title: Whitelist security constraint in web.xml
body: <p>I'm using Tomcat for my Struts2 application. The <code>web.xml</code> has certain entries as shown below:</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;restricted methods&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
          &lt;http-method&gt;PUT&lt;/http-method&gt;
          &lt;http-method&gt;DELETE&lt;/http-method&gt;
          &lt;http-method&gt;TRACE&lt;/http-method&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint /&gt;
  &lt;/security-constraint&gt;
  &lt;security-constraint&gt;
     &lt;web-resource-collection&gt;
         &lt;web-resource-name&gt;no_access&lt;/web-resource-name&gt;
         &lt;url-pattern&gt;/jsp/*&lt;/url-pattern&gt;
     &lt;/web-resource-collection&gt;
     &lt;auth-constraint/&gt;
  &lt;/security-constraint&gt;
      &lt;security-constraint&gt;
     &lt;web-resource-collection&gt;
         &lt;web-resource-name&gt;no_access&lt;/web-resource-name&gt;
         &lt;url-pattern&gt;/myrrunner/*&lt;/url-pattern&gt;
     &lt;/web-resource-collection&gt;
     &lt;auth-constraint/&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>How can I change above blacklisted parts to use only whitelisting part... For example, instead of blacklisting <code>PUT</code>, <code>DELTE</code> http methods, I need to whitelist other methods but I'm not sure the syntax of whitelisting them &amp; what methods to whitelist them. </p>
  
  <p>For my above <code>web.xml</code> snippet, I'll appreciate if some one can provide me whitelisitng counter part for above <code>xml</code>.</p>
  
  <p>EDIT: Also, how would I really verify whether the solution works or not?</p>
  
  <p>Thanks</p>