A Web module consists of servlets, JavaServer Pages (JSP) files, server-side utility classes, static Web content that includes HTML, images, sound files, cascading style sheets (CSS), and client-side classes applets. You can use development tools such as Rational Application Developer to develop a Web module and enforce security at the method level of each Web resource.
You can identify a Web resource by its URI pattern. A Web resource method can be any HTTP method (GET, POST, DELETE, PUT, for example). You can group a set of URI patterns and a set of HTTP methods together and assign this grouping a set of roles. When a Web resource method is secured by associating a set of roles, grant a user at least one role in that set to access that method. You can exclude anyone from accessing a set of Web resources by assigning an empty set of roles. A servlet or a JavaServer Pages (JSP) file can run as different identities before invoking another enterprise bean component. All the secured Web resources require the user to log in by using a configured login mechanism. Three types of Web login authentication mechanisms are available: basic authentication, form-based authentication and client certificate-based authentication.
For more detailed information on Web security, see the product architectural overview article.
Related concepts
Securing Web applications using an assembly tool