Authenticate web applications BASIC, DIGEST, FORM, and CLIENT-CERT

Securing Web Applications

Web applications are created by application developers who give, sell, or otherwise transfer the application to an application deployer for installation into a runtime environment. Application developers communicate how to set up security for the deployed application by using annotations or deployment descriptors. This information is passed on to the deployer, who uses it to define method permissions for security roles, set up user authentication, and set up the appropriate transport mechanism. If the application developer doesn’t define security requirements, the deployer will have to determine the security requirements independently.

Some elements necessary for security in a web application cannot be specified as annotations for all types of web applications. This post point to links to give you a start for how to secure web applications using annotations wherever possible.

http://docs.oracle.com/javaee/6/tutorial/doc/gkbaa.html