Using the following setup, I can request cocoon.properties and see its contents because it seems that Tomcat wants the cocoon.properties file in each web application directory. - am I doing something wrong? - is this a security problem in the making? Per Kreipke Onclave, Inc.