hi,
have a question on web-app security...
when having more than one <security-constraint> elements in the DD with conflicts... the HFS book describes how the various conflicts can be resolved...
here is the DD..
<web-app>
<security-constraint>
<web-resource-collection>
<web-resource-name>Something</web-resource-name>
<url-pattern>/me/Display/*</url-pattern>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint/>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>Something</web-resource-name>
<url-pattern>/me/Display/*</url-pattern>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint> ///this or is this tag is not included at all...
<role-name>*</role-name>
</auth-constraint>
</security-constraint>
the book discusses all combinations except this one ... one that allows all roles to request and one that allows none to access... though the DD may not make sense nevertheless it is one valid combination...
The HFS book says that an empty <auth-constraint/> has the final word but the next line says that --- "If one of the <security-constraint> elements has not <auth-constraint> element then it combines with anything else to allow access to all"...
so does the abv combination allow access to all roles or does it prevent access to all....
Regards
Simon
[ May 16, 2006: Message edited by: Roy Simon ]
[ May 16, 2006: Message edited by: Roy Simon ]
[ May 16, 2006: Message edited by: Roy Simon ]