Security issue - Oracle Identity System Administration login screen is exposed to public

Hi

You should be able to put all of the logic into the HTTP_REQUEST event, something like...

when HTTP_REQUEST {
	if { [string tolower [HTTP::uri]] starts_with "/restricted-uri" }{
	if {not [IP::addr [IP::client_addr] equals 10.0.0.0/8]} {
		drop
		}
	}
}