ClaimAuthFilter uses metadata provided in the request (through either HTTP or AJP protocols) and accepts this metadata as validated authetication. It is easy to forge this metadata. The metadata is provided by an HTTP proxy (i.e. Apache performing the authentication and identity lookup). Therefore it is essential that the servlets only accept connections from the trusted HTTP proxy and no other clients. We need to define a configuration option that identifies what the trusted ports are and enforce the use of those ports by ignoring any request whose local port is not in the list of trusted ports.

The configuration of the trusted ports is part of the deployment steps.