security - How to secure Jetty to only allow access from loopback(localhost) - Stack Overflow

I found the answer to my question myself after a little bit more googling.

The answer is (Tested on jetty-distribution-7.0.1.v20091125):

1. Locate jetty.xml (etc/jetty.xml)
2. Search for <Call name="addConnector">
3. Set <Set name="Host"><SystemProperty name="jetty.host" default="127.0.0.1"/></Set> before line <Set name="port"><SystemProperty name="jetty.port"/></Set>
4. That's it. Restart jetty server (java -jar start.jar). The server should output something like:

2009-12-23 23:02:09.291:INFO::Started SelectChannelConnector@127.0.0.1:8080

The import thing is that it should say 127.0.0.1 instead of 0.0.0.0, 0.0.0.0 means listen on all ips on the machine.

P.S: I wanted to secure apache solr (which is using jetty) which can be achieved in the same way.

You can also bind to localhost programmatically(embed jetty) by:

Server server = new Server();  Connector connector = new SelectChannelConnector();  connector.setHost("localhost");  connector.setPort(80);  server.addConnector(connector);

Read full article from security - How to secure Jetty to only allow access from loopback(localhost) - Stack Overflow