Tech Challenge

2026-07-20

🔐

Daily Tech Challenge

Cybersecurity

medium

Question 1 of 5

This Java EE security constraint requires the 'admin' role for /admin/*. An unauthenticated attacker retrieves a protected admin page by sending a request with a method that is NOT listed, such as HEAD. Why does the constraint fail to stop them?

Example

<security-constraint>
  <web-resource-collection>
    <url-pattern>/admin/*</url-pattern>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
  </web-resource-collection>
  <auth-constraint>
    <role-name>admin</role-name>
  </auth-constraint>
</security-constraint>

Monday, July 20, 2026 · A new challenge drops every day