How to exclude one url from authorization

Question

My web.xml looks like:

Answer 1

A solution is to use an alternate security framework like Apache Shiro instead of the container based security. Then it's easy to exclude a resource from the protected content. Using Shiro you would put in WEB-INF/shiro.ini:

[urls]
/info = anon
/**   = authc