JSP/HTML files in WEB-INF

[ankur rathi]

If I don't want to let client access the JSP/HTML files directory, then I can put them in WEB-INF directory. But then how my application will access them?

Will container automatically figure out, where JSP files are???

Please comments.

Thanks.

[Jesper de Jong]

No, the container will not automatically find out where they are. The purpose of putting your JSP/HTML or other files in the WEB-INF directory (or a subdirectory of the WEB-INF directory) is to make sure that a client cannot access them directly by typing in an URL in his/her browser.

You can access them only from a servlet or JSP outside the WEB-INF directory, by forwarding from the servlet or JSP to one of the pages inside the WEB-INF directory.

[Hemant Agarwal]

You can also map your jsp files in web.xml

<servlet>
<servlet-name>someName</sevlet-name>
<jsp-file>someFile</jsp-file>
</servlet>

Then in servlet mappings section just map your servlet-name to the url-pattern you want to use for that jsp file. In this way you can access your jsp file directly from WEB-INF folder.

[Vishnu Prakash]

Consider you have a web-application where one jsp(MyJsp.jsp) is at the context root available to everyone and another jsp(SecuredJsp.jsp) inside WEB-INF. With the following code you can communicate between resources

  
    <%
RequestDispatcher dispatch = request.getRequestDispatcher("WEB-INF/SecuredJsp.jsp");
dispatch.forward(request, response);
    %>

But you cannot use response.sendRedirect(String resource) to communicate between resources.

[Vishnu Prakash]

You can access them only from a servlet or JSP outside the WEB-INF directory,

Not necessarily.

Consider the same example which I had explained in my previous post. Now lets add one more jsp page lets call it SecuredJspTwo.jsp inside WEB-INF.

After accessing MyJsp.jsp control is dispatched to SecuredJsp.jsp. Now include the following code inside SecuredJsp.jsp

  
        <%
RequestDispatcher dispatch = request.getRequestDispatcher("SecuredJspTwo.jsp");
dispatch.forward(request, response);
    %>

Since request.getRequestDispatcher() can take a relative path now request will be dispatched to SecuredJspTwo.jsp which is also inside WEB-INF.

Consider my next scenario

Create a servlet inside WEB-INF/classes/com/example/TestServlet.class

add the following in the service method

  
RequestDispatcher dispatch = request.getRequestDispatcher("WEB-INF/SecuredJspTwo.jsp");
dispatch.forward(request, response);
 

Access this servlet directly from your browser and you will end up in SecuredJspTwo.jsp page.

[ankur rathi]

Thanks a lot Vishnu.

It was great explanation and that too with code.