Java EE Security configuration not working.

[chaitanya karthikk]

Hi all, I am trying to learn Java EE security. I configured security-constraint in web.xml file as
<security-constraint> <display-name>Security Constraint</display-name> <web-resource-collection> <web-resource-name>Secured Resources</web-resource-name> <url-pattern>/secure/*</url-pattern> <http-method>POST</http-method> </web-resource-collection> <auth-constraint> <role-name>AuthenticatedUser</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>FORM</auth-method> <realm-name>file</realm-name> <form-login-config> <form-login-page>/public/login.jsp</form-login-page> <form-error-page>/public/error.jsp</form-error-page> </form-login-config> </login-config> In glassfish server I have added 2 users in the file realms and also enabled "Default Principal To Role Mapping" option. But when I to tried to access any file under secure folder I could actually view it instead of being redirected to /public/login.jsp page.

Can anyone please explain me how to configure security in my web application.

Thank you all in advance. Good day.

[Jaikiran Pai]

Are you sure you are doing a POST? Your security configuration has been configured for only the POST method and will not be applied for GET and other methods.

[chaitanya karthikk]

Thank you Jai for pointing the problem. I am doing a redirection from index.jsp. I included GET and it is working now.