title: Security constraint <url-pattern> acting weirdly - websphere
body: <p>I am testing security constraints for certain URLs. I feel <em>url pattern</em> is acting weird. I want access restricted whatever comes after <code>ServletSecurityTest(webapproot)/</code>. But, after deploying war file in websphere, even <code>ServletSecurityTest(webapproot)</code> itself is restricted. why ? </p>
  
  <p><strong>For example:</strong></p>
  
  <p>I wanted this <code>http//ravi-pc:9080/ServletSecurityTest/testSecurity.do</code> to be restricted. That is alright. But even <code>http//ravi-pc:9080/ServletSecurityTest</code> is restricted. why ?</p>
  
  <p>Any ideas ?</p>
  
  <p><strong>web.xml</strong></p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Servlet Security Resources&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;Administrator&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  
  &lt;/security-constraint&gt;
  
  &lt;security-role&gt;
      &lt;role-name&gt;Administrator&lt;/role-name&gt;
  &lt;/security-role&gt;
  </code></pre>
  
  <p><strong>Servlet</strong></p>
  
  <pre><code>@WebServlet(name="SecurityTestServlet", urlPatterns={"/testSecurity.do"})
  public class SecurityTestServlet extends HttpServlet {
  
      public void doGet(HttpServletRequest request, HttpServletResponse response)
              throws ServletException, IOException {
  
          response.getWriter().write("Only Administrators can see this...");
  
      }
  
  }
  </code></pre>