL</param-name>
          <param-value>http://82.58.146.45/geoserver</param-value>
        </context-param>
         -->
    
        <!--
       <context-param>
          <param-name>GEOSERVER_DATA_DIR</param-name>
           <param-value>C:\eclipse\workspace\geoserver_trunk\cite\confCiteWFSPostGIS</param-value>
       </context-param>
      -->
    
        <!-- pick up all spring application contexts -->
        <context-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath*:/applicationContext.xml classpath*:/applicationSecurityContext.xml</param-value>
        </context-param>
    
        <filter>
            <filter-name>FlushSafeFilter</filter-name>
            <filter-class>org.geoserver.filters.FlushSafeFilter</filter-class>
        </filter>
    
        <filter>
            <filter-name>Set Character Encoding</filter-name>
            <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
            <init-param>
                <param-name>encoding</param-name>
                <param-value>UTF-8</param-value>
            </init-param>
        </filter>
    
        <filter>
            <filter-name>SessionDebugger</filter-name>
            <filter-class>org.geoserver.filters.SessionDebugFilter</filter-class>
        </filter>
    
        <filter>
            <filter-name>filterChainProxy</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        </filter>
    
        <filter>
            <filter-name>xFrameOptionsFilter</filter-name>
            <filter-class>org.geoserver.filters.XFrameOptionsFilter</filter-class>
        </filter>
    
        <filter>
            <filter-name>GZIP Compression Filter</filter-name>
            <filter-class>org.geoserver.filters.GZIPFilter</filter-class>
            <init-param>
                <!-- The compressed-types parameter is a comma-separated list of regular expressions.
                     If a mime type matches any of the regular expressions then it will be compressed.
                     -->
                <param-name>compressed-types</param-name>
                <param-value>text/.*,.*xml.*,application/json,application/x-javascript</param-value>
            </init-param>
        </filter>
    
        <filter>
            <filter-name>Advanced Dispatch Filter</filter-name>
            <filter-class>org.geoserver.platform.AdvancedDispatchFilter</filter-class>
            <!--
            This filter allows for a single mapping to the spring dispatcher. However using /* as a mapping
            in a servlet mapping causes the servlet path to be "/" of the request. This causes problems with
            library like wicket and restlet. So this filter fakes the servlet path by assuming the first
            component of the path is the mapped path.
            -->
        </filter>
    
        <filter>
            <filter-name>Spring Delegating Filter</filter-name>
            <filter-class>org.geoserver.filters.SpringDelegatingFilter</filter-class>
            <!--
            This filter allows for filters to be loaded via spring rather than
            registered here in web.xml.  One thing to note is that for such filters
            init() is not called. INstead any initialization is performed via spring
            ioc.
            -->
        </filter>
    
        <filter>
            <filter-name>Thread locals cleanup filter</filter-name>
            <filter-class>org.geoserver.filters.ThreadLocalsCleanupFilter</filter-class>
            <!--
            This filter cleans up thread locals Geotools is setting up for concurrency and performance
            reasons
            -->
        </filter>
    
        <!-- Uncomment following filter to enable CORS in Jetty. Do not forget the second config block further down. -->
        <!--    
        <filter>
           <filter-name>cross-origin</filter-name>
           <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class>
           <init-param>
             <param-name>chainPreflight</param-name>
             <param-value>false</param-value>
           </init-param>
           <init-param>
             <param-name>allowedOrigins</param-name>
             <param-value>*</param-value>
           </init-param>
           <init-param>
             <param-name>allowedMethods</param-name>
             <param-value>GET,POST,PUT,DELETE,HEAD,OPTIONS</param-value>
           </init-param>
           <init-param>
             <param-name>allowedHeaders</param-name>
             <param-value>*</param-value>
           </init-param>
         </filter>
         -->
    
        <!-- Uncomment following filter to enable CORS in Tomcat. Do not forget the second config block further down. -->
        <!--    
        <filter>
           <filter-name>cross-origin</filter-name>
           <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
           <init-param>
             <param-name>cors.allowed.origins</param-name>
             <param-value>*</param-value>
           </init-param>
           <init-param>
             <param-name>cors.allowed.methods</param-name>
             <param-value>GET,POST,PUT,DELETE,HEAD,OPTIONS</param-value>
           </init-param>
           <init-param>
             <param-name>cors.allowed.headers</param-name>
             <param-value>*</param-value>
           </init-param>
        </filter>
        -->
    
