I guess one alternative is to patch the code, maybe even add an option so I can flip it between dev and production envs.
Tim
Mike Barton wrote:
Tim,
Yes, we have done something very similar to that by using custom Axis handlers and web app filters.
Mike
Tim K. (Gmane) wrote:
Anyone out there who uses Axis on a production system and has disabled these features?
Thanks.
Tim
Tim K. (Gmane) wrote:
Hello,
How can I turn off these features for an Axis production deployment:
1) Disable the generation of WSDL when one goes to http://server:port/app/ws/ServiceName?wsdl
2) Turn off listing the available services and their methods by going to http://server:port/app/ws/
3) Turn off all Admin services/servlets, etc.
I would like to provide clients static WSDL files they can download from another (static) location and only allow my custom web services to be invoked, not the Axis built-in ones. This way I only have to worry about the security and exploits of my stuff rather than sweat over what could be exploited via the default Axis features (which for development are great, but not for production).
Thank you for your help.
