How can I stop users from directly connecting to the OC4J and force them to come through the Oracle HTTP server ?
You can set access mask for a web application by making changes in the orion-web.xml for your web application to allow access to a particular host or IP address where your Oracle HTTP Server is running. For example you want to allow access only from host named dpanda-us and machine with IP address 192.168.1.100 you have to add the following in the orion-web.xml: