use google, or read the specification.servlet spec, if security on servlets,or ejb spec if secutiry on your beans.