Mailing-List: contact tomcat-user-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
Message-ID: <002901c2b84d$72f9a0b0$bcac6041@winter>
From: "Jeffrey Winter" <jeffreywinter@attbi.com>
To: "Tomcat Users List" <tomcat-user@jakarta.apache.org>
References: <20030109174118.B1680-100000@icarus.apache.org>
Subject: Re: Authentication and Filters
Date: Thu, 9 Jan 2003 21:10:29 -0500
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit

> A key rule to remember is that security constraints are applied *only* on
> the original URL requested by the client -- not on RequestDispatcher
> calls.  I would bet you probably have "/resource/*" protected, but you'll
> likely want to protect "/user/*" as well.

Thanks, this is a great help.  You're right, for /user/*, GET requires
authentication,
but POST doesn't which looks to be why it was working as I had outlined it.

But actually, given the nature of how I need to authenticate my resources,
it seems
that I would be better off in this particular circumstance to use Apache's
mod_rewrite
to setup the urls which would eliminate the RequestDispatcher altogether.


--
To unsubscribe, e-mail:   <mailto:tomcat-user-unsubscribe@jakarta.apache.org>
For additional commands, e-mail: <mailto:tomcat-user-help@jakarta.apache.org>