title: Multiple security-constraints in web.xml not working
body: <p>I am upgrading a web application (Servlet 3.0 / Tomcat 7) that requires basic authentication on most of its pages. This application has a small set of monitoring servlets, none of which should be protected. In my <code>web.xml</code>, I currently have the following <code>security-constraint</code> blocks (private info replaced by letters of the alphabet):</p>
  
  <pre><code>&lt;security-constraint&gt;
      &lt;display-name&gt;Security Constraint&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Protected Area&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;CN=A,OU=B,OU=C,OU=D,DC=E,DC=F&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Unprotected Pages&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/health/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
  &lt;/security-constraint&gt;
  </code></pre>
  
  <p>Within the "health" path there are three endpoints:</p>
  
  <ul>
  <li><code>/health/monitor/status</code></li>
  <li><code>/health/monitor/version</code></li>
  <li><code>/health/monitor/version/xml</code></li>
  </ul>
  
  <p>When I visit either of the <code>version</code> endpoints, I am not prompted for credentials (as expected). However when I visit the <code>status</code> page, the browser presents me with a basic authentication box. When I hit "Cancel", I'm allowed to load the page normally. Likewise if I've already logged in, I will not be prompted again by the status screen until my login expires.</p>
  
  <p>I realize that this could be solved by not having the secure content deployed to <code>/*</code>, but moving it would be a lot of work changing hard-coded paths and testing (it's a very old application)... and I have 5 or 6 more to do. I'm open to doing this if necessary, but I wanted to find out if this is possible <em>without</em> changing any secure content paths. I <em>do</em> have complete freedom over the paths of the monitoring servlets.</p>
  
  <p>This seems related to <a href="https://stackoverflow.com/questions/9432710/tomcat-7-multiple-security-constraints-not-working">Tomcat 7 - Multiple security-constraints not working</a> but rather than total failure just one of my endpoints is failing, which I find very strange. I've spent some time searching and it looks like what I'm doing should work... but it doesn't.</p>
  
  <p>I'm using <code>web-app</code> version 3.0, deploying to Tomcat 7 (have tried versions 7.0.42 and 7.0.47). I have already tried changing the order of the <code>security-constraint</code> blocks.</p>
  
  <p>Thoughts? </p>
  
  <p>Here is my full <code>web.xml</code> for reference (note the monitoring servlets are managed via Java annotations, so are not present):</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app version="3.0"
       xmlns="http://java.sun.com/xml/ns/javaee"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
       http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
  
  &lt;display-name&gt;TPS&lt;/display-name&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;CFMLServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;railo.loader.servlet.CFMLServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
        &lt;param-name&gt;configuration&lt;/param-name&gt;
        &lt;param-value&gt;/WEB-INF/railo/&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;AMFServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;railo.loader.servlet.AMFServlet&lt;/servlet-class&gt;
      &lt;load-on-startup&gt;1&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  
  &lt;servlet&gt;
      &lt;servlet-name&gt;AttachmentServlet&lt;/servlet-name&gt;
      &lt;servlet-class&gt;com.package.toolshed.AttachmentServlet&lt;/servlet-class&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;configFilePath&lt;/param-name&gt;
          &lt;param-value&gt;com/package/toolshed/configuration/tps-config.xml&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;init-param&gt;
          &lt;param-name&gt;configPathParam&lt;/param-name&gt;
          &lt;param-value&gt;attachment.servlet.pathPrefix&lt;/param-value&gt;
      &lt;/init-param&gt;
      &lt;load-on-startup&gt;6&lt;/load-on-startup&gt;
  &lt;/servlet&gt;
  
  
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;CFMLServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;*.cfm&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;CFMLServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;*.cfml&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;CFMLServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;*.cfc&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;AMFServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/flashservices/gateway/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;AttachmentServlet&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/attachments/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;default&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  
  &lt;welcome-file-list&gt;
      &lt;welcome-file&gt;index.cfm&lt;/welcome-file&gt;
      &lt;welcome-file&gt;index.cfml&lt;/welcome-file&gt;
  &lt;/welcome-file-list&gt;
  
  &lt;security-constraint&gt;
      &lt;display-name&gt;Security Constraint&lt;/display-name&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Protected Area&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
          &lt;role-name&gt;CN=A,OU=B,OU=C,OU=D,DC=E,DC=F&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Unprotected Pages&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/health/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
  &lt;/security-constraint&gt;
  
  &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
      &lt;realm-name&gt;TPS&lt;/realm-name&gt;
  &lt;/login-config&gt;
  
  &lt;security-role&gt;
      &lt;role-name&gt;CN=A,OU=B,OU=C,OU=D,DC=E,DC=F&lt;/role-name&gt;
  &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>