Tomcat url-pattern problems

Question

I'm trying to secure my webapplication using tomcats security constraint. Therefore i added a folder "prot", I want to secure through the url-pattern in the web.xml. When I change the tag to <url-pattern>/prot</url-pattern> my login page doesn't appear, therefor the file i wanted to protect. Wehn I change the path to <url-pattern>/*</url-pattern> the page login-page appears, but without any javascript i defined in a separate file (which is blocked from tomcat?). On the context i added the path /mywebapp/prot. How do i secure the folder prot ? Thanks in advance!

Bruno Grieder · Accepted Answer · 2012-03-20 17:03:59Z

2

You should secure by default and unsecure what you want.

The constraints must be declared from the most specific to the most generic in web.xml, so that you match the most specific first.

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Unsecure resources</web-resource-name>
        <url-pattern>/unsecure</url-pattern>
    </web-resource-collection>
</security-constraint>

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Secure resources</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>authenticated</role-name>
    </auth-constraint>
</security-constraint>

answered Mar 20, 2012 at 17:03

Bruno Grieder

30k10 gold badges73 silver badges104 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

B--rian Over a year ago

It is not-so-straight forward, that the mere existence of <auth-constraint> decides about security or not, but it does indeed make sense at a 2nd glance.

Collectives™ on Stack Overflow

Tomcat url-pattern problems

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related