Error in MP-JWT TCK; wrong usage of @HttpConstraint

[Arjan Tijms]

Hi,

I noticed the following being used in the MP-JWT TCK:

@HttpConstraint(rolesAllowed={"Tester"})

@WebServlet("/ServiceServlet/*")

public class ServiceServlet extends HttpServlet {

This however can not work according to the Servlet spec; @HttpConstraint is supposed to appear within a @ServletSecurity annotation, and not be used on its own.

See:

* https://docs.oracle.com/javaee/7/api/javax/servlet/annotation/HttpConstraint.html

* https://docs.oracle.com/javaee/7/api/javax/servlet/annotation/ServletSecurity.html

Kind regards,

Arjan Tijms