Back to Servlet Hub

Nearby lessons

23 of 34
Servlet - ListenersServlet - Web SecurityServlet - Declarative SecurityServlet - Programmatic SecurityServlet - Questions & Answers

Servlet - Declarative Security (web.xml)

📌 What You Will Learn
  • Understand Declarative Security(web.xml declarations)
  • Understand Demo Program for Basic Authentication
  • See complete working code examples

Declarative Security (web.xml) is an essential part of the Java Servlet technology. This lesson explains Declarative Security(web.xml declarations), Demo Program for Basic Authentication and FirstServlet.java with complete, runnable code examples, clear step-by-step explanations, and common mistakes to avoid.

Declarative Security(web.xml declarations)

In the deployment descriptor declare

1.<security-constraint>

2.<web-resource>

3.<transport-guarentee>

4.<login-config>

5.<security-role>

We can implement web security by using the following 3 tags.

Declarative Security(web.xml declarations)

It defines the resources which have to be protected, which roles are allowed to access and security

constraint is applicable for which type of http methods etc...

Example02
JCode Cell
1 
2<security-constraint>:
3

Declarative Security(web.xml declarations)

It defines the type of authentication what we are using.

3.<security-role>

It defines the security roles which are allowed in the web application.

Note:

The above 3 tags are direct child tags of <web-app> and hence we can place anywhere within the

<web-app>

Example03
JCode Cell
1 
2<login-config>:
3

Declarative Security(web.xml declarations)

This tag defines the following 3 child tags

Example04
JCode Cell
1 
2<security-constraint>:
3

Declarative Security(web.xml declarations)

Defines the resource which has to be protected

Example05
JCode Cell
1 
2<web-resource-collection>
3

Declarative Security(web.xml declarations)

Authorization constraint which determines what roles are allowed to access the resource.

Example06
JCode Cell
1 
2<auth-constraint>
3

Declarative Security(web.xml declarations)

It specifies what type of protection is required when trasporting the resource accross the

network.

1.<web-resource-collection>:

This tag contains the following 4 child tags

1.<web-resource-name>

2.<description>

3.<url-pattern>

4.<http-method>

It specifies the Http method to which security constraint is applicable.

If we are not using this tag, then security constraint is applicable for all methods.

2.<auth-constraint>:

It specifies which security roles are allowed to access protected resource.

It contains the following 2 child tags.

1.<description>

2.<role-name>

If the security constraint is applicable for all the roles, we have to specify as follows...

<role-name>*</role-name>

3.<user-data-constraint>:

This tag contains the following 2 child tags

1.<description>

2.<transport-guarentee>

This tag specifies what type of guarantee we are providing while transporting the resource

across the network.

The allowed values for this tag are:

1.NONE:

It means the data is transported in plain text form.

It is the default value

2.INTEGRAL:

It means the data should not be changed in trans

  • CONFIDENTIAL:

It means the data is transported in encryption form.

The required priority order is: CONFIDENTIAL,INTEGRAL and NONE.

Example07
JCode Cell
1 
2<user-data-constraint>
3

Declarative Security(web.xml declarations)

This tag specifies the type of authentication we are using.

It contains the following child tags

1.<auth-method>

It specifies the authentication method

The allowed values are

BASIC

DIGEST

FORM

CLIENT-CERT

Example08
JCode Cell
1 
2<login-config>
3

Declarative Security(web.xml declarations)

It specifies the location where we are storing authentication information.

It is required only for basic authentication.

Example09
JCode Cell
1 
2<realm-name>
3

Declarative Security(web.xml declarations)

This tag is required to specify login page url and error page url in the case of Form based

authentication.

This tag contains the following 2 child tags

1.<form-login-page> /login.html </form-login-page>

2.<form-error-page> /error.html </form-error-page>

3.<security-role>:

It can be used to define security roles in the web application.

This tag contains the following 2 child tags.

1.<description>

2.<role-name>

Summary of all security related tags:

Example10
JCode Cell
1 
2<form-login-config>
3

Declarative Security(web.xml declarations)

Example11
JCode Cell
1 
2<web-app>
3<security-constraint>
4<web-resource-collection>
5<web-resource-name>
6<description>
7<url-pattern>
8<http-method>
9</web-resource-collection>
10 
11<auth-constraint>
12<description>
13<role-name>
14</auth-constraint>
15 
16<user-data-constraint>
17<description>
18<transport-guarentee>
19</user-data-constraint>
20</security-constraint>
21 
22<login-config>
23<auth-method>
24<realm-name>
25<form-login-config>
26<form-login-page>
27<form-error-page>
28</form-login-config>
29</login-config>
30 
31<security-role>
32<description>
33<role-name>
34</security-role>
35 
36</web-app>
37

Demo Program for Basic Authentication

web.xml:

Demo Program for Basic Authentication

<tomcat-users>

...

