[GERONIMO-5578] incorrect behaviour of security-constraint configuration in web.xml

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.0.0
• Fix Version/s: 2.1.7, 2.2.1, 3.0.0
• Component/s: Tomcat
• Security Level: public (Regular issues)
• Assignee: Haihong Xu
• Reporter: Hong Fang Han
• Created: 07/Sep/10 17:11
• Updated: 02/Nov/10 03:07
• Resolved: 27/Sep/10 06:18

Description

When have following configuration in web.xml, GET and POST can be accessed by both "RoleA" and "RoleB".

<security-constraint>
<web-resource-collection>
<web-resource-name>resource2</web-resource-name>
<url-pattern>/SampleServlet2</url-pattern>
<http-method>GET</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>RoleA</role-name>
</auth-constraint>
</security-constraint>

<security-constraint>
<web-resource-collection>
<web-resource-name>resource3</web-resource-name>
<url-pattern>/SampleServlet2</url-pattern>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>RoleB</role-name>
</auth-constraint>
</security-constraint>