Few guesses about security

[Gowher Naik]

case 1:
<security-constraint>
<web-resource-collection>
<web-resource-name>webapp</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
All methods has constraint because <http-method> tag is missing
 
case 2:
<security-constraint>
<web-resource-collection>
<web-resource-name>webapp</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>admin</role-name>
</auth-constraint>
</security-constraint>
Only GET and POST method has constraint
 
case 3:
security-constraint>
<web-resource-collection>
<web-resource-name>webapp</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
</auth-constraint>
</security-constraint>
No user are allowed because <user-role> tag is missing
 
case 4:
security-constraint>
<web-resource-collection>
<web-resource-name>webapp</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint/>
</security-constraint>
No user are allowed due to <auth-constraint/> tag
 
case 5:
security-constraint>
<web-resource-collection>
<web-resource-name>webapp</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
</security-constraint>
Every one is allowed beacuse <auth-constraint> tag is missing
 
case 6:
security-constraint>
<web-resource-collection>
<web-resource-name>webapp</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method></http-method>
</web-resource-collection>
<auth-constraint>
</auth-constraint>
</security-constraint>
I guess no method is allowed
 
case 7:
<security-constraint>
<web-resource-collection>
<web-resource-name>webapp</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name></role-name>
</auth-constraint>
</security-constraint>
I guess no one has access

I have no doubt about case 1 to 5
But for case 6 and 7 i am not sure
please correct me if i am wrong.
Thanks