Would JETTY (?JBossWeb?) mix roles?

[powro]

Hello,

I use JBoss 3.0.4 + JETTY (?JBossWeb?).

I have in my web application 2 roles : administrator and customer. It seems that JETTY (?JBossWeb?) allows each of them to access the resources of each other...

But maybe - more probably - there is an error in my web.xml?

I did the following test to be sure it is not an Internet Explorer cache problem : 1) as administrator : reset the database 2) as customer : update profile 3) as customer : reset the database 4) as customer : view profile - and it was as it should be after the database has been resetted, what the customer cannot do obviously :-)

I hope you can help me!

[jules]

If you have the time to invest this is how we should continue.

0. check sourceforge for similar reports..
1. test on the latest jboss-3.0.x (6).
2. compare Jetty and Tomcat integrations...

This will tell us whether the problem has already been fixed and whether it is in the webcontainer (integration) or Jboss itself.

If you get back to me with the results of these tests, we can decide how to go forward..

Jules