So far I've just written internal .JSP apps. Now we are looking at a larger project allowing data access to our external customers.

- Oracle database on internal network that supports the business. Want to allow authenticated users to query and update some data on this database. Few concurrent customers so performance and scaleability isn't as important as security and ease of development and maintenance. Data concurancy is very important so replicated data isn't an option.

I'm thinking of an app server outside the network to handle the front end request using .JSP pages. I'm not comfortable putting database connections on this public machine and opening up holes in my firewall even though that seems a simple way to go. Do I need to put an App server inside the network and put the database connections there and only let the public App server talk to the internal App server? Is that overkill or is that the proper way to do it?

Thanks for any feedback.

-EJL