<div dir="ltr" style="text-align: left;" trbidi="on"> <div dir="ltr" style="text-align: left;" trbidi="on"> j2ee standard way of protecting resources and login setup as mentioned here if we don't mention http-method in web.xml all methods will be protected by default . in other words if you mention <http-method>GET</http-method>, this would protect only GET method for all resources and other methods like PUT,TRACE,HEAD,UPDATE,PATCH and DELETE requests on the resources would not be protected web.xml ----------- <security-constraint> <web-resource-collection> <web-resource-name>All Access</web-resource-name> <url-pattern> ...