What you need to do, is to have a cgi proxy on your tomcat webserver, and use the OpenLayers.ProxyHost to point to it.
The OpenLayers site has a FAQ Answer for this issue :
Why do I need a ProxyHost?
retrieve information from remote domains via an XMLHttpRequest.
Classes like WFS and GeoRSS use XMLHTTPRequest to get their data. If
they are querying a remote server (anything other than the machine
hosting your page), you must install a proxy script somewhere web
accessible on that machine. See below for how to set up your own
If the OpenLayers.ProxyHost variable is not set to a valid proxy host,
requests are sent directly to the remote servers. In most cases, the
result will be a security exception, although this exception often
occurs silently. How do I set up a ProxyHost?
An example proxy host script is available here:
For the standard Apache configuration, you would place proxy.cgi into
your /usr/lib/cgi-bin/ directory.
Once a proxy host script has been installed, you must then edit the
OpenLayers.ProxyHost variable to match that URL.
Given the above standard Apache configuration:
OpenLayers.ProxyHost = "/cgi-bin/proxy.cgi?url=";
If you have done something like this, you should be able to visit:
The resulting content at that page should be the openlayers.org
If you get a 404 error instead, either the proxy script is not in the
right location, or your webserver is not configured correctly.
After you have copied over the proxy file to your server, don't forget to edit the allowedHosts array.