Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows Server 2008 server that our web site (web application) runs on. Our web application, which is running in IIS using PHP uses Curl (PHP library) to request data using JAX-WS web services. How should we protect these web services from getting called by the general public, so only our web application can only make requests?

2 Answers 2


You need to block traffic to the port on which your JAX-WS web service is listening from all addresses other than localhost. You can do this using the Windows Firewall application on Windows, iptables on Linux.


You need to authenticate the caller somehow in order to differentiate a valid caller from an invalid caller. In JAX-WS you should be using WS-Security for authentication. IBM has a document on using WS-Security with Axis 2 - not sure how up to date it is as I haven't used the framework before.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .