title: How do I know whether HttpServletRequest is subject to <security-constraint> or not?
body: <p>I have an servlet with security constraint in it's web.xml like below:</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Admin&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/admin/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;user-data-constraint&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>Above forces a switch to https protocol and works fine. But on the secured pages there some <strong>relative</strong> links to unsecured pages. When users clicks on them they're opened via https which I want to avoid. Converting relative links to absolute is not an option.
  Servlet spec does not provide means of forcing unsecured connection so I'm going to implement a filter which would redirect user to http: </p>
  
  <pre><code>public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
      if(!isSubjectToAuthConstraint(request)) {
          // Check protocol and redirect to http if https
          // ....
      } else {
          // Do nothing, managed by servlet spec
          filterChain.doFilter(request, response);
      }
  }
  </code></pre>
  
  <p>So I need to know whether request is under security constraint or not. How do I know it <strong>programmatically</strong>? Is it possible at all?</p>