The Security Token Service must be configured to limit access to internal packages.

The "package.access" entry in the "catalina.properties" file implements access control at the package level. When properly configured, a Security Exception will be reported if an errant or malicious webapp attempts to access the listed internal classes directly or if a new class is defined under the protected packages. The Security Token Service comes preconfigured with the appropriate packages defined in "package.access", and this configuration must be maintained.