Question

I am looking into the security model of Tomcat and have a question regarding when security realms come into effect. I have secured a portion of my web app:

<security-constraint>
  <display-name>My Realm</display-name>
    <web-resource-collection>
      <web-resource-name>MyServices</web-resource-name>
      <url-pattern>/service/*</url-pattern>
    </web-resource-collection>
  <auth-constraint>
    <description>AUser</description>
    <role-name>AUser</role-name>
  </auth-constraint>
</security-constraint>

and have configured this web app to use JDBCRealm.

I have an initial Filter defined where getSession() is invoked, and thus a cookie is returned to the client’s browser during the response. When the client makes another request, is the security realm bypassed when the cookie is returned (current authenticated session)? What class makes this decision (to invoke a security realm or not)? JDBCRealm has no notion of cookies or sessions, and RealmBase looks like it has some cookie logic, but not much.

Answer 1

It happens per session if possible, and happens here in AuthenticatorBase