Is there a way to limit a servlet accessibilty to a certain port?

Question

I have an application which is using two different ports, 443 & 4443. Another is for using the application (UI) and the other is a control channel for some automated clients.

I have few different servlets configured in web.xml. First is for the UI use, for users who normally use the application through the https-443:

<servlet-mapping>
    <servlet-name>application_ui</servlet-name>
    <url-pattern>/*</url-pattern>
</servlet-mapping>

I also have an servlet mapped in web.xml which is only used by the clients in port 4443, let this servlet be named as "client_inlet". This is a simple listener service for POST requests and there is no functionality for users.

<servlet-mapping>
    <servlet-name>client_inlet</servlet-name>
    <url-pattern>/ClientInlet</url-pattern>
</servlet-mapping>

Currently users can access the both sections of application from both ports, 443 & 4443.

What I wish to achieve is that the client_inlet part of application would achievable only using port 4443 and all the 443 traffic would be redirected to the application_ui

Something like the following is what I would like to do (not sure if this is even possible syntax in web.xml but at least it does not work):

<servlet-mapping>
    <servlet-name>application_ui</servlet-name>
    <url-pattern>https://*:443/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>client_inlet</servlet-name>
    <url-pattern>https://*:4443/ClientInlet</url-pattern>
</servlet-mapping>

Is the scenario even possible using the web.xml config? Or should it be done in the application server side? I'm using WildFly 8.1.0, any idea how this should be done there in standalone.xml?

It is part of application server or servlet container configuration, not `web.xml` — Andremoniy, Oct 13 '16 at 10:03
So you are basically saying that this should be done in wildfly's configuration? — Jokkeri, Oct 13 '16 at 10:08
I would like to limit the access to the application in firewall by using IP-whitelist (443) still letting all the traffic through in port 4443. And I don't want that the application is usable through the 4443 port. — Jokkeri, Oct 13 '16 at 10:13

score 0 · Answer 1 · answered Oct 13 '16 at 12:31

I don't think you can do this in configuration. Since each port is a different server isn't it? In that case you want a redirect to a different location/server not a redirect within the same application.

I don't see any other way then to do it in code or application.

Using javax.servlet.Filter implementation seems perfect for this task. You just have to to check if path starts with "/ClientInlet" then redirect to some other location or else just continue with the request. I am not sure I got the details about redirection right but something as below seems appropriate:

Filter code:

String path = request.getRequestURI();
if(path.equals("/ClientInlet"))
{//Redirect the client to the new location i.e. the other port
    response.setStatus(HttpServletResponse.SC_MOVED_PERMANENTLY);
    response.setHeader("Location", "https://someserver.com:port/ClientInlet");
} else
{//Just forward the request to the servlet
   filterChain.doFilter(servletRequest, servletResponse);
}

Is there a way to limit a servlet accessibilty to a certain port?

1 Answers1