问题:

I would like to exclude only one JSP file question.jsp from security-constraint.

I have this from my web.xml:

<security-constraint>
    <display-name>My Security Constraint</display-name>
    <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>      
        <url-pattern>*.do</url-pattern>
        <url-pattern>*.jsp</url-pattern>
    </web-resource-collection>
    <auth-constraint>      
        <role-name>*</role-name>
    </auth-constraint>
</security-constraint>

回答1:

Just add a free-pages section, without providing any auth-constraint. It will take precedence over protected pages:

<security-constraint>
  <web-resource-collection>
    <web-resource-name>free pages</web-resource-name>
    <url-pattern>/question.jsp</url-pattern>
  </web-resource-collection>
</security-constraint>

回答2:

One way to go about this is to move all your secure JSP content to a specific directory path (say /protected/ from web root) and then your web.xml content will look like :

<security-constraint>
    <display-name>My Security Constraint</display-name>
    <web-resource-collection>
        <web-resource-name>Protected Area</web-resource-name>      
        <url-pattern>/protected/*.jsp</url-pattern>

You may leave your public JSPs on default docroot or to some other directory path as required.