web security : doubt

[Sreeraj G Harilal]

Can we specify <security-constraint> to a particular folder?

HFSJ says yes.
But its not working to me.
I have a class SelectBeer under WEB-INF/classes/com/example/web.

here is my security constraint part of web.xml

 
<login-config>
<auth-method>BASIC</auth-method>
</login-config>

<security-constraint>
 
<web-resource-collection>
<web-resource-name>Security for BeerSelect class</web-resource-name>
 
<url-pattern>/com/example/web/*</url-pattern>

<http-method>GET</http-method>
<http-method>POST</http-method>
 
</web-resource-collection>
 
<auth-constraint>
<role-name>king</role-name>
<role-name>tomcat</role-name>
</auth-constraint>
 
</security-constraint>
 

but its not working.
i tried this also
<url-pattern>/classes/com/example/web/*</url-pattern>

but still its not working.

Please tell me how i make security constraint to all the files in that folder WEB-INF/classes/com/example/web.

[Sreeraj G Harilal]

Here is my full web.xml file

 
<?xml version="1.0" encoding="ISO-8859-1"?>
 
<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee 
    <a href="http://java.sun.com/xml/ns/j2ee/webapp_2_4.xsd"" target="_blank" rel="nofollow">http://java.sun.com/xml/ns/j2ee/webapp_2_4.xsd"</a> version="2.4">
 
<context-param>
<param-name>name</param-name>
<param-value>Sreeraj.G.H</param-value>
</context-param>
 
<context-param>
<param-name>e-mail</param-name>
<param-value>[e-mail]</param-value>
</context-param>
 
<servlet>
<servlet-name>Ch3 Beer</servlet-name>
<servlet-class>com.example.web.BeerSelect</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Ch3 Beer</servlet-name>
<url-pattern>/SelectBeer.do</url-pattern>
</servlet-mapping>
<error-page>
<exception-type>java.lang.Throwable</exception-type>
<location>/Error.jsp</location>
</error-page>
 
<!-- ***********************Security*********************** -->
 
<login-config>
<auth-method>BASIC</auth-method>
</login-config>

<security-constraint>
 
<web-resource-collection>
<web-resource-name>Security for BeerSelect class</web-resource-name>
 
<url-pattern>/com/example/web/*</url-pattern>

<http-method>GET</http-method>
<http-method>POST</http-method>
 
</web-resource-collection>
 
<auth-constraint>
<role-name>king</role-name>
<role-name>tomcat</role-name>
</auth-constraint>
 
</security-constraint>
 
<!-- ***********************Security*********************** -->
</web-app>
 

browser request
http://localhost:8080/HFSJ/SelectBeer.do

[Celinio Fernandes]

duh !
the path you specified in the <url-pattern> element is wrong.
What is the fully-qualified class name doing here ?
I suggest that you check the rules regarding URL mapping.

[Gowher Naik]

First of all
<security-role>
<role-name>admin</role-name>
</security-role>

is missing

Try
<url-pattern>/SelectBeer.do</url-pattern> inside <security-constraint>

[Sreeraj G Harilal]

First of all
<security-role>
<role-name>admin</role-name>
</security-role>

is missing

Try
<url-pattern>/SelectBeer.do</url-pattern> inside <security-constraint>

There is no need to specify <security-role> here(DD).
I know this url pattern(<url-pattern>/SelectBeer.do</url-pattern>) will work.

But my doubt is HFSJ says (Page number 634) we can specify directories with constraints.

Please try to clear my doubt.