In Tomcat-3.2.1, I protecting the following url pattern: <url-pattern>/config/*</url-pattern> This works. However, there is a JSP at the root of my context named config.jsp which is also getting constrained, and I don't want this. Apparently, Tomcat is treating my "/config/*" string as "/config*". Is this a bug? To work around this, I've added explicit (non-wildcard) url patterns for all of my resources under /config/, but I really don't like this :) --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, email: [EMAIL PROTECTED]