The whole reason for putting JSPs under the WEB-INF/ directory is so that they cannot be accessed directly through a URL.
The J2EE specification for web containers dictates that anything put in WEB-INF or its child directories cannot be accessible through a URL. The reasoning for putting pages there is that it isn't a good idea for a user to be able to call a JSP page directly by name. This makes it so that the only way to reach /WEB-INF/xyz.jsp is by calling an action or Servlet that forwards to it (xyzAction.do). [ October 17, 2006: Message edited by: Merrill Higginson ]