Need to block GET requests for a WebService

[Hemant B. Kumar]

Hi All,

I have a JaxWS WebService and I want the WebService URL to be available only for HTTP POST method.

What I understand after little bit googling and writing a sample code is that normally a JaxWS WebService can be invoked only through HTTP POST request. When I try HTTP GET request on the same URL I get HTTP (200 OK) response having links to all Endpoints/wsdl provided by the WebService.

I want to hide even the wsdl information from unknown client and on getting GET request I want to send "405 Method not Allowed" HTTP response to Client.

Please let me know if anyone has any details to share. I am using Glassfish application Server.

Thanks,
Naive

[Tim Moores]

The WSDL can be disabled by some setting in the web.xml (depending on which SOAP stack you're using).

[Hemant B. Kumar]

depending on which SOAP stack you're using

I'm sorry (I'm very new to WebServices), what do you mean by which SOAP stack? If you mean SOAP spec version then its 1.1.

Just to clarify what I need is not just restricting access to wsdl but also to send 405 response everytime a GET request is used to access the WebService URL.

Thanks.

[Ivan Krizsan]

Hi!
Try this in your web.xml deployment descriptor:
... <security-constraint> <display-name>SecurityConstraint</display-name> <web-resource-collection> <web-resource-name>Secure Area</web-resource-name> <url-pattern>/HelloWorldWSService</url-pattern> <!-- JSR-109 specifies that http-method POST must be used. If we include GET here, access to the WSDL will also be protected, otherwise not. --> <http-method>POST</http-method> </web-resource-collection> <!-- Here we specify which roles can access the web service. --> <auth-constraint> <role-name>user</role-name> </auth-constraint> </security-constraint> ...
The above will only allow POST requests with a user in the role "user" to the specified URL pattern.
This should not depend on which web service stack you use.
Best wishes!

[Hemant B. Kumar]

Thanks for the suggestions.

For me a filter on WebService URL worked. This filter is to allow only POST requests and rejects other HTTP requests.