Skip to content

Make only_from authoritative for server services - #3075

Open
rzo1 wants to merge 1 commit into
mainfrom
only-from-no-implicit-localhost
Open

rzo1 wants to merge 1 commit into
mainfrom
only-from-no-implicit-localhost

Conversation

@rzo1

@rzo1 rzo1 commented Oct 9, 2026

Copy link
Copy Markdown
Contributor

ServiceAccessController always admitted localhost and the server's own addresses, regardless of the configured only_from list. The list is now authoritative; the default admin service already lists localhost. Setting openejb.server.only_from.implicit-local=true restores the old behaviour, which should go into the release notes. Extended ServiceAccessControllerTest.

only_from is now authoritative; the legacy behavior can be restored
with openejb.server.only_from.implicit-local=true.
@rzo1 rzo1 self-assigned this Oct 9, 2026
@rzo1
rzo1 requested a review from jungm October 9, 2026 09:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant