title: Tomcat servlet security
body: <p>I am toying with tomcat security for servlets. In my server.xml I have</p>
  
  <pre><code>&lt;Realm className="org.apache.catalina.realm.UserDatabaseRealm"
   resourceName="UserDatabase" 
   digest="SHA"/&gt;
  </code></pre>
  
  <p>and in my tomcat-users.xml</p>
  
  <pre><code>&lt;user username="zenon" password="qazxsw" roles="proby"/&gt;
  &lt;user username="andrzej" password="1c29cf0ceb89afce131e27b76c18af1e9cf7f5e3" roles="admin-gui,manager-gui,proby,role1"/&gt;
  </code></pre>
  
  <p>web.xml of very simple application</p>
  
  <pre><code>&lt;security-constraint&gt;
    &lt;display-name&gt;No Pasaran&lt;/display-name&gt;
    &lt;web-resource-collection&gt;
      &lt;web-resource-name&gt;Tylko dla memberow&lt;/web-resource-name&gt;
      &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
    &lt;/web-resource-collection&gt;
    &lt;auth-constraint&gt;
      &lt;role-name&gt;proby&lt;/role-name&gt;
      &lt;role-name&gt;role1&lt;/role-name&gt;
    &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;login-config&gt;
    &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
    &lt;realm-name&gt;UserDatabase&lt;/realm-name&gt;
  &lt;/login-config&gt;
  </code></pre>
  
  <p>so when auth-method is BASIC I can log in with username:andrzej and password:qazxsw (this long password of andrzej is SHA of qazxsw) so it seems that now when I send password he already is digesting it before comparing.
  I think so because when i use DIGEST as auth-method I can't log in, is he digesting password twice before comparing it?
  If yes is there any other way then https to secure such things on container level?</p>