Re: [Exist-open] URL Rewriting - via Jetty's Rewrite Handler or XQueryURLRewrite?

[Adam R. <ad...@ex...>]

> Claudius,
>
>>> This means that on a production server one can use only eXist, without
>>> apache in front of it, as is suggested in eXist's documentation?
>
> Yes, one can - remember to take the usual security precautions
> outlined in http://exist-db.org/production_good_practice.html.
>
>> On web facing production server I would recommend using Apache HTTP or
>> Nginx upfront and reverse proxy eXist into the URI namespace. See the
>> production best practice bits in the documentation...
>
> Adam - in http://exist-db.org/production_web_proxying.html you
> explained the reasons behind the 'positive' reasons for adopting the
> reverse proxy approach (1. Unified web namespace and 2. Virtual
> Hosting), but could you expand a bit on the 'negative' reason: "eXist
> like any Web Application Server (Tomcat, WebLogic, GlassFish, etc)
> should not be directly exposed to the Web."  My understanding was that
> Jetty played the role of 'web server' to eXist's 'web application
> server', no?  Pardon my ignorance!

I generally believe that web application servers are really there for
deploying your applications into, they tend to be complicated beasts,
which permit huge amounts of configuration and customisation and as
such they provide large attack surfaces. As such I prefer to use
something smaller, lighter and more specifically designed to be web
facing up-front, Apache or Nginx has had a lot of web exposure and I
would tend to trust it more in a hostile environment.

In the strictest Java sense, Jetty is a Web Application server and
eXist is a set of Web Applications.

> Joe
>



-- 
Adam Retter

eXist Developer
{ United Kingdom }
ad...@ex...
irc://irc.freenode.net/existdb