AppFuseSecuritySettings

This is version 3. It is not the current version, and thus it cannot be edited.
[Back to current version]   [Restore this version]

Security Settings in AppFuse

This page is intended to be a catch-all for security related configurations in AppFuse. Most of the security settings are found in one file /metadata/web/web-security.xml. By default, all actions require a login except the PasswordHintAction and SignupAction. But only actions are protected. So all static content, or other resource mappings that don't match the pattern *.html do not require a login to access.

Allowing an action to be accessed without a login.

...
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>Unrestricted</web-resource-name>
            <description>All users can view</description>
            <url-pattern>/passwordHint.html</url-pattern>
            <url-pattern>/signup.html</url-pattern>

            <!-- Allow MyAction to be accessed with out a login -->
            <url-pattern>/myaction.html</url-pattern>

            <http-method>POST</http-method>
            <http-method>GET</http-method>
        </web-resource-collection>
...