Security constraint does not protect URL ---------------------------------------- Key: WFLY-3261 URL: https://issues.jboss.org/browse/WFLY-3261 Project: WildFly Issue Type: Bug Security Level: Public(Everyone can see) Components: Web (Undertow) Affects Versions: 8.1.0.CR1 Reporter: Simon Martinelli Assignee: Stuart Douglas Security constraint works as expected on JBoss EAP 6.2.2 and JBoss AS 7.1.1.Final but no on Wildfly *web.xml* {code:xml} <security-constraint> <display-name>Spaces</display-name> <web-resource-collection> <web-resource-name>spaces</web-resource-name> <url-pattern>/spaces/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>user</role-name> </auth-constraint> </security-constraint> {code} *jboss-web.xml* {code:xml} <jboss-web> <context-root>/jtaf</context-root> <security-domain>jtaf</security-domain> </jboss-web> {code} *standalone.xml* {code:xml} <security-domain name="jtaf" cache-type="default"> <authentication> <login-module code="Database" flag="required"> <module-option name="dsJndiName" value="java:jboss/datasources/MysqlDS"/> <module-option name="principalsQuery" value="select secret from securityuser where email = ?"/> <module-option name="rolesQuery" value="select name, 'Roles' from securitygroup where email = ?"/> <module-option name="password-stacking" value="useFirstPass"/> <module-option name="hashAlgorithm" value="MD5"/> <module-option name="hashEncoding" value="base64"/> </login-module> </authentication> </security-domain> {code}