Re: your eXist-db is an open proxy

Great point, Omar.  I'd forgotten about the one additional setting needed
to lock down an eXist server from processing requests with these _query
parameters.  I'll quote from Retter & Siegel, ch. 8:

"To remove the REST Server's ability to directly receive web requests, you
can modify the parameter `hidden` in `$EXIST_HOME/webapp/WEB-INF/web.xml`:

  <init-param>
    <param-name>hidden</param-name>
    <param-value>true</param-value>
  </init-param>

Once you change the default value of <param-value> from "false" to "true"
as shown here, requests with the ?_query parameter are blocked.  For
example take this request:

  http://localhost:8080/exist/apps/?_query=1

Before applying the setting above, you'd get this in response (the query
"1" evaluates, obviously, to the number "1"):

<exist:result xmlns:exist="http://exist.sourceforge.net/NS/exist"
exist:hits="1"
    exist:start="1" exist:count="1" exist:compilation-time="6"
    exist:execution-time="6">
    <exist:value exist:type="xs:integer">1</exist:value>
</exist:result>

After applying the setting, you'd get this:

> HTTP ERROR 403
> Problem accessing /exist/apps/. Reason:
>   Not allowed to read collection

This is also explained in the web.xml file - see https://github.com/eXist-
db/exist/blob/develop/webapp/WEB-INF/web.xml.tmpl#L87-L101.  This would be
a great topic to be covered in the eXist prose documentation too, so I've
filed an issue to ensure this idea is captured: https://github.com/
eXist-db/documentation/issues/98.

Again, I'd welcome anyone interested in further discussion on this topic to
move it over to exist-open.

On Fri, Mar 10, 2017 at 11:21 AM, Omar Siam <[email protected]> wrote:

> Hi!
>
> You are right, sorry. I will post that to the correct list. Just everyone
> who runs exist facing to the public: This is *not a REST issue*. This is
> *not solveable* by most or any of the tipps in the exist-db docs. it is
> something more scary.
>
> Everyone using exist for serving stuff needs to use RewriteCond or sth
> similar.
>
> Best Regards
>
> Omar
>
>