限制J2EE servlet只能从localhost调用的正确方法是什么？

Question

I am working on building a servlet to perform work that should only be able to be initiated from the host itself. My current plan is to check the request object in the service method:

public void service(ServletRequest request, ServletResponse response) throws ServletException, IOException

The only methods I see on ServletRequest that seem relevant are getRemoteHost() and getRemoteAddr() . My biggest concerns are whether this could be spoofed (someone could send an inbound request with the source IP 127.0.0.1 and start the process) or if checking the IP against 127.0.0.1 could fail if IPv6 is being used.

There will be a credential which should prevent an IP spoof from being successful but I can't help but feel like there's a better, more direct way to check (or otherwise restrict) the source of the request.

Is there a standard way to reliably make this restriction that is independent of IP version and safe from spoofing (assuming an attacker could get the credential but not access to the server)? I think from a security perspective the credential should be sufficient; I'm mostly interested in what the 'right' way to solve this problem is.

EDIT:

I don't believe this is a duplicate of java- using a filter to check remote address as I was not considering using a filter in the first place. While a filter-based solution was eventually what I went with this question is open to other potential solutions as well (for example, Raffaele's suggestion to use a server socket could prove useful to someone else or an answer that hasn't been posted yet could be superior to both methods).

Answer 1

You can use Filters :

class OnlyLocalhostFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        if (servletRequest.getLocalAddr().equals(servletRequest.getRemoteAddr())) {
            filterChain.doFilter(servletRequest, servletResponse);
        }

    }

    @Override
    public void destroy() {

    }
}

After that declare you filter OnlyLocalhostFilter in web.xml and bind it to servlet you want.

UPDATE:

This solution not always works right. Found the answer here

Answer 2

The standard way to solve this is not to act at the servlet (application) level, but instead bind your entire server socket on 127.0.0.1 (or another loopback address).

I think the default API for Java server socket uses 0.0.0.0 which is anyaddress , but if you specify a loopback address like 127.0.0.1 (or localhost ) your application is protected at the kernel level.