• Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

Tomcat 8 cannot read httpMethodConstraints

 
Himai Minh
Ranch Hand
Posts: 1361
7
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator


index.jsp


tomcat-users.xml:


The result is that mary , as a manager role is forbidden access the PUT.

But when I remove value= @HttpConstraint... , it works.
 
Tim Holloway
Saloon Keeper
Posts: 18367
56
Android Eclipse IDE Linux
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
That actually wasn't a very clear question.

But what I think you meant was that depending on the user's role, you could do one thing or the other, but not both.

J2EE security roles are not simple labels. It's perfectly legal for Mary to be both a Manager and an Employee:

Likewise, code security can allow users in more than one role:
 
Himai Minh
Ranch Hand
Posts: 1361
7
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi, Tim,

This security rule says
1. manager is allowed to use doPut
2. employee are allowed to use the rest of the methods except doPut.

Suppose jane is employee and mary is manager as defined in tomcat-user.xml.
I was surprised to see that mary is not allowed to use doPut.


But when I changed the security rule :

Mary is allowed to use doPut.

 
Himai Minh
Ranch Hand
Posts: 1361
7
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
It has something to do with using Put in the form.
I changed the code into :



Now, jane cannot access POST method and mary can access it.
The reason is the form in index.jsp cannot use method="PUT".
 
Himai Minh
Ranch Hand
Posts: 1361
7
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I used curl.exe that I downloaded from https://curl.haxx.se/dlwiz/?type=bin. I used free 7Zip to unzip it.
I ran this command :

It promotes me for password.
Then, the doPut method runs.

I think it was because my browser does not support PUT in form.
 
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic