Use Filterthat maps to url-pattern, which covers the resources you would like to hide, and does basically the following in a method doFilter():
if (request.getRemoteAddr().equals(request.getLocalAddr())) {
chain.doFilter(request, response);
} else {
((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN);
}
It will display an HTTP 403FORBIDDEN error for requests not created by the same client as the server.
source
share