Admin Console not suitable for production

[OndroMih]

Hi all, we're concerned with the current Admin Console in GlassFish, which is based on an ancient technology and might even have some security issues. After we in OmniFish evaluated the situation, we are inclined to disable Admin Console by default. Users would have to enable it explicitly.

Currently, Glassfish supports an option server.admin-service.property.adminConsoleStartup that can be set to never to disable the Admin Console completely. if we change the behavior to disable the Admin Console by default, this option could be used to enable it explicitly. We can also add support for setting an environment variable to enable the Admin Console, which would allow enabling the Admin Console globally without running an asadmin command to set the property.

What do you think about disabling Admin Console by default, because of security concerns, and enable it via an environment variable or a property in domain.xml?

@eclipse-ee4j/ee4j-glassfish-committers ?

Ondro

[joestr]

I guess since most of the management happens in the CLI anyways?

For starters the WebUI is the easiest form of management. Most tools nowadays come with some management UI. So it should be enabled by default for the time being.

Gradually rebuilding the UI to a better version would be the best option.