turn off security constraint for a directory

[Stephen Huey]

The webapp is located at \Tomcat\webapps\mywebapp and that directory has several subdirectories like \Tomcat\webapps\mywebapp\cache\ and \Tomcat\webapps\mywebapp\images\ and these are all protected by one global security constraint (the url-pattern is /* so everything in there is off-limits if you're not authenticated). I'm trying to figure out if there's a way to specify a directory that is an exception, meaning you could access a file in it (if you knew the URL to the file) without being authenticated. Bascially, how can I make a file in \Tomcat\webapps\mywebapp\newdirectory\ be accessible to you without you having to log in?

I'm posting the complete web.xml in mywebapp\WEB-INF\ so you can see what I'm talking about. Also, I'm trying to modify the original developer's work, so I've been using Windows Grep to try and find out where the web resource ADE Supply is mentioned elsewhere, but honestly, I can't find it! How does it know what directory is being specified? Also, do you think this is the same ADE Supply mentioned in the realm-name at the bottom, or is it just circumstantial that they have the same name?

Thanks for your help!

  <?xml version="1.0" encoding="ISO-8859-1" ?> 
  <!DOCTYPE web-app (View Source for full doctype...)> 
- <web-app>
- <mime-mapping>
  <extension>js</extension> 
  <mime-type>text/javascript</mime-type> 
  </mime-mapping>
- <welcome-file-list>
  <welcome-file>Login.jsp</welcome-file> 
  </welcome-file-list>
- <resource-ref>
  <description>Database Pool</description> 
  <res-ref-name>jdbc/wwxchange</res-ref-name> 
  <res-type>javax.sql.DataSource</res-type> 
  <res-auth>Container</res-auth> 
  </resource-ref>
- <security-constraint>
  <display-name>ADE Security Constraint</display-name> 
- <web-resource-collection>
  <web-resource-name>ADE Supply</web-resource-name> 
- <!--  Define the context-relative URL(s) to be protected 
  --> 
  <url-pattern>/*</url-pattern> 
  </web-resource-collection>
- <auth-constraint>
- <!--  Anyone with one of the listed roles may access this area 
  --> 
  <role-name>user</role-name> 
  </auth-constraint>
- <!-- 
user-data-constraint>
 <transport-guarantee>CONFIDENTIAL</transport-guarantee>
      </user-data-constraint
 
  --> 
  </security-constraint>
- <login-config>
  <auth-method>BASIC</auth-method> 
  <realm-name>ADE Supply</realm-name> 
  </login-config>
  </web-app>

[leon fan]

The whole security mechemism is defined by Java Servlet Specification and implemented by container,
I guess you couldn't find ADE string in your own program.

Seemed there don't exist a better way except list all constraint directory instead of '/*' in entity 'url-pattern', so user can access your exception file without being authenticated