<role rolename="durgarole"/>

<user name="durga" password="java" roles="durgarole" />

<user name="ravi" password="scjp" roles="durgarole" />

</tomcat-users>

postreqform.html:

Example13
JCode Cell
1 
2<web-app>
3<servlet>
4<servlet-name>FirstSevlet</servlet-name>
5<servlet-class>FirstServlet</servlet-class>
6</servlet>
7 
8<servlet-mapping>
9<servlet-name>FirstSevlet</servlet-name>
10<url-pattern>/test</url-pattern>
11</servlet-mapping>
12 
13<security-constraint>
14<web-resource-collection>
15<web-resource-name>CheckedServlet</web-resource-name>
16<url-pattern>/test</url-pattern>
17<http-method>POST</http-method>
18<http-method>GET</http-method>
19</web-resource-collection>
20 
21<auth-constraint>
22<role-name>durgarole</role-name>
23</auth-constraint>
24 
25</security-constraint>
26 
27<login-config>
28<auth-method>BASIC</auth-method>
29</login-config>
30 
31 
32<security-role>
33<role-name>durgarole</role-name>
34</security-role>
35 
36</web-app>tomcat-users.xml:
37

Demo Program for Basic Authentication

Example14
JCode Cell
1 
2<html>
3<body><h1> Basic Authentication Demo to send POST request</h1>
4<form action = "/webs1/test" method="POST">
5Enter Text :<input type=text name="text">
6<input type=submit>
7</form>
8</body>
9</html>
10

FirstServlet.java

Demo Program for FORM-BASED Authentication:

login.html:

Example15
JCode Cell
1 
2import javax.servlet.*;
3import javax.servlet.http.*;
4import java.io.*;
5public class FirstServlet extends HttpServlet
6{
7public void doGet(HttpServletRequest req,HttpServletResponse resp) throws ServletException,IOException
8{
9PrintWriter out = resp.getWriter();
10out.println("<h1>Get:After Authentication only we can access this servlet</h1>");
11}
12public void doPost(HttpServletRequest req,HttpServletResponse resp) throws ServletException,IOException
13{
14PrintWriter out = resp.getWriter();
15out.println("<h1>POST:After Authentication only we can access this servlet</h1>");
16}
17}
18
Output

<h1>Get:After Authentication only we can access this servlet</h1>
<h1>POST:After Authentication only we can access this servlet</h1>

FirstServlet.java

<h1>Your credentials are not correct. Please provide valid credentials</h1>

web.xml:

Example16
JCode Cell
1 
2<html>
3<body><h1> Welcome to Durga Software Solutions</h1><br>
4<h2>Please login to avail the facilities....</h2>
5<form action = "j_security_check">
6Enter Name :<input type=text name="j_username"><br>
7Enter password :<input type=password name="j_password"><br>
8<input type=submit>
9</form>
10</body>
11</html>error.html:
12

FirstServlet.java

Example17
JCode Cell
1 
2<web-app>
3<servlet>
4<servlet-name>FirstSevlet</servlet-name>
5<servlet-class>FirstSevlet</servlet-class>
6</servlet>
7 
8<servlet-mapping>
9<servlet-name>FirstSevlet</servlet-name>
10<url-pattern>/test</url-pattern>
11</servlet-mapping>
12 
13<security-constraint>
14<web-resource-collection>
15<web-resource-name>CheckedServlet</web-resource-name>
16<url-pattern>/test</url-pattern>
17<http-method>GET</http-method>
18<http-method>POST</http-method>
19</web-resource-collection>
20<auth-constraint>
21<role-name>durgarole</role-name>
22</auth-constraint>
23</security-constraint>
24 
25<login-config>
26<auth-method>FORM</auth-method>
27<form-login-config>
28<form-login-page>/login.html</form-login-page>
29<form-error-page>/error.html</form-error-page>
30</form-login-config>
31</login-config>
32 
33<security-role>
34<role-name>durgarole</role-name>
35</security-role>
36</web-app>tomcat-users.xml:
37<tomcat-users>
38...
39<role rolename="durgarole"/>
40<user name="durga" password="java" roles="durgarole" />
41<user name="ravi" password="scjp" roles="durgarole" />
42</tomcat-users>postreqform.html:
43<html>
44<body><h1> Basic Authentication Demo to send POST request</h1>
45<form action = "/webs2/test" method="POST">
46Enter Text :<input type=text name="text">
47<input type=submit>
48</form>
49</body>
50</html>
51
📝 Key Takeaways
  • Key ideas of Servlet - Declarative Security (web.xml) explained simply
  • Ready-to-use code examples
  • Exam-style questions at the end

🧠 Test Your Knowledge

3 Questions
Progress: 0 / 3