rspec/rules/S2647/xml/rule.adoc

== Why is this an issue?

include::../description.adoc[]

=== Noncompliant code example

[source,xml]
----
// in web.xml
<web-app  ...>
  <!--  ...  -->
  <login-config>
    <auth-method>BASIC</auth-method>
  </login-config>
</web-app>
----

=== Exceptions

The rule will not raise any issue if HTTPS is enabled, on any URL-pattern.

[source,xml]
----
<web-app  ...>
  <!--  ...  -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>HTTPS enabled</web-resource-name>
      <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
      <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
  </security-constraint>
</web-app>
----

include::../see.adoc[]

ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

include::../message.adoc[]

'''
== Comments And Links
(visible only on this page)

include::../comments-and-links.adoc[]
endif::env-github,rspecator-view[]