I had the same problem that day. I set up Tomcat security, it worked locally (on a Windows computer), but after deploying to a production server, it gave me a 403 forbidden error. The fact is that on a Linux and Linux production server, tomcat has different default settings than Windows tomcat.
My solution was to define every possible option in config to match the default settings of Windows + my config. It worked.
Sorry for the lack of examples, but that was a long time ago, and I just can't find the project.
Hope this helps.
source share