Bugs item #621521, was opened at 2002-10-10 12:38 You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=621521&group_id=22866
Category: JBossWeb Group: v3.0 Rabbit Hole Status: Open Resolution: None Priority: 5 Submitted By: Scott M Stark (starksm) Assigned to: Nobody/Anonymous (nobody) Summary: Jetty welcome-file security problem? Initial Comment: If the url of a welcome-file points to a resource that should be secured its content is displayed without requesting authentication. In the attached war, the following URLs should all require the login form to be displayed: http://localhost:8080/secure/ http://localhost:8080/secure/restricted/hello.html http://localhost:8080/secure/restricted/hello2.html Jetty is only displaying the login form for the second two URLs. The first URL which includes the http://localhost:8080/secure/restricted/hello.html content does not require authentication. Maybe this is a grey area of the servlet spec, but the jboss- 3.0.3_tomcat-4.0.5 bundle does not exhibit this behavior. It does display the login form when the http://localhost:8080/secure/ is accessed. ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=376685&aid=621521&group_id=22866 ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Jboss-development mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/jboss-development
