The section https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1#combining-constraints is confusing to read and interpret.
Example: if we have 2 constraints declared, no roles, just blanket authentication constraints, both with the same http-method-omission, what is the resulting combined constraint?
Example:
<security-constraint>
<web-resource-collection>
<web-resource-name>constraint A</web-resource-name>
<url-pattern>/test/*</url-pattern>
<http-method-omission>GET</http-method-omission>
</web-resource-collection>
<auth-constraint/>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>constraint B</web-resource-name>
<url-pattern>/test/*</url-pattern>
<http-method-omission>GET</http-method-omission>
</web-resource-collection>
<!-- Intentionally Omitted: <auth-constraint/> -->
</security-constraint>If we read the spec, then "constraint B" should win, and all methods should be served without auth-constraint restriction as the unchecked constraint wins over the checked constraint. The combine doesn't have to merge roles, as there are none, so no union logic or anything else that exists in the linked spec section.
But in testing, no servlet container actually does this. (tomcat, jetty, glassfish).
The spec has an example after the linked section, but it's overly complex and doesn't adequately explain things, especially with things like http-method-omission.
I also cannot find a TCK test that covers this section adequately.
The section https://jakarta.ee/specifications/servlet/6.1/jakarta-servlet-spec-6.1#combining-constraints is confusing to read and interpret.
Example: if we have 2 constraints declared, no roles, just blanket authentication constraints, both with the same http-method-omission, what is the resulting combined constraint?
Example:
If we read the spec, then "constraint B" should win, and all methods should be served without auth-constraint restriction as the unchecked constraint wins over the checked constraint. The combine doesn't have to merge roles, as there are none, so no union logic or anything else that exists in the linked spec section.
But in testing, no servlet container actually does this. (tomcat, jetty, glassfish).
The spec has an example after the linked section, but it's overly complex and doesn't adequately explain things, especially with things like http-method-omission.
I also cannot find a TCK test that covers this section adequately.