"Disable Services Directory" issues

[RoyceSimpson]

I've got a AGS/Flex app that's been working great for the past year.  I would like to now disable the services directory from being accessible via the browser but would still like all the functionality within the Flex app of the exposed map services of our AGS installation.

Should that be doable?  I've been trying it and I get stream errors on certain operations like "featureLayer.selectFeatures".  If I enable the services directory again, that operations works just fine.  Assuming there are no bugs in the Flex or REST API regarding this... I'm at a loss as to what the good of "disable services directory" is.

I've looked up the REST API documentation on the services directory options and it only mentions how to disable the directory but doesn't explain any best practices or rationale for doing so.

Anyone got some knowledge on this?

Thanks much,
-Royce

[NancyGnanicys]

Didn't you ask how to do this?

All the endpoint are still accessible, just not the root directory.

Your flex app uses http calls.  If your app can do it, so can a browser.

For example:

My folder
http://www.mymanatee.org/arcgis/rest/services/
is forbidden
but
http://www.mymanatee.org/arcgis/rest/services/base-map/
is accessible.

This allows a user to get to the service they need, but not "nose" around and see what else we are hosting.

Jeff.Pace,
This is exactly what I am trying to do.:D How did you do this? Could you perhaps share a screen shot of how this was done?   I keep reading about reverse proxy's but I'm not familiar enough with that, is there a way to do this using the arcgis server admin interface?

[JeffPace]

Jeff.Pace,
This is exactly what I am trying to do.:D How did you do this? Could you perhaps share a screen shot of how this was done?   I keep reading about reverse proxy's but I'm not familiar enough with that, is there a way to do this using the arcgis server admin interface?

Unfortunately I am not exactly sure, my security team handles that.

What I do know

We are running tomcat modproxy.  We use this as a Web Application Firewall to proxy requests to particular folders.  Each folder is a rule in the proxy.

So we have 4 AGS internal, all with different folders.  By redirecting at the folder level, They all appear to be coming from the same server, which is great for CORS issues, etc..

However it does mean if we hit a firewall rule (Sql injection on a query, for example) you have to apply that exception to dozens of rules, one for each folder, and it becomes a bit of a maintenance mess

We are getting away from this architecture with 10.2 and the web adapters as it handles most of it.

I have not done any config with ags admin itself, I find it, well, lacking.