title: Disable or hide "ejb-timer-service-app" on Glassfish/Payara
body: <p>Running a stock Glassfish or Payara Server there is a default application deployed called "ejb-timer-service-app" which includes a web frontend at <a href="http://localhost:8080/ejb-timer-service-app/timer" rel="nofollow noreferrer">http://localhost:8080/ejb-timer-service-app/timer</a></p>
  
  <p><a href="https://i.stack.imgur.com/2wAt4.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2wAt4.png" alt="enter image description here"></a></p>
  
  <p>More information here: <a href="https://docs.oracle.com/cd/E18930_01/html/821-2418/beahw.html" rel="nofollow noreferrer">https://docs.oracle.com/cd/E18930_01/html/821-2418/beahw.html</a></p>
  
  <p>Sadly the frontend is not reachable over the protected admin console (port 4848) but over the main host (port 8080 and 8181). So everyone knowing my server URL can access this page.</p>
  
  <p>Is there a way to deactive the app (not the ejb-timer-service itself) or at least make the frontend-page no longer accessable (hide it) without some fancy firewall or loadbalancer configurations?</p>