My highly unscientific test was only meant to see if a resource in the WEB-INF directory was accessible through a HTTP request. Based on the behaviour that I observed I assumed that anything that is not part of the document or servlet context will not be accessible. According to the section you referenced and I quote:
"The WEB-INF node is not part of the public document tree of the application. No file contained in the WEB-INF directory may be served directly to a client by the container." I would then assume then that the getRequestDispatcher method does not have direct access to the WEB-INF directory as per the 2.3 specifications. Greg. Craig Dickson <[EMAIL PROTECTED]> on 2002/10/03 01:46:01 PM Please respond to "JDJList" <[EMAIL PROTECTED]> To: "JDJList" <[EMAIL PROTECTED]> cc: Subject: [jdjlist] Re: Issue with servlet forwarding on WLS 7 Hi, Perhaps I wasn't clear. The client does _not_ request the JSP directly - ever. All requests go through a front side controller servlet, and that servlet forwards to the appropriate JSP. Section SRV9.5 of the Servlet 2.3 specification clearly states that clients cannot directly request resources under the WEB-INF directory. But it does say that Servlets and other server side resource do have access to the WEB-INF directory - via the getResource and getResourceAsStream methods. It does not specifically mention however, that the getRequestDispatcher method has access to the WEB-INF directory - perhaps this is where the confusion may be. In the section titled "Hide Resource from a Client" in the book "Core J2EE Patterns" (Alur et. al.), they suggest that if you use a front side controller (as I am) and then place all JSPs under the WEB-INF directory you have now made it impossible for a client to directly request a JSP - which is the desired affect that I want. All client requests go through the front side controller which has access to the WEB-INF directory and everything should be peaches! So there seems to be 3 possibilities: 1) the book is wrong, and the getRequestDispatcher method does not have access to the WEB-INF directory 2) or it is correct and I am doing something wrong 3) or both the book and I are correct and Weblogic is wrong. Has anyone tried this configuration before? Thanks, Craig -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Thursday, October 03, 2002 10:10 AM To: JDJList Subject: [jdjlist] Re: Issue with servlet forwarding on WLS 7 I just did a simple test on WebLogic 7.0 and for a JSP or a HTML page accessed directly through a browser I get the same 404 error. I don't believe that it will let you access anything under the WEB-INF folder through HTTP as it is not meant to be used for serving content files. I really doubt if any app server would allow access to anything under the WEB-INF directory to a HTTP/HTTPS request as it would mean that any class file, jar or any other resource would be accessible. Normally you wouldn't want this kind of behaviour for reasons that you have already pointed out. I couldn't find anything on BEA's site to confirm or deny my assumptions though.... HTH, Greg. ____________________________________________________ To change your JDJList options, please visit: http://www.sys-con.com/java/list.cfm Be respectful! Clean up your posts before replying ____________________________________________________
