Re: Why should you call JSP pages directly?

[Craig R. McClanahan]

Maya Muchnik wrote:

> One way, as I know, is to put all jsp, except index.jsp (or similar start up)
> under a protected directory. For Tomcat the secure directory is setup in web.xml
> (see web.xml for webapps/example, directory is example/jsp/security/protected).