        <!--
          THIS FILTER MAPPING MUST BE THE FIRST ONE, otherwise we end up with ruined chars in the input from the GUI
          See the "Note" in the Tomcat character encoding guide:
          http://wiki.apache.org/tomcat/FAQ/CharacterEncoding
        -->
        <filter-mapping>
            <filter-name>Set Character Encoding</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!-- Uncomment following filter-mapping to enable CORS -->
        <!--
        <filter-mapping>
            <filter-name>cross-origin</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
        -->
    
        <filter-mapping>
            <filter-name>FlushSafeFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>SessionDebugger</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>GZIP Compression Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>xFrameOptionsFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!--
          If you want to use your security system comment out this one too
        -->
        <filter-mapping>
            <filter-name>filterChainProxy</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>Advanced Dispatch Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>Spring Delegating Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>Thread locals cleanup filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!-- general initializer, should be first thing to execute -->
        <listener>
            <listener-class>org.geoserver.GeoserverInitStartupListener</listener-class>
        </listener>
    
        <!-- logging initializer, should execute before spring context startup -->
        <listener>
            <listener-class>org.geoserver.logging.LoggingStartupContextListener</listener-class>
        </listener>
    
        <!--  spring context loader -->
        <listener>
            <listener-class>org.geoserver.platform.GeoServerContextLoaderListener</listener-class>
        </listener>
    
        <!--  http session listener proxy -->
        <listener>
            <listener-class>org.geoserver.platform.GeoServerHttpSessionListenerProxy</listener-class>
        </listener>
    
        <!-- request context listener for session-scoped beans -->
        <listener>
            <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
        </listener>
    
        <!-- spring dispatcher servlet, dispatches all incoming requests -->
        <servlet>
            <servlet-name>dispatcher</servlet-name>
            <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        </servlet>
    
        <!-- single mapping to spring, this only works properly if the advanced dispatch filter is
             active -->
        <servlet-mapping>
            <servlet-name>dispatcher</servlet-name>
            <url-pattern>/*</url-pattern>
        </servlet-mapping>
    
        <session-config>
            <cookie-config>
                <http-only>true</http-only>
                <!-- The Secure flag should be set on session cookies but is commented out by default since it -->
                <!-- will break non-HTTPS web UI access and may cause problems with some proxy configurations. -->
                <!-- Uncomment the following line to add the Secure flag to session cookies. -->
                <!-- <secure>true</secure> -->
            </cookie-config>
            <tracking-mode>COOKIE</tracking-mode>
        </session-config>
    
        <mime-mapping>
            <extension>xsl</extension>
            <mime-type>text/xml</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>sld</extension>
            <mime-type>text/xml</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>json</extension>
            <mime-type>application/json</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>yaml</extension>
            <mime-type>text/plain</mime-type>
        </mime-mapping>
    
        <welcome-file-list>
            <welcome-file>index.html</welcome-file>
        </welcome-file-list>
    
    </web-app>
    
  2. Uncomment the following <filter-mapping>:

    <?xml version="1.0" encoding="UTF-8"?>
    <web-app
            xmlns="http://xmlns.jcp.org/xml/ns/javaee"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
            metadata-complete="false"
            version="3.1">
        <display-name>GeoServer</display-name>
    
        <context-param>
            <param-name>serviceStrategy</param-name>
            <!-- Meaning of the different values :
    
                 PARTIAL-BUFFER2
                 - Partially buffers the first xKb to disk. Once that has buffered, the the
                   result is streamed to the user. This will allow for most errors to be caught
                   early.
    
