We are developing two web applications:

  1. Application A : Restful web-services running on a GlassFish Server .

  2. Application B : Dynamic web application running on a Tomcat Server .

I am accessing Application A only via my Application B, I don't want any other application to access my Application A. For this I have planned to install a Client-server certificate in the respective servers, so that my Application A will only be accessed by my Application B, I want to block other Applications from accessing my Application A.

Can you please tell me how to install client - server certificates in the respective servers?

If anyone has a better alternative to obtain this then please explain it to me.

Please explain with an example if possible.

  • do these two servers hosting the applications belong in the same network domain?
    – JOW
    Aug 4, 2015 at 13:34
  • Explanations on how to install certificates belong on either StackOverflow or ServerFault. What you will get on this forum are answers on alternative measures.
    – schroeder
    Aug 4, 2015 at 16:16

3 Answers 3


Based on the limited information:

At a minimum your looking layers of security you trying to accomplish.

  1. We'll call this the DMZ. This is the layer that Application A is accessed at, or more simply put, the point of entry for your setup. You don't want anyone beyond this point.
  2. The next layer is the backend. This is your application B and you are trying to restrict the access to this application only through Application A.

At a network level, your best option is through white listing of IP's/Domain Names. If you truly are just in development, and you basically trying restrict users/ other devs from messing with a system that's no ready, simply while listing at your servers FW will probably be sufficient.

You don't need to have a FW in between for something this basic (unless your development demands a certain level of protection upon which I would suggest no using these forums and hire a professional. This place is great for information, but specific engagements shouldn't be done here)

You should know the IP and Ports that Application A and B talk on which is what you want to white list.

If/when you push this into production I would make a few suggested changes.

  1. Depending on your level of required security, use a dedicated firewall to separate your DMZ from the backend (Your organization may have this already).
  2. Use Third Party Signed Certificates, I believe the current best practices are Minimum Key length of 2048, SHA2 signatures, running on TLS 1.1 or greater.
  3. Secure the at the server level. Set your group permission properly, etc for the application. (I am not including actual server security recommendations, but that should be a given).
  4. Know you DMZ access level, and internal application doesn't need to be access by external IPs, and you IT team should know what IP scheme they use and if they are really on the ball, they'll know what IP range will be accessing the application for the dedicated user group.
  • Sir , I am consuming my restful web application directly through JSP(VIEW) (Application B) running on Tomcat , with the help of ajax we are consuming Rest web-services . Can you give some detail about your point 2 (Third party certificate), how to use it . Aug 4, 2015 at 17:23
  • Configuring tomcat is beyond IS, as @schroeder said it better asked in Serverfault, but you can look at link and link for addional informaiton Aug 4, 2015 at 19:25

How about host-based firewall rules based on a whitelist?

Ruleset server A:

  • Incoming: IP (Server B)
  • Outgoing: IP (Server B)

Should do the job for applications that don't have high/very high protection requirements.


Potentially you could put application A on an internal network giving it no access to the outside world (or the outside world access to it). This combined with the firewall rule Th0mas mentioned should do the trick.


It seems that you're really attempting to validate what is calling you, this can be done by using csrf token exchanges in your JSP, see :http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#csrf-include-csrf-token

This isn't a guarantee that it is only you're web-app that is calling the API but it's a good guess.

  • Sir , I am consuming my restful web application directly through JSP(VIEW) (Application B) running on Tomcat , with the help of ajax we are consuming Rest web-services .We are calling rest web-service from JSP(running on tomcat) but we are calling REST from JSP with the help of AJAX , AJAX is a client side scripting , so we can say that we are consuming REST from user browser then is it will work if we keep REST on local network? Aug 4, 2015 at 17:50
  • I misunderstood the question, please see my edit to see if this helps in anyway
    – daark
    Aug 5, 2015 at 13:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.