[UNDERTOW-1997] Corrected handling of security constraints with URL p…

…attern '/'
undertow-io · Aug 11, 2022 · e2b1e68 · e2b1e68
1 parent e8ae803
commit e2b1e68
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/servlet/src/main/java/io/undertow/servlet/handlers/security/SecurityPathMatches.java b/servlet/src/main/java/io/undertow/servlet/handlers/security/SecurityPathMatches.java
@@ -139,6 +139,14 @@ public SecurityPathMatch getSecurityInfo(final String path, final String method)
             handleMatch(method, extensionMatch, currentMatch);
             return new SecurityPathMatch(currentMatch.type, mergeConstraints(currentMatch));
         }
+
+        // if nothing else, check for security info defined for URL pattern '/'
+        match = exactPathRoleInformation.get("/");
+        if (match != null) {
+            handleMatch(method, match, currentMatch);
+            return new SecurityPathMatch(currentMatch.type, mergeConstraints(currentMatch));
+        }
+
         return new SecurityPathMatch(currentMatch.type, mergeConstraints(currentMatch));
     }