Let us look at a scenario in which a security rule for failure is being registered for restriction of access to all the external URIs. This can be configured in the conf/neo4j-server.properties file:

org.neo4j.server.rest.security_rules=rule.CompleteRestrictionSecurityRule

The code for the CompleteRestrictionSecurityRule class can be defined in the following manner:

publicclassCompleteRestrictionSecurityRuleimplementsSecurityRule
{

publicstaticfinalStringMYREALM="MyApplication";

@Override
publicbooleanisAuthorized( HttpServletRequestrequest )
    {
returnfalse; // Forces failure always
// Logic for authorization coded here
    }

@Override
publicStringforUriPath()
    {
return"/*"; //For any incoming URI path
    }

@Override
publicStringwwwAuthenticateHeader()
    {
returnSecurityFilter.basicAuthenticationResponse(MYREALM);
    }
}

This rule restricts all types of access to the server from external locations. For a production scenario, you can configure the rule class to check for login credentials in order to authorize users to the application.

Sample request

POST http://localhost:7474/db/data/relationship/1
Accept:application/json; charset=UTF-8

Sample response

401:Unauthorized
WWW-Authenticate:Basic realm="MyApplication"

Unlike the previous case, where all incoming requests are blocked, we can also target the restriction to some specific type of URIs with the use of wildcards. We need to register for this with a predefined wildcard URI path, with * specifying any section of the path. For example, /users* will block those requests that access the user root. In a similar fashion, the /users*type* expression refers to URIs accessing the type option for users like /users/mark/type/new.

You can use the defined CompleteRestrictionSecurityRule security rule class with a modification to the forUriPath method as follows:

publicStringforUriPath()
{
return"/secure/*";
}

This rule restricts only those requests that attempt to access the data under the /secure/ directory. So, with wildcards, you can flexibly control access to different parts of the server API.

Sample request

GET http://localhost:7474/secure/any/path/after/this/stuff
Accept:application/json; charset=UTF-8

Sample response

401:Unauthorized
WWW-Authenticate:Basic realm="MyApplication"

You can use multiple or a chain of wildcards in order to restrict a specific URI type or a pattern of URIs. Consider the case when the forUriPath() method is changed to take this form:

publicStringforUriPath()
    {
return"/protected/*/something/else/*/final/bit";
    }

The type of requests that this blocks are very specific and targeted in nature. An example of the type of request restricted is as follows:

Sample request

GET http://localhost:7474/protected/any/x/y/z/path/something/else/any/subpath/final/bit/anything
Accept:application/json; charset=UTF-8

Example response

401:Unauthorized
WWW-Authenticate:Basic realm="MyApplication"