Secure POST only, by ip and/or password

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

Secure POST only, by ip and/or password

Jonathan Austin
Hi There,

This is my first time on the list.

I am using Jetty 7 in Embedded mode and want to restrict access to POST requests in a servlet (by passwd or ip).  I would like to keep GET requests open to anyone.

In Apache I can do this easily using .htaccess.

Is there a way to do this in Jetty 7, preferably programatically.  I note that the HTAccessHandler is no longer in Jetty 7.

Any ideas much appreciated.

Jonathan




Reply | Threaded
Open this post in threaded view
|

Re: Secure POST only, by ip and/or password

nimret
Hi Jonathan,

I am not sure about how and whether jetty supports this feature but a portable
way to implement this which works across all servlet containers would be to
write a servlet filter to intercept the incoming request and handle it before
it reaches server side logic:

http://java.sun.com/products/servlet/Filters.html
http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=servlet+filter

hth,
--
Nimret Sandhu
http://www.nimret.com
http://www.nimsoft.biz

On Friday 19 March 2010 05:43:58 am Jonathan Austin wrote:

> Hi There,
>
> This is my first time on the list.
>
> I am using Jetty 7 in Embedded mode and want to restrict access to POST
> requests in a servlet (by passwd or ip).  I would like to keep GET requests
> open to anyone.
>
> In Apache I can do this easily using .htaccess.
>
> Is there a way to do this in Jetty 7, preferably programatically.  I note
> that the HTAccessHandler is no longer in Jetty 7.
>
> Any ideas much appreciated.
>
> Jonathan
>

---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email


Reply | Threaded
Open this post in threaded view
|

Re: Secure POST only, by ip and/or password

djencks
In reply to this post by Jonathan Austin

On Mar 19, 2010, at 5:43 AM, Jonathan Austin wrote:

> Hi There,
>
> This is my first time on the list.
>
> I am using Jetty 7 in Embedded mode and want to restrict access to  
> POST requests in a servlet (by passwd or ip).

It's not clear to me exactly what you mean by this.... but I'll guess  
"by password" means you want the user to be logged in?

>  I would like to keep GET requests open to anyone.

You can restrict access to particular url patterns and https methods  
to users in particular roles using standard servlet security  
constraints in web.xml.  You'd have to write a custom authenticator to  
restrict based on IP address.  This should be fairly easy in jetty 7.
>
> In Apache I can do this easily using .htaccess.
>
> Is there a way to do this in Jetty 7, preferably programatically.  I  
> note that the HTAccessHandler is no longer in Jetty 7.

I think tt's still there, but moved.  I don't know that it's been used  
much lately.

thanks
david jencks

>
> Any ideas much appreciated.
>
> Jonathan
>
>
>
>


---------------------------------------------------------------------
To unsubscribe from this list, please visit:

    http://xircles.codehaus.org/manage_email


Reply | Threaded
Open this post in threaded view
|

Re: Secure POST only, by ip and/or password

Michael Gorovoy
In reply to this post by Jonathan Austin
Jonathan,

The IPAccessHandler has been re-implemented in Jetty 7 and will be released as part of 7.0.2 in the nearest future. You can download milestone build 7.0.0.RC0 from Maven Central repository.

-Michael

Michael Gorovoy / [hidden email]


On Fri, Mar 19, 2010 at 8:43 AM, Jonathan Austin <[hidden email]> wrote:
Hi There,

This is my first time on the list.

I am using Jetty 7 in Embedded mode and want to restrict access to POST requests in a servlet (by passwd or ip).  I would like to keep GET requests open to anyone.

In Apache I can do this easily using .htaccess.

Is there a way to do this in Jetty 7, preferably programatically.  I note that the HTAccessHandler is no longer in Jetty 7.

Any ideas much appreciated.

Jonathan