Can Apache restrict access based on a Tomcat webapp's Spring SecurityContext?

We have a tomcat webapp which provides webservices which are protected using Spring Security. The client makes a call to a specific authenticationService method which we wrote to authenticate them and create an authToken which is then used to register them with Spring Security as so:

SecurityContextHolder.getContext().setAuthentication( authToken )

That's all fine and good. However, we also have the requirement that authenticated users be able to access static content which is served by Apache (httpd) on the 开发者_JAVA技巧same server. Is there a way to enforce the requirement that the user has been authenticated (by Java/Spring) before they can download the static content? It seems like Apache and Tomcat would have to somehow share the SecurityContext.

OR - alternatively it seems like Tomcat could serve the static content itself since it already has access to the SecurityContext. If that is the best solution, could anyone provide a pointer to how we would get tomcat to do that (serve static content after checking that the user has been authenticated).

Thanks.

---

Yes, Tomcat is going to have to serve the static content.

mvc:resources can be helpful here. After that is set up protect those mappings using the standard intercept-url configuration.