Skip to main content
Dynamic_critic9200
Participating Frequently
Dec 2, 2025 3:17 PM UTC
Answered

Restricting Jetty Access to Server Only

I'd like to restrict Jetty access to the server itself only (CF2021).  I need to do this because the port, 8993, is coming up on a security scan.  I can't use Windows Firewall to block the port (it's complicated, but long story short, it's not an option).

 

I have found two places to do this, I think:

 

[cf]\cfusion\jetty\start.ini

## Connector host/address to bind to
# jetty.http.host=0.0.0.0

## Connector port to listen on
jetty.http.port=8993

I'd change the 2nd line to jetty.http.host=127.0.0.1.  Would this cause any problems?  I did this in my test environment and the server seemed fine.  We don't use Solr; we do use PDF generation, and PDFs still generated after I made this change.

 

[cf]\cfusion\jetty\etc\jetty-ipaccess.xml

<Configure id="Server" class="org.eclipse.jetty.server.Server">
    <Call name="insertHandler">
        <Arg>
            <New id="IPAccessHandler" class="org.eclipse.jetty.server.handler.IPAccessHandler">
                <Set name="white">
                    <Array type="String">
                        <Item>127.0.0.1</Item>
                    </Array>
                </Set>
                <Set name="black">
                    <Array type="String">
                        <Item></Item>
                    </Array>
                </Set>
                <Set name="whiteListByPath">false</Set>
            </New>
        </Arg>
    </Call>
</Configure>

I'm confused about this, as it already looks like it is using a whitelist, and that whitelist is only 127.0.0.1.  And yet when this command is run, it outputs JSON data:

 

curl [server]:8993/solr/admin/info/properties

 

FYI, this post is a continuation of a convo that was started here:

 

https://community.adobe.com/t5/coldfusion-discussions/upgrade-or-patch-for-solr-in-coldfusion-2021-to-current/m-p/15615533#M202665

BKBK
BKBKCorrect answer
Community Expert
Dec 9, 2025 7:51 PM UTC

FYI, if I comment this out:

<Call name="addConnector">
<Arg>
<New class="org.eclipse.jetty.server.ServerConnector">
<Arg name="server"><Ref refid="Server"/></Arg>
<Set name="host">::1</Set>
<Set name="port">8993</Set>
</New>
</Arg>
</Call>

Then I don't get an error and SOLR starts just fine.  Is this necessary?


Yes, it is safe and correct to delete the ::1 setting and use only the IPv4 127.0.0.1 binding.

View reply

11 replies

BKBK
Community Expert
BKBKCommunity Expert
Community Expert
Dec 5, 2025 5:44 PM UTC

This subject was discussed extensively in a thread posted last September. See https://community.adobe.com/t5/coldfusion-discussions/cold-fusion-2023-restrict-access-to-solr-web-app-to-localhost-on-server-with-ipv6/m-p/15489261 .

You will find many ideas and suggestions there.

Translate
Dynamic_critic9200Author
Participating Frequently
Dec 8, 2025 4:08 PM UTC

Thanks, BKBK.  I'll try out your latest solution and let you know how it goes.  I'm using CF2021, FYI.  A point of clarification in your solution:

 

"Add two explicit connectors bound to loopback only"

 

You just add that at the end, right?  Like this (I'm using port 8993):

        <Get name="SelectorManager">
          <Set name="connectTimeout"><Property name="jetty.http.connectTimeout" default="15000"/></Set>
        </Get>
      </New>
    </Arg>
  </Call>
  
<Call name="addConnector">
<Arg>
<New class="org.eclipse.jetty.server.ServerConnector">
<Arg name="server"><Ref refid="Server"/></Arg>
<Set name="host">127.0.0.1</Set>
<Set name="port">8993</Set>
</New>
</Arg>
</Call>

<Call name="addConnector">
<Arg>
<New class="org.eclipse.jetty.server.ServerConnector">
<Arg name="server"><Ref refid="Server"/></Arg>
<Set name="host">::1</Set>
<Set name="port">8993</Set>
</New>
</Arg>
</Call>

</Configure>
Translate
BKBK
Community Expert
BKBKCommunity Expert
Community Expert
Dec 8, 2025 4:44 PM UTC

Yes, @Dynamic_critic9200 . Remember to:

  •  Verify that 8993 is the correct port. You can do so in the ColdFusion Administrator, on the page Data & Services > PDF Service. 
  • Comment out the existing host and port lines in jetty-http.xml:
<!--<Set name="host"><Property name="jetty.http.host" deprecated="jetty.host" /></Set>-->
<!--<Set name="port"><Property name="jetty.http.port" deprecated="jetty.port" default="8080" /></Set>-->
  • Restart ColdFusion.

 

 

 

 

Translate
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices