[jboss-user] [Security & JAAS/JBoss] - JBoss Status Page
do-not-reply at jboss.com
Thu Jul 24 03:31:42 EDT 2008
Perhaps I should have asked this in the Beginner's forum but it is a security related question.
How important is it to secure the JBoss/Tomcat Status page? e.g. domain.com/status
If an application handles secret URLs with a unique key rather than relying on a login e.g.
and that web page renders content which is a secret hosted file:
Users then exchange the links to a recipient with the private URL.
The files are fetched with a HTTP GET request. What are the implications
of having the status page publicly available. Would there be a slight
security risk of someone seeing the GET requests on this page and
accessing the content?
View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4166326#4166326
Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&p=4166326
More information about the jboss-user