                 BUFFER
                 - stores the entire response in memory first, before sending it off to
                   the user (may run out of memory)
    
                 SPEED
                 - outputs directly to the response (and cannot recover in the case of an
                   error)
    
                 FILE
                 - outputs to the local filesystem first, before sending it off to the user
              -->
            <param-value>PARTIAL-BUFFER2</param-value>
        </context-param>
    
        <context-param>
            <!-- see comments on the PARTIAL-BUFFER strategy -->
            <!-- this sets the size of the buffer.  default is "50" = 50kb -->
    
            <param-name>PARTIAL_BUFFER_STRATEGY_SIZE</param-name>
            <param-value>50</param-value>
        </context-param>
    
        <!--Can be true or false (defaults to: false). -->
        <!--When true the JSONP (text/javascript) output format is enabled -->
        <!--
        <context-param>
          <param-name>ENABLE_JSONP</param-name>
          <param-value>true</param-value>
        </context-param>
        -->
        <!--
        <context-param>
          <param-name>PROXY_BASE_URL</param-name>
          <param-value>http://82.58.146.45/geoserver</param-value>
        </context-param>
         -->
    
        <!--
       <context-param>
          <param-name>GEOSERVER_DATA_DIR</param-name>
           <param-value>C:\eclipse\workspace\geoserver_trunk\cite\confCiteWFSPostGIS</param-value>
       </context-param>
      -->
    
        <!-- pick up all spring application contexts -->
        <context-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath*:/applicationContext.xml classpath*:/applicationSecurityContext.xml</param-value>
        </context-param>
    
        <filter>
            <filter-name>FlushSafeFilter</filter-name>
            <filter-class>org.geoserver.filters.FlushSafeFilter</filter-class>
        </filter>
    
        <filter>
            <filter-name>Set Character Encoding</filter-name>
            <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
            <init-param>
                <param-name>encoding</param-name>
                <param-value>UTF-8</param-value>
            </init-param>
        </filter>
    
        <filter>
            <filter-name>SessionDebugger</filter-name>
            <filter-class>org.geoserver.filters.SessionDebugFilter</filter-class>
        </filter>
    
        <filter>
            <filter-name>filterChainProxy</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        </filter>
    
        <filter>
            <filter-name>xFrameOptionsFilter</filter-name>
            <filter-class>org.geoserver.filters.XFrameOptionsFilter</filter-class>
        </filter>
    
        <filter>
            <filter-name>GZIP Compression Filter</filter-name>
            <filter-class>org.geoserver.filters.GZIPFilter</filter-class>
            <init-param>
                <!-- The compressed-types parameter is a comma-separated list of regular expressions.
                     If a mime type matches any of the regular expressions then it will be compressed.
                     -->
                <param-name>compressed-types</param-name>
                <param-value>text/.*,.*xml.*,application/json,application/x-javascript</param-value>
            </init-param>
        </filter>
    
        <filter>
            <filter-name>Advanced Dispatch Filter</filter-name>
            <filter-class>org.geoserver.platform.AdvancedDispatchFilter</filter-class>
            <!--
            This filter allows for a single mapping to the spring dispatcher. However using /* as a mapping
            in a servlet mapping causes the servlet path to be "/" of the request. This causes problems with
            library like wicket and restlet. So this filter fakes the servlet path by assuming the first
            component of the path is the mapped path.
            -->
        </filter>
    
        <filter>
            <filter-name>Spring Delegating Filter</filter-name>
            <filter-class>org.geoserver.filters.SpringDelegatingFilter</filter-class>
            <!--
            This filter allows for filters to be loaded via spring rather than
            registered here in web.xml.  One thing to note is that for such filters
            init() is not called. INstead any initialization is performed via spring
            ioc.
            -->
        </filter>
    
        <filter>
            <filter-name>Thread locals cleanup filter</filter-name>
            <filter-class>org.geoserver.filters.ThreadLocalsCleanupFilter</filter-class>
            <!--
            This filter cleans up thread locals Geotools is setting up for concurrency and performance
            reasons
            -->
        </filter>
    
