title: How to protect expired session clean-up with a security constraint?
body: <p><strong>The protection attempt</strong></p>
  
  <p>The URL</p>
  
  <pre><code>http://[GAE app URL]/_ah/sessioncleanup?clear
  </code></pre>
  
  <p>clears 100 expired sessions from the GAE datastore (so it seems).</p>
  
  <p>I wanted to protect this URL so that it can be called from within the app using an entry in <code>cron.xml</code> like</p>
  
  <pre><code>&lt;cronentries&gt;
    [...]
  
    &lt;cron&gt;
      &lt;url&gt;/_ah/sessioncleanup?clear&lt;/url&gt;
      &lt;description&gt;Clean 100 expired sessions up&lt;/description&gt;
      &lt;schedule&gt;[Schedule]&lt;/schedule&gt;
    &lt;/cron&gt;
  &lt;/cronentries&gt;
  </code></pre>
  
  <p>but not from just any user following the URL of the form given above.</p>
  
  <p>So I added the following code to <code>web.xml</code>:</p>
  
  <pre><code>&lt;web-app&gt;
  [...]
  
    &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;session-clean-up&lt;/web-resource-name&gt;
        &lt;url-pattern&gt;/_ah/sessioncleanup&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
        &lt;role-name&gt;admin&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
    &lt;/security-constraint&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p>I omitted adding the following to <code>web.xml</code> since the session clean-up takes place using a manual URL invocation without it:</p>
  
  <pre><code>&lt;web-app&gt;
    [...]
  
    &lt;servlet&gt;
      &lt;servlet-name&gt;_ah_sessioncleanup&lt;/servlet-name&gt;
      &lt;servlet-class&gt;com.google.apphosting.utils.servlet.SessionCleanupServlet&lt;/servlet-class&gt;
    &lt;/servlet&gt;
  
    &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;_ah_sessioncleanup&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/_ah/sessioncleanup&lt;/url;-pattern&gt;
    &lt;/servlet-mapping&gt;
  &lt;/web-app&gt;
  </code></pre>
  
  <p><strong>Result</strong></p>
  
  <p>Sadly, after deployment of this code into production, I find that no protection has been given by the addition of the <code>&lt;security-constraint&gt;</code> above to either</p>
  
  <pre><code>http://[GAE app URL]/_ah/sessioncleanup?clear
  </code></pre>
  
  <p>or</p>
  
  <pre><code>http://[GAE app URL]/_ah/sessioncleanup
  </code></pre>
  
  <p><strong>Background information</strong></p>
  
  <p>I based my code above on the posting by a Googler as referenced in <a href="https://code.google.com/p/googleappengine/issues/detail?id=10047&amp;can=4&amp;sort=priority&amp;colspec=ID%20Type%20Component%20Status%20Stars%20Summary%20Language%20Priority%20Owner%20Log" rel="nofollow">GAE issue 10047 (Request to document or publish code for SessionCleanupServlet)</a>.</p>
  
  <p><strong>My question</strong></p>
  
  <p>Does anyone know how I can solve my problem?</p>