Provide an isAccessAllowed method to see if user has access to URL

Nobody has claimed this yet.

Following the Servlet spec, security constraints can be specified in web.xml. The Servlet container internally uses these to determine whether the current user has access to a given URL (Servlet 3.0 specification Section 12.1).

There is however no method in the public API that user code can use to do the same check. A use case for this would be the rendering of a list of links (e.g. in a menu), where the requirement is to not render those links where the user does not have access to. Without a means to ask the Servlet container about the access for every link, the code must either duplicate the URL-role association somewhere (perhaps in a custom XML file), or has to duplicate the algorithm from Section 12.1.

Both solutions are not ideal, since the container already maintains this association and already has an implementation of said algorithm.

Therefor I would like to request a "boolean isAccessAllowed(String url, String role)" method to be provided by the Servlet API, perhaps added to HttpServletRequest, that user code can use to determine if the current user has access to a given URL (relative to the context root of the web app).

Start with HttpServletRequest and the Servlet 3.0 specification, especially Section 12.1, then review how security constraints in web.xml are represented and checked. Define the public API contract for checking access to a context-relative URL and role, including where it belongs and how its result should be specified; the issue is done when the API design is agreed and covered by the relevant specification and tests.

Written by the indexing model from the issue text.