In short, you shouldn't access JSP variable in javascript directly. Theoretically you could create a cookie in the JSP that the javascript can then access, but I wouldn't recommend that under most conditions. If the data really needs to be hidden, I'd suggest another
pattern such as calling a
servlet separately.
What I would recommend is just generate code that creates a javascript variable such as 'var myJavaScriptVar = <%=myJSPVar%>;' or some variation that could then be used by the HTML/JavaScript page.