Jetty Security

Security Configurations for Jetty Applications

Jetty applications can be protected with user authentication and client IP restrictions. These controls help limit access to authorized users and prevent selected addresses from reaching the deployed application.

In this article

Security Options

User authenticationRequires a valid username and password before protected application resources can be accessed.
Role-based accessAllows access only to users assigned to the roles listed in the application security constraint.
IP filteringAllows or denies requests according to the client address.
Combined protectionAuthentication and IP restrictions can be applied together.

Configure User Authentication

1

Open Jetty configuration

In the platform dashboard, click Config beside the Jetty application-server node.

2

Create a user and role

Open the Jetty realm or login-service configuration file and add the required username, password, and role according to the active Jetty version.

username: password,role-name
Jetty user and role configuration
Add the application user and assigned role in the Jetty realm configuration.
3

Configure the protected application resource

Open the application WEB-INF/web.xml file and add the security constraint, login method, and required role.

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <auth-constraint>
    <role-name>admin</role-name>
  </auth-constraint>
</security-constraint>

<login-config>
  <auth-method>BASIC</auth-method>
  <realm-name>Jetty Realm</realm-name>
</login-config>

<security-role>
  <role-name>admin</role-name>
</security-role>
Jetty web.xml security configuration
Define the protected URL pattern, authentication method, realm, and authorized role.
4

Save and restart Jetty

Save the configuration files and restart the Jetty node so the new security settings are loaded.

!

Use secure credentials

Do not use example passwords in production. Assign only the roles required by the application and restrict access to the realm configuration file.

Restrict Client IP Addresses

Jetty request filters or handler rules can be used to allow or deny selected client addresses. The exact configuration path depends on the Jetty version and application structure.

1

Identify the real client address

Determine whether requests reach Jetty directly through a public IP or through a platform load balancer or reverse proxy.

2

Add the IP restriction

Configure the application filter, Jetty handler, or server rule to reject the required address or network range.

<filter>
  <filter-name>IPAccessFilter</filter-name>
  <filter-class>org.eclipse.jetty.servlets.IPAccessHandler</filter-class>
</filter>
i

Version-specific syntax

Jetty security and IP-access classes can differ between major versions. Confirm the class and configuration format supported by the Jetty release running in the environment.

Jetty client IP restriction configuration
Configure the supported Jetty handler or application filter to restrict selected client addresses.
3

Restart and test

Restart Jetty and test the application from an allowed client and from the denied address.

Verify the Configuration

  • Open the protected URL in a private browser session and confirm that the authentication prompt appears.
  • Sign in with valid credentials and confirm that the application opens.
  • Test an invalid username, password, or role.
  • Test the application from a denied client IP address.
  • Review Jetty logs for authentication failures and blocked requests.
Jetty application authentication prompt
A protected Jetty application requests valid credentials before access is granted.

Expected Result

The Jetty application requires valid credentials for protected resources, rejects selected client addresses, or applies both security controls according to the configured policy.

Important Notes

  • Back up Jetty and application configuration files before editing them.
  • Keep role names consistent between the user realm and web.xml.
  • Restart Jetty after applying authentication or handler changes.
  • Account for reverse proxies when evaluating the real client IP address.
  • Use HTTPS when BASIC authentication is enabled.
  • Test allowed and denied access paths before production use.

Common Issues and Solutions

Authentication prompt does not appearCheck the URL pattern, application deployment path, realm configuration, role name, and whether Jetty was restarted.
Valid user is rejectedConfirm that the user is assigned to the same role listed in the application security constraint.
Wrong client IP is detectedReview reverse-proxy headers and the platform entry point before applying the deny rule.
Jetty fails to startRestore the previous configuration and validate XML, properties, and class names for the installed Jetty version.
Credentials are transmitted insecurelyEnable SSL/TLS and redirect HTTP requests to HTTPS before using BASIC authentication.

Related Guides