2

I am trying to secure the cache refresh URL from the internet. What would be the best way to do that with DXA framework? I did some research on the @Secured for Spring framework but I don't want role based security. Can this be handled at the application server level (WAS server) and creating a batch job for timely cache refresh?

2

The way we generally handle this is to deny access to /admin/ at the load balancer level - this means you can still call admin refresh internally from your servers without any application changes.

1

Because adding security to this URL also meant that the web application needed role based security by default, we initially opted to only make it available on the staging website, and disable it for live.

If you want the URL to be there for live, I would sugest adding role based security. But you might want to opt for simply restarting the web aplication to clear its cache when needed, as republishing the settings is probably not a job that will be done often on a live environment. I wouldn't schedule anything via a batch job that does it on an interval, it is something which should really only be triggered when required (i.e. a change in the settings).

1

You can create a Tridion custom page that allows selected editors to request /admin/refresh, or create a publish event handler on the "Publishing Settings" system page to request that URL. Then as Rob suggested, protect the URL on the load balancer level to block all requests from anywhere else (and in this case, just allow the requests originated from CMS or Publishing servers).

In your custom code you may want to consider requesting /admin/refresh on individual presentation servers, such as www-1.customsite.com/admin/refresh and www-2.customsite.com/admin/refresh, while configuring the hosts file for these "private" domains.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.