<p>Any administrative application should be protected by a
RemoteAddressValve. (Note that this Valve is also available as a Filter.)
- The allow attribute should be used to limit access to a set of known
+ The <strong>allow</strong> attribute should be used to limit access to a set of known
trusted hosts.</p>
<p>The default ErrorReportValve includes the Tomcat version number in the
<subsection name="Manager">
<p>The manager component is used to generate session IDs.</p>
- <p>The default entropy value has been shown to generate predictable values
+ <p>The default <strong>entropy</strong> value has been shown to generate predictable values
under certain conditions. For more secure session generation, this should
be set to a long string. This is done automatically if the APR/native
library is installed; a random value will be obtained from the APR/native