My primary issue is with a HelioSearch Solr instance, but I've included Tomcat as its possible that's all I need to change, I'm a Tomcat NOOB too.
Solr has a pretty full fledged REST API, possibly too expansive- it's a known issue(SOLR1523) that you can delete an entire Solr Collection via an non authenticated HTTP GET request.
http://localhost:8983/solr/update?commitWithin=10&stream.body=%3Cdelete%3E%3Cquery%3E*:*%3C/query%3E%3C/delete%3E"
Until a fix is released, can't I change some configuration on the Solr or Tomcat side to either:(from best case to worst)
- Establish a filter for each endpoint/HTTP verb pointing to AuthN/AuthZ provider (ZooKeeper/CXF? i'm not sure how they work yet either)
- Specify an IP whitelist filter with environment variables
- Specify an IP whitelist filter hardcoded
I need the update? endpoint for feeding new data into the collection, but I only need to POST that data so there's a 4th option: Remove/Block the GET endpoint(even if it was via some hacky routing/overloading/eclipsing method). Or even grosser, can the Coyote part of Tomcat look for the string "delete".. yuk, but I'm desperate.
I know the Solr project doesn't concern itself with security, but even with a behind the firewall solution there are too many users that are foolish or silly.