Search code examples
web-applicationssolrfull-text-searchjettysearch-engine

Securing Apache Solr in production

We are using Apache Solr 4.1 to index data for a web app. Only the web app should have access to the Solr. Users and other clients will not directly talk to Solr.

What are some of the best practices to secure this type of Solr use case?

(we are using Jetty to run Solr)

Solution

  • Well, just a few of the options available:

    1. Don't expose the Solr server URL to the browser, make sure only the web app can see it and issue queries to the Solr server (SolrJ and Solr.Net are good clients to use for this).
    2. Don't allow any other URL to communicate with your Solr server host except the web app server.
    3. Use a proxy to obfuscate the Solr server URL and disallow certain queries and URLs ( and admin).