Match the registry url only in the root directory

Question

I would only like to password protect the root directory in my context context for Jetty WebApp. My context path is / MyApp, so I would like to get a password for access:

http://localhost:8080/MyApp 

But NOT for:

 http://localhost:8080/MyApp/cometd 

My current setup is below (note the url pattern):

 <security-constraint> <web-resource-collection> <web-resource-name>Private Page</web-resource-name> <url-pattern>/</url-pattern> </web-resource-collection> <auth-constraint> <role-name>moderator</role-name> </auth-constraint> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>Test Realm</realm-name> </login-config> 

I expect this to work by nature as / and / * in general. I also saw this resource, which I believe suggests that this should pretty much work: http://www.coderanch.com/t/364782/Servlets/java/there-key-difference-between-url

However, for my case, url patterns are:

 <url-pattern>/</url-pattern> 

and

 <url-pattern>/*</url-pattern> 

seem to act exactly the same: both

 http://localhost:8080/MyApp 

and

 http://localhost:8080/MyApp/cometd 

The GENERAL password is protected.

Of course, if I go to / nothingishere, just like a performance test, nothing is password protected except / MyApp / nothingishere

Does anyone know how to protect only the root directory of web servlets?

Answer 1

Here is the answer:

 <?xml version="1.0" encoding="UTF-8"?> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0"> <session-config> <session-timeout> 30 </session-timeout> </session-config> <security-constraint> <web-resource-collection> <web-resource-name>Private Page</web-resource-name> <url-pattern>/</url-pattern> </web-resource-collection> <auth-constraint> <role-name>moderator</role-name> </auth-constraint> </security-constraint> <security-constraint> <web-resource-collection> <web-resource-name>Public page</web-resource-name> <url-pattern>/test/*</url-pattern> </web-resource-collection> </security-constraint> <login-config> <auth-method>BASIC</auth-method> <realm-name>Test Realm</realm-name> </login-config> </web-app> 

In this configuration, the root directory is password protected, but the /test/... directory is not. I think this is what you are asking for.

This configuration is tested on Tomcat 7+ and a new project created from the very beginning in NetBeans (I can send you the whole source if you need it).

This is the result: