Suppose you have an application running Java web services in Apache Axis 2. Specifically, these are JAX-WS (Java API for XML-Based Web Services). Currently these web services are on the same Windows Server 2008 server that our web site (web application) runs on. Our web application, which is running in IIS using PHP uses Curl (PHP library) to request data using JAX-WS web services. How should we protect these web services from getting called by the general public, so only our web application can only make requests?
You need to block traffic to the port on which your JAX-WS web service is listening from all addresses other than
localhost. You can do this using the Windows Firewall application on Windows, iptables on Linux.