3 ms·

Solr is not a web-based application. You shouldn't directly expose your Solr instance to anyone. Regardless of whether or not you secure your admin interface. T

by Tharkun 12y ago

Solr is not a web-based application. You shouldn't directly expose your Solr instance to anyone. Regardless of whether or not you secure your admin interface. That's not Solr's core business, and I don't see why they should was their efforts on it. Have Solr listen on localhost and have your web app talk to Solr. If your Solr is visible to the world, you're doing it wrong. Edit: by saying that it's not a web-based application I mean that it shouldn't be on teh interwebz -- it's obviously a webapp in the sense that it mostly speaks HTTP.

tomp 12y ago
Well, regardless of whether it's web-facing or not, it's not unreasonable to want to limit the access to its admin panel (e.g. in a big company with different teams). I agree however that SOLR is best off doing one thing well, web page security can be implemented e.g. by Apache.
- imaginenore 12y ago
  So limit it to only whitelisted IPs. That's why you have sysadmins.
  - untog 12y ago
    Or use Nginx as a proxy, or something. It's frustrating, but I can see the argument for Solr to just delegate this kind of task to other projects that do it better.
- Tharkun 12y ago
  You would be right if the Solr admin page were the only administrative interface. It's not. You could send delete queries, create additional indexes, etc all without using the admin page, simply by sending http requests to the relevant Solr components. Instead of adding overhead by securing each individual call, they leave it up to you. Or to whichever friendly consultant you decide to hire to help out with that. Wink wink. Nudge nudge.
BonoboBoner 12y ago
While you are technically right, that kind of thinking gave people access to a ton of MongoDB databases last week.
gregors 12y ago
The admin is a web application I can tell this because I'm looking at my browser. ;) Not wanting to deal with the boring parts of web apps -- that's understandable but not business/user savvy.

by Tharkun 12y ago

tomp 12y ago

Well, regardless of whether it's web-facing or not, it's not unreasonable to want to limit the access to its admin panel (e.g. in a big company with different teams). I agree however that SOLR is best off doing one thing well, web page security can be implemented e.g. by Apache.

imaginenore 12y ago
So limit it to only whitelisted IPs. That's why you have sysadmins.
- untog 12y ago
  Or use Nginx as a proxy, or something. It's frustrating, but I can see the argument for Solr to just delegate this kind of task to other projects that do it better.
Tharkun 12y ago
You would be right if the Solr admin page were the only administrative interface. It's not. You could send delete queries, create additional indexes, etc all without using the admin page, simply by sending http requests to the relevant Solr components. Instead of adding overhead by securing each individual call, they leave it up to you. Or to whichever friendly consultant you decide to hire to help out with that. Wink wink. Nudge nudge.

BonoboBoner 12y ago

While you are technically right, that kind of thinking gave people access to a ton of MongoDB databases last week.

gregors 12y ago

The admin is a web application I can tell this because I'm looking at my browser. ;) Not wanting to deal with the boring parts of web apps -- that's understandable but not business/user savvy.