provide a configuration to block access to assets (like the AssetProtectionDispatcher)

Alejandro Scandroli added a comment - 01/Jun/12 5:36 PM Here is one solution: public class AssetProtectionModule { public static void contributeSecurityConfiguration(Configuration<SecurityFilterChain> configuration, @Symbol(SymbolConstants.ASSET_PATH_PREFIX) final String assetPathPrefix, SecurityFilterChainFactory factory) { configuration.add(factory.createChainWithRegEx(assetPathPrefix + ".*/$" ).add(factory.notfound()).build()); final String pattern = ".*\\.((css)|(js)|(jpg)|(jpeg)|(png)|(gif))$" ; final Pattern p = Pattern.compile(pattern); configuration.add(factory.createChain(pattern, new PatternMatcher() { @Override public boolean matches( String ignored, String source) { return source.startsWith(assetPathPrefix) && !p.matcher(source).matches(); } }).add(factory.notfound()).build()); } } Now I think there is no point in having this out-of-the-box in tapestry-security. For documentation purposes I've created a github gist so you can follow my train of thoughts: https://gist.github.com/2831057