Search code examples
web-servicesresttomcatmod-proxyajp

Restrict RESTful endpoint on tomcat to local webapp

Is there a mechanism built into Tomcat or Apache to differentiate between a local web application calling a local web service vs a direct call to a webservice?

For example, a single server has both apache and tomcat servers with a front end web app deployed to apache and back end services deployed on tomcat. The webapp can call the service via port 80 utilizing mod_proxy, however a direct call to the webservice and examining tomcaat's logs shows the requests to both be identical. For example:

http://127.0.0.1/admin/tools   

<Location /admin/tools>
     Order Deny,Allow
     Deny from all
     Allow from 127.0.0.1
  </Location>
ProxyPass /admin/tools http://localhost:8080/admin/tools
ProxyPassReverse /admin/tools http://localhost:8080/admin/tools

This only blocks (or allows if you remove the deny) all external requests and both requests appear identical in tomcat's log.

Is there a recommended mechanism to differentiate and limit a direct remote service request vs the web application making a service request?

Solution

  • You need to use Tomcat's Remote IP Filter to extract the client IP provided by the proxy in the X-Forwarded-For HTTP header and use it to populate Tomcat's internal data structures. Then you will be able to correctly identify the source of the request.