为tomcat上的项目设置密码访问

conf目录下的设置 tomcat-user.xml文件中放开如下配置项：

<tomcat-users>
    <role rolename="yy_role"/>
    <user username="yyadmin" password="yyadmin" roles="yy_role"/>
</tomcat-users>

在项目的web-info目录下的web.xml中做如下配置项（如果没有web-info目录，从example项目中拷贝过来就行）：

<?xml version="1.0" encoding="UTF-8"?>  
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">  
  <display-name>app</display-name>  
  <welcome-file-list>  
    <welcome-file>index.html</welcome-file>  
    <welcome-file>index.htm</welcome-file>  
    <welcome-file>index.jsp</welcome-file>  
    <welcome-file>default.html</welcome-file>  
    <welcome-file>default.htm</welcome-file>  
    <welcome-file>default.jsp</welcome-file>  
  </welcome-file-list>  
    
<security-constraint>
      <web-resource-collection>
         <web-resource-name>force login</web-resource-name>
         <!-- Define the context-relative URL(s) to be protected -->
         <url-pattern>/*</url-pattern>
         <!-- If you list http methods, only those methods are protected -->
      </web-resource-collection>
      <auth-constraint>
         <!-- Anyone with one of the listed roles may access this area -->
         <role-name>yy_role</role-name>
      </auth-constraint>
    </security-constraint>
	<login-config>   
	<auth-method>BASIC</auth-method> 
	<realm-name>force login</realm-name>
	</login-config>
    <!-- Security roles referenced by this web application -->
    <security-role>
      <role-name>yy_role</role-name>
    </security-role>  
   </web-app>

参照：
https://blog.51cto.com/53cto/1754424