A security constraint define the access privileges to a collection of resources using their URL mapping.
A security constraint includes an authorization constraint that specifies whether users can access the path.
The following subelements can be part of a security-constraint:
Web resource collection,
A list of URL patterns (the part of a URL after the host name and port you want to constrain) and HTTP operations (the methods within the files that match the URL pattern you want to constrain) that describe a set of resources to be protected. Web resource collections are discussed in Specifying a Web Resource Collection.
Authorization constraint,
Specifies whether authentication is to be used and names the roles authorized to perform the constrained requests. For more information about authorization constraints, see Specifying an Authentication Mechanism in the Deployment Descriptor.
User data constraint.
Specifies how data is protected when transported between a client and a server. User data constraints are discussed in Specifying a Secure Connection.
Read more at: Specifying Security Constraints at Oracle site.
