More Servlets and JavaServer Pages™

Chapter 7. Declarative Security

Topics in This Chapter

• Understanding the major aspects of Web application security

• Authenticating users with HTML forms

• Using BASIC HTTP authentication

• Defining passwords in Tomcat, JRun, and ServletExec

• Designating protected resources with the security-constraint element

• Using login-config to specify the authentication method

• Mandating the use of SSL

• Configuring Tomcat to use SSL

There are two major aspects to securing Web applications:

1. Preventing unauthorized users from accessing sensitive data. This process involves access restriction (identifying which resources need protection and who should have access to them) and authentication (identifying users to determine if they are one of the authorized ones). Simple authentication ...