Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I visit a Solr URL such as:


The response includes the JDBC URL/username/password that was passed into DataImportHandler as part of the initargs section.

Are there any configuration options to stop this from happening, or am I going to have to look into using Apache HTTPD's mod_substitute to remove the offending line(s)?

Edit: by the way, currently we aren't fronting Solr with Apache, so if there is a Solr-only solution that is the preferable option.

Edit2: I'm not the only one with the problem

share|improve this question

Basically the easy solr-only route would be to hack in http auth to the solr webapp itself. It's about two snippets of xml, but one part of it (defining users and roles) is servlet container specific. Which servlet container are you using?

EDIT: Jetty and Resin examples here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.