I am trying to secure the cache refresh URL from the internet. What would be the best way to do that with DXA framework? I did some research on the @Secured for Spring framework but I don't want role based security. Can this be handled at the application server level (WAS server) and creating a batch job for timely cache refresh?
Add a comment
|
3 Answers
The way we generally handle this is to deny access to /admin/ at the load balancer level - this means you can still call admin refresh internally from your servers without any application changes.
answered May 30, 2017 at 15:00
Because adding security to this URL also meant that the web application needed role based security by default, we initially opted to only make it available on the staging website, and disable it for live.
If you want the URL to be there for live, I would sugest adding role based security. But you might want to opt for simply restarting the web aplication to clear its cache when needed, as republishing the settings is probably not a job that will be done often on a live environment. I wouldn't schedule anything via a batch job that does it on an interval, it is something which should really only be triggered when required (i.e. a change in the settings).
answered May 30, 2017 at 14:50
You can create a Tridion custom page that allows selected editors to request /admin/refresh, or create a publish event handler on the "Publishing Settings" system page to request that URL. Then as Rob suggested, protect the URL on the load balancer level to block all requests from anywhere else (and in this case, just allow the requests originated from CMS or Publishing servers).
In your custom code you may want to consider requesting /admin/refresh on individual presentation servers, such as www-1.customsite.com/admin/refresh and www-2.customsite.com/admin/refresh, while configuring the hosts file for these "private" domains.
