AJP, or Apache JServ Protocol, is a connector protocol used by Apache Tomcat to pass requests from Apache HTTP Server to a backend Java application server. It is designed for trusted-network deployments, not for direct exposure to the public internet. Because AJP sits between a front-end proxy and Tomcat, it can carry request details such as paths, headers, and client information in a way that is efficient for local server-to-server communication.
AJP matters because security depends on the proxy and the application server agreeing on what a request means. If AJP is exposed too broadly, misconfigured, or handled inconsistently, attackers may bypass controls, trigger denial-of-service conditions, or influence how requests are routed and interpreted. Defenders usually reduce risk by keeping AJP on internal networks only, disabling it when unused, and testing proxy and connector behavior together so access rules and parsing stay aligned.