Mantis Bugtracker
  

Viewing Issue Simple Details Jump to Notes ] View Advanced ] Issue History ] Print ]
ID Category Severity Reproducibility Date Submitted Last Update
0001419 [Resin] minor always 10-19-06 10:33 05-01-07 10:09
Reporter sam View Status public  
Assigned To ferg
Priority normal Resolution fixed  
Status closed   Product Version 3.0.19
Summary 0001419: multiple http-method security-constraints
Description (rep by K Fetterman)

In the specification, it shows an example of the security constraints
that are placed in web.xml. I have displayed it below:

<security-constraint>
   <web-resource-collection>
     <web-resource-name>restricted methods</web-resource-name>
     <url-pattern>/*</url-pattern>
     <http-method>DELETE</http-method>
     <http-method>PUT</http-method>
   </web-resource-collection>
   <auth-constraint/>
 </security-constraint>
 <security-constraint>
   <web-resource-collection>
     <web-resource-name>wholesale</web-resource-name>
     <url-pattern>/*</url-pattern>
     <http-method>GET</http-method>
     <http-method>POST</http-method>
   </web-resource-collection>
   <auth-constraint>
     <role-name>SALESCLERK</role-name>
   </auth-constraint>
 </security-constraint>

 <login-config>
   <auth-method>BASIC</auth-method>
   <realm-name>Wholesale</realm-name>
 </login-config>

 <security-role>
   <role-name>SALESCLERK</role-name>
 </security-role>

From what I read, the above configuration should prevent all DELETE and
PUT requests and use Basic Auth to when performing GET and POST
requests. Resin doesn't do this. Using the above configuration, it does
not perform any authentication when performing a GET or POST request.
Essentially, it ignores the second security constraint declaration and
allows anyone to perform a get or post.

I tried various combinations of above, but none work as expected.
I ended up deleting the second security constraint and removing all
<http-method> declarations so the security constraint applies to all
methods.
Additional Information
Attached Files

- Relationships

- Notes
(0001970)
ferg
05-01-07 10:09

server/1a52
 

- Issue History
Date Modified Username Field Change
10-19-06 10:33 sam New Issue
05-01-07 10:09 ferg Note Added: 0001970
05-01-07 10:09 ferg Assigned To  => ferg
05-01-07 10:09 ferg Status new => closed
05-01-07 10:09 ferg Resolution open => fixed
05-01-07 10:09 ferg Fixed in Version  => 3.1.2


Mantis 1.0.0rc3[^]
Copyright © 2000 - 2005 Mantis Group
29 total queries executed.
26 unique queries executed.
Powered by Mantis Bugtracker