Specifying a Web Resource Collection

A web resource collection consists of the following subelements:

• web-resource-name is the name you use for this resource. Its use is optional.

• url-pattern is used to list the request URI to be protected. Many applications have both unprotected and protected resources. To provide unrestricted access to a resource, do not configure a security constraint for that particular request URI.

  The request URI is the part of a URL after the host name and port. For example, let’s say that you have an e-commerce site with a catalog that you would want anyone to be able to access and browse, and a shopping cart area for customers only. You could set up the paths for your web application so that the pattern /cart/* is protected but nothing else is protected. Assuming that the application is installed at context path /myapp, the following are true:

  • http://localhost:8080/myapp/index.xhtml is not protected.

  • http://localhost:8080/myapp/cart/index.xhtml is protected.

  A user will be prompted to log in the first time he or she accesses a resource in the cart/ subdirectory.

• http-method or http-method-omission is used to specify which methods should be protected or which methods should be omitted from protection. An HTTP method is protected by a web-resource-collection under any of the following circumstances:

  • If no HTTP methods are named in the collection (which means that all are protected)

  • If the collection specifically names the HTTP method in an http-method subelement

  • If the collection contains one or more http-method-omission elements, none of which names the HTTP method