javaee url-pattern “/” matches everything, while this should be the case for “/*” only, not for “/”
问题 <security-constraint> <web-resource-collection> <web-resource-name>Common pages</web-resource-name> <url-pattern>/test1.html</url-pattern> <http-method>GET</http-method> </web-resource-collection> <auth-constraint> <role-name>MY_GROUP</role-name> </auth-constraint> </security-constraint> as expected, with this constraint, the page /test1.html needs authentication, and the page /test2.html does not need authentication. <security-constraint> <web-resource-collection> <web-resource-name>Common