Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows Server 2008 server that our web site (web application) runs on. Our web application, which is running in IIS using PHP uses Curl (PHP library) to request data using JAX-WS web services. How should we protect these web services from getting called by the general public, so only our web application can only make requests?

share|improve this question
up vote 3 down vote accepted

You need to block traffic to the port on which your JAX-WS web service is listening from all addresses other than localhost. You can do this using the Windows Firewall application on Windows, iptables on Linux.

share|improve this answer

You need to authenticate the caller somehow in order to differentiate a valid caller from an invalid caller. In JAX-WS you should be using WS-Security for authentication. IBM has a document on using WS-Security with Axis 2 - not sure how up to date it is as I haven't used the framework before.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.