Choose one answer.
A. It is faulty becasue it has multiple security-constraint elements
B. It is faulty because it does not supply the http-method tag
C. Only members of the manager role will be able to access the resource
D. Any user will be able to access the resource
E. No users will be able to access the resource
I had answered E, but the correct answer given is D. The explanation is : "Although the first auth-constraint is empty, implying no one will have access to the resource, this is cancelled out by the second auth-constraint that will allow anyone to access the resource. "
Is this right?
"A problem well stated is a problem half solved.” - Charles F. Kettering
SCJP 6, OCPJWCD
an empty auth-constraint has precedence. It appears there is a problem with that first auth-constraint, because the role-name is outside the auth-constraint element. I think the manager role should be within the first auth-constraint element, and then it would be true that any user would have access. It appears as an error in the code, and a faulty explanation.
Dieter Quickfend wrote:an empty auth-constraint has precedence. It appears there is a problem with that first auth-constraint, because the role-name is outside the auth-constraint element.
Thanks Dieter, that's what I thought too.
The only reason I thought that the "empty auth-constraint trumps all" rule might not apply here is, that the <web-resource-name> of both web-resource-collection elements is identical. Haven't seen that before, so I thought that might skew the results somehow.
Unlike servlet-name, are web-resource-name elements allowed to be duplicate?
Joined: Aug 06, 2010
Ah, good find, hadn't realized that. I believe the web-resource-name wouldn't influence the behaviour of the auth-constraint. As far as I know, it is used only for recognition by GUI-tools.