tomcat指定项目使用简单密码访问

vim apache-tomcat-8.5.56/webapps/XXXXXX(对应项目)/WEB-INF/web.xml

<?xml version="1.0" encoding="UTF-8"?>  
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">  
  <display-name>app</display-name>  
  <welcome-file-list>  
    <welcome-file>index.html</welcome-file>  
    <welcome-file>index.htm</welcome-file>  
    <welcome-file>index.jsp</welcome-file>  
    <welcome-file>default.html</welcome-file>  
    <welcome-file>default.htm</welcome-file>  
    <welcome-file>default.jsp</welcome-file>  
  </welcome-file-list>  
    
<security-constraint>
      <web-resource-collection>
         <web-resource-name>force login</web-resource-name>
         <!-- Define the context-relative URL(s) to be protected -->
         <url-pattern>/*</url-pattern>
         <http-method-omission>POST</http-method-omission>
         <!-- If you list http methods, only those methods are protected -->
      </web-resource-collection>
      <auth-constraint>
         <!-- Anyone with one of the listed roles may access this area -->
         <role-name>tomcat</role-name>
         <role-name>role1</role-name>
      </auth-constraint>
    </security-constraint>
	<login-config>   
	<auth-method>BASIC</auth-method> 
	<realm-name>force login</realm-name>
	</login-config>
    <!-- Security roles referenced by this web application -->
    <security-role>
      <role-name>tomcat</role-name>
      <role-name>role1</role-name>
    </security-role>  
   
</web-app>

取消注释
vim apache-tomcat-8.5.56/conf/tomcat-users.xml

 <role rolename="tomcat"/>
  <role rolename="role1"/>
  <role rolename="manager-gui"/>
  <user username="tomcat" password="passwords" roles="tomcat,manager-gui"/>
  <user username="admin" password="passwords" roles="tomcat,role1"/>
  <user username="role1" password="passwords" roles="role1"/>

tip：
1、输入密码后一直重复让输入，检查密码录入是否包含特殊字符。比如：& 在xml中非法。
2、访问403，确认下http-method-omission的类型。

参考：
https://blog.51cto.com/53cto/1754424