title: tomcat and security-constraint: url pattern not working
body: <p>I have 2 apps deployed to a tomcat server. One of them (app2) I want to be protected by tomcat.</p>
  <p>Example of the resulting URLs:</p>
  <pre><code>localhost:8080/app1
  localhost:8080/app2
  </code></pre>
  <p>i do <strong>not</strong> develop the apps itself, so i have no access to the application specific web.xml of the apps themselves.
  So I'm using the &quot;global&quot; one in the /conf folder of tomcat. This is what I added:</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
  &lt;web-app xmlns=&quot;http://xmlns.jcp.org/xml/ns/javaee&quot; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; xsi:schemaLocation=&quot;http://xmlns.jcp.org/xml/ns/javaee                       http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd&quot; version=&quot;4.0&quot;&gt;
  
    &lt;security-constraint&gt;
      &lt;display-name&gt;app2 Users&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;app2 Content&lt;/web-resource-name&gt;
        &lt;url-pattern&gt;/app2/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
        &lt;role-name&gt;*&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
    &lt;/security-constraint&gt;
  
    &lt;security-role&gt;
      &lt;role-name&gt;*&lt;/role-name&gt;
    &lt;/security-role&gt;
  
    &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
    &lt;/login-config&gt;
  
    &lt;servlet&gt;
      &lt;servlet-name&gt;default&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.apache.catalina.servlets.DefaultServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;debug&lt;/param-name&gt;
        &lt;param-value&gt;0&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;listings&lt;/param-name&gt;
        &lt;param-value&gt;false&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
    &lt;servlet&gt;
      &lt;servlet-name&gt;jsp&lt;/servlet-name&gt;
      &lt;servlet-class&gt;org.apache.jasper.servlet.JspServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;fork&lt;/param-name&gt;
        &lt;param-value&gt;false&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;xpoweredBy&lt;/param-name&gt;
        &lt;param-value&gt;false&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;3&lt;/load-on-startup&gt;
    &lt;/servlet&gt;
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;default&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;jsp&lt;/servlet-name&gt;
      &lt;url-pattern&gt;*.jsp&lt;/url-pattern&gt;
      &lt;url-pattern&gt;*.jspx&lt;/url-pattern&gt;
    &lt;/servlet-mapping&gt;
    &lt;session-config&gt;
      &lt;session-timeout&gt;30&lt;/session-timeout&gt;
    &lt;/session-config&gt;
    &lt;!-- mime type mappings --&gt;
  &lt;/web-app&gt;
  </code></pre>
  <p>IMHO this is all whats nessecary to protect app2, but i do not get a password promt, and app2 is accessible without basic auth. Here is the log:</p>
  <pre><code>15-Jul-2020 14:58:35.663 FINE [http-nio-8080-exec-1] org.apache.catalina.authenticator.AuthenticatorBase.invoke Security checking request GET /blabla2/
  15-Jul-2020 14:58:35.664 FINE [http-nio-8080-exec-1] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[blabla Content]' against GET /index.jsp --&gt; false
  15-Jul-2020 14:58:35.664 FINE [http-nio-8080-exec-1] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[blabla Content]' against GET /index.jsp --&gt; false
  15-Jul-2020 14:58:35.664 FINE [http-nio-8080-exec-1] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[blabla Content]' against GET /index.jsp --&gt; false
  15-Jul-2020 14:58:35.664 FINE [http-nio-8080-exec-1] org.apache.catalina.realm.RealmBase.findSecurityConstraints   Checking constraint 'SecurityConstraint[blabla Content]' against GET /index.jsp --&gt; false
  15-Jul-2020 14:58:35.665 FINE [http-nio-8080-exec-1] org.apache.catalina.realm.RealmBase.findSecurityConstraints   No applicable constraint located
  
  </code></pre>
  <p>when setting the <code>url-pattern</code> to <code>/*</code> everything works, but (as expected) app1 is protected to.
  Whats wrong with my <code>url-pattern</code>?</p>