There will be a component of the security API that handles page security, however it currently has low priority. In terms of what it will provide, most likely it will be simple role-based restriction to view-tier resources. There are plans to support X509 authentication, however it is quite a way off. There are currently no plans for special handling of http/https requests, I imagine that this kind of thing could be implemented by a servlet filter? View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3986338#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...