[
https://issues.apache.org/jira/browse/GERONIMO-5577?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Han Hong Fang updated GERONIMO-5577:
------------------------------------
Attachment: GERONIMO-5577.patch
Highlight some important statements in the spec for this topic.
- setServletSecurity of ServletRegistation.Dynamic: this method applies the
security constraint to all mappings added to this ServletRegistration up until
the point that the ServletContext from which it was obtained has been
initialized.
- The @ServletSecurity annotation is not applied to the url-patterns of a
ServletRegistration created using the addServlet(String, Servlet) method of the
ServletContext interface, unless the Servlet was constructed by the
createServlet method of the ServletContext interface.
- The @ServletSecurity annoation applies to the url-patterns of a
ServletRegistration created using the addServlet(String, String) and
addServlet(String, Class<?>) method of the ServletContext interface
- Security constraints on URLs has following priority from high to low:
web.xml, ServletRegistration.Dynamic.setServletSecurity(), @ServletSecurity
BTW, the patch is for tomcat only. For jetty it is a todo item.
Please help to review. Thanks!
> Support ServeltSecurity annotation when the servlets are added by
> ServletContext.addServlet methods
> ---------------------------------------------------------------------------------------------------
>
> Key: GERONIMO-5577
> URL: https://issues.apache.org/jira/browse/GERONIMO-5577
> Project: Geronimo
> Issue Type: New Feature
> Security Level: public(Regular issues)
> Components: web
> Affects Versions: 3.0
> Reporter: Han Hong Fang
> Assignee: Han Hong Fang
> Attachments: GERONIMO-5577.patch
>
>
> Servlet 3.0 spec has following statements in chapter 13.4.1.
> The @ServletSecurity annotation provides an alternative mechanism for
> defining access control constraints equivalent to those that could otherwise
> have
> been expressed declaratively via security-constraint elements in the portable
> deployment descriptor or programmatically via the setServletSecurity method
> of the ServletRegistration interface. Servlet containers MUST support the use
> of the @ServletSecurity annotation on classes (and subclasses thereof) that
> implement the javax.servlet.Servlet interface.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
