web.xml security-constraint question

[zac craven]

I want to make a kind of inverted security constraint. I want to ALLOW access to a specific page over HTTP. All other pages should be HTTPS.

Is that possible???

(Sorry if this is in wrong forum, I'm fairly new to java.)

The kind of code I am talking abuot is like this:

<security-constraint>
<web-resource-collection>
<web-resource-name>all-except-attachments</web-resource-name>
<url-pattern>*.js</url-pattern>
<url-pattern>*.jsp</url-pattern>
<url-pattern>*.jspa</url-pattern>
<url-pattern>*.css</url-pattern>
<url-pattern>/browse/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
 

[Ben Souther]

Originally posted by zac craven:

(Sorry if this is in wrong forum, I'm fairly new to java.)

No need to be sorry.
I'm going to move this to our servlets forum because security constraints are covered in the servlet specification. This forum covers the JSP, and JSTL specs.