Re: Ideas for password-protecting live site

At 2006-05-09 10:05, Eric Carlson wrote:
>I have set up a site where resin manages the authentication in the
>usual way via a login box. I need to set up a staging server for the
>testers to be able to see whats coming next, so it needs to be as
>close to the live one as possible but only available to them. Hacking
>it too much just to deny unauthorised access means it isn't ;-) What I
>really want is the functionality I'd get by dropping a .htaccess file
>in my root dir, running mod_caucho & apache, and having apache pop up
>its password box once first, then the site appears as normal. I tried
>this and apache just ignored it (because jsp's bypass it?). Anyway,
>this and other ideas very welcome for what must be a common situation
>please. Thanks.

A totally different approach would be to use an IP constraint in 
resin.conf/web.xml

   <security-constraint>
     <web-resource-collection>
       <url-pattern>/*</url-pattern>
     </web-resource-collection>

     <ip-constraint>1.2.3.4/28</ip-constraint>
...