title: Web.xml Security Constraints not working
body: <p>Trying to get the security aspect of my web app up and going.  </p>
  
  <p>I've created a dynamic web application within eclipse and am trying to use a form based authentication setup.</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;web-app id="WebApp_ID" version="3.0"
   xmlns="http://java.sun.com/xml/ns/javaee"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"&gt;
   &lt;display-name&gt;Application&lt;/display-name&gt;
   &lt;context-param&gt;
    &lt;param-name&gt;javax.ws.rs.Application&lt;/param-name&gt;
    &lt;param-value&gt;com.foo.bar.webservices.MyApplication&lt;/param-value&gt;
   &lt;/context-param&gt;
   &lt;context-param&gt;
    &lt;param-name&gt;resteasy.servlet.mapping.prefix&lt;/param-name&gt;
    &lt;param-value&gt;/resteasy&lt;/param-value&gt;
   &lt;/context-param&gt;
   &lt;listener&gt;
    &lt;listener-class&gt;org.jboss.resteasy.plugins.server.servlet.ResteasyBootstrap&lt;/listener-class&gt;
   &lt;/listener&gt;
   &lt;servlet&gt;
    &lt;servlet-name&gt;Resteasy&lt;/servlet-name&gt;
    &lt;servlet-class&gt;org.jboss.resteasy.plugins.server.servlet.HttpServletDispatcher&lt;/servlet-class&gt;
   &lt;/servlet&gt;
   &lt;servlet&gt;
    &lt;display-name&gt;LoginServlet&lt;/display-name&gt;
    &lt;servlet-name&gt;LoginServlet&lt;/servlet-name&gt;
    &lt;servlet-class&gt;httpAuth.LoginServlet&lt;/servlet-class&gt;
   &lt;/servlet&gt;
   &lt;servlet-mapping&gt;
    &lt;servlet-name&gt;Resteasy&lt;/servlet-name&gt;
    &lt;url-pattern&gt;/resteasy/*&lt;/url-pattern&gt;
   &lt;/servlet-mapping&gt;
   &lt;servlet-mapping&gt;
    &lt;servlet-name&gt;LoginServlet&lt;/servlet-name&gt;
    &lt;url-pattern&gt;/LoginServlet&lt;/url-pattern&gt;
   &lt;/servlet-mapping&gt;
   &lt;welcome-file-list&gt;
    &lt;welcome-file&gt;/login.jsp&lt;/welcome-file&gt;
   &lt;/welcome-file-list&gt;
   &lt;security-constraint&gt;
    &lt;display-name&gt;Authorized Only&lt;/display-name&gt;
    &lt;web-resource-collection&gt;
     &lt;web-resource-name&gt;Authorized Only&lt;/web-resource-name&gt;
     &lt;url-pattern&gt;/restricted/*&lt;/url-pattern&gt;
     &lt;http-method&gt;GET&lt;/http-method&gt;
     &lt;http-method&gt;PUT&lt;/http-method&gt;
    &lt;/web-resource-collection&gt;
    &lt;auth-constraint&gt;
     &lt;description&gt;Allowed users&lt;/description&gt;
     &lt;role-name&gt;USER&lt;/role-name&gt;
    &lt;/auth-constraint&gt;
    &lt;user-data-constraint&gt;
     &lt;transport-guarantee&gt;NONE&lt;/transport-guarantee&gt;
    &lt;/user-data-constraint&gt;
   &lt;/security-constraint&gt;
   &lt;login-config&gt;
    &lt;auth-method&gt;FORM&lt;/auth-method&gt;
    &lt;form-login-config&gt;
     &lt;form-login-page&gt;/login.jsp&lt;/form-login-page&gt;
     &lt;form-error-page&gt;/logonError.jsp&lt;/form-error-page&gt;
    &lt;/form-login-config&gt;
   &lt;/login-config&gt;
   &lt;security-role&gt;
    &lt;role-name&gt;USER&lt;/role-name&gt;
   &lt;/security-role&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>However, when I deploy and go to <code>http://localhost:8080/Application/restricted/index.jsp</code> it shows, which it shouldn't do.  </p>
  
  <p>EDIT 1:  Have made change to remove /Application.  Doing so does not hold on pages such as /restricted/index.jsp</p>
  
  <h2>Folder Breakdown</h2>
  
  <pre><code>Application
     +build
     -WebContent
       +css
       +img
       +js
       login.jsp
       logonError.jsp
      +META-INF
      -restricted
        index.jsp
      +WEB-INF
  </code></pre>