-1

I have an Apache Tomcat 7. It runs a servlet which is accessible over HTTP GET and POST. I want to block all POST requests to this servlet, which are not from localhost. The servlet must still be accessible over HTTP GET from anywhere.

How do I configure the servlet to achieve that?

1 Answer 1

0

For any user, deny access to PUT, POST, DELETE, OPTIONS, and TRACE methods". In a stock Tomcat installation, if I were to send an HTTP OPTIONS request, for example, to the web site, it would work. In my newly constrained configuration, OPTIONS requests now fail with an HTTP Status code of 403 - Forbidden.

Sample Security Constraint

<security-constraint>
<web-resource-collection>
<web-resource-name>restricted methods</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>PUT</http-method>
<http-method>POST</http-method>
<http-method>DELETE</http-method>
<http-method>OPTIONS</http-method>
<http-method>TRACE</http-method>
</web-resource-collection>
<auth-constraint />
</security-constraint>
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.