Doubt in Security contraints

[Eusebio Floriano]

Hi,
I have an doubt when more than one <url-pattern> elements overlap.
If a <secutiry-constraint> element has no <auth-constraint> element, everyone can accesses the resource.

If a <secutiry-constraint> element has a empty <auth-constraint> element,
no one can accesses the resource.

But if both exits ? What will happen ?
Here�s a snippet.

  <web-app>
    ....
    <security-constraint>
      <web-resource-collection>
        ...
        <url-pattern>*.do</url-pattern>
      </web-resource-collection>
      ....
    </security-constraint>
    ....
    <security-constraint>
      <web-resource-collection>
        ...
        <url-pattern>/someResource.do</url-pattern>
      </web-resource-collection>
      ....
      <auth-constraint/>
    </security-constraint>

Regards,

[Serghei Jelauc]

As I know empty one - <auth-constraint/> is ALWAYS WIN.

[Vishwa Kumba]

I have an doubt when more than one <url-pattern> elements overlap.
If a <secutiry-constraint> element has no <auth-constraint> element, everyone can accesses the resource.

If a <secutiry-constraint> element has a empty <auth-constraint> element, no one can accesses the resource.
But if both exits ? What will happen ?

Serghei is right. In this case, nobody can access the resource!

Refer HF book, Chap 12, page: 639 (Dueling <auth-constraint> elemets table)

[Eusebio Floriano]

Yes, i�ll take a look.

Thx a lot.

Regards,

[trivikram Kumar]

Yeah....no one can access the resource....