        <!-- Uncomment following filter to enable CORS in Jetty. Do not forget the second config block further down. -->
        <!--    
        <filter>
           <filter-name>cross-origin</filter-name>
           <filter-class>org.eclipse.jetty.servlets.CrossOriginFilter</filter-class>
           <init-param>
             <param-name>chainPreflight</param-name>
             <param-value>false</param-value>
           </init-param>
           <init-param>
             <param-name>allowedOrigins</param-name>
             <param-value>*</param-value>
           </init-param>
           <init-param>
             <param-name>allowedMethods</param-name>
             <param-value>GET,POST,PUT,DELETE,HEAD,OPTIONS</param-value>
           </init-param>
           <init-param>
             <param-name>allowedHeaders</param-name>
             <param-value>*</param-value>
           </init-param>
         </filter>
         -->
    
        <!-- Uncomment following filter to enable CORS in Tomcat. Do not forget the second config block further down. -->
        <!--    
        <filter>
           <filter-name>cross-origin</filter-name>
           <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
           <init-param>
             <param-name>cors.allowed.origins</param-name>
             <param-value>*</param-value>
           </init-param>
           <init-param>
             <param-name>cors.allowed.methods</param-name>
             <param-value>GET,POST,PUT,DELETE,HEAD,OPTIONS</param-value>
           </init-param>
           <init-param>
             <param-name>cors.allowed.headers</param-name>
             <param-value>*</param-value>
           </init-param>
        </filter>
        -->
    
        <!--
          THIS FILTER MAPPING MUST BE THE FIRST ONE, otherwise we end up with ruined chars in the input from the GUI
          See the "Note" in the Tomcat character encoding guide:
          http://wiki.apache.org/tomcat/FAQ/CharacterEncoding
        -->
        <filter-mapping>
            <filter-name>Set Character Encoding</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!-- Uncomment following filter-mapping to enable CORS -->
        <!--
        <filter-mapping>
            <filter-name>cross-origin</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
        -->
    
        <filter-mapping>
            <filter-name>FlushSafeFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>SessionDebugger</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>GZIP Compression Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>xFrameOptionsFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!--
          If you want to use your security system comment out this one too
        -->
        <filter-mapping>
            <filter-name>filterChainProxy</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>Advanced Dispatch Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>Spring Delegating Filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <filter-mapping>
            <filter-name>Thread locals cleanup filter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    
        <!-- general initializer, should be first thing to execute -->
        <listener>
            <listener-class>org.geoserver.GeoserverInitStartupListener</listener-class>
        </listener>
    
        <!-- logging initializer, should execute before spring context startup -->
        <listener>
            <listener-class>org.geoserver.logging.LoggingStartupContextListener</listener-class>
        </listener>
    
        <!--  spring context loader -->
        <listener>
            <listener-class>org.geoserver.platform.GeoServerContextLoaderListener</listener-class>
        </listener>
    
        <!--  http session listener proxy -->
        <listener>
            <listener-class>org.geoserver.platform.GeoServerHttpSessionListenerProxy</listener-class>
        </listener>
    
        <!-- request context listener for session-scoped beans -->
        <listener>
            <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
        </listener>
    
        <!-- spring dispatcher servlet, dispatches all incoming requests -->
        <servlet>
            <servlet-name>dispatcher</servlet-name>
            <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        </servlet>
    
        <!-- single mapping to spring, this only works properly if the advanced dispatch filter is
             active -->
        <servlet-mapping>
            <servlet-name>dispatcher</servlet-name>
            <url-pattern>/*</url-pattern>
        </servlet-mapping>
    
        <session-config>
            <cookie-config>
                <http-only>true</http-only>
                <!-- The Secure flag should be set on session cookies but is commented out by default since it -->
                <!-- will break non-HTTPS web UI access and may cause problems with some proxy configurations. -->
                <!-- Uncomment the following line to add the Secure flag to session cookies. -->
                <!-- <secure>true</secure> -->
            </cookie-config>
            <tracking-mode>COOKIE</tracking-mode>
        </session-config>
    
        <mime-mapping>
            <extension>xsl</extension>
            <mime-type>text/xml</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>sld</extension>
            <mime-type>text/xml</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>json</extension>
            <mime-type>application/json</mime-type>
        </mime-mapping>
        <mime-mapping>
            <extension>yaml</extension>
            <mime-type>text/plain</mime-type>
        </mime-mapping>
    
        <welcome-file-list>
            <welcome-file>index.html</welcome-file>
        </welcome-file-list>
    
    </web-app>
    
  3. Restart