Doubt in Auth-Constraint

[Padma priya Gururajan]

<security-constraint>
....
<auth-constraint>
<role-name>Member<role-name>
</auth-constraint>
</security-constraint>

<security-constraint>
...
<auth-constraint/>
</security-constraint>

My doubt is who is given access?


Thanks in advance.

[Khadija Lokhandwala]

Hi,
when any role name is combined with an empty <auth-constraint/> tag, no one is given access.
So , in your case no one (not even Member) can access it.
Thanks

[Joe San]

This is very clearly explained in the Head First in the security chapters.

[Sandeep Vaid]

<security-constraint>
....
<auth-constraint>
<role-name>Member<role-name>
</auth-constraint>
</security-constraint>
 
<security-constraint>
...
<auth-constraint/>
</security-constraint>

If the same url (resource) are constrained, then only no one will be able to access the constrained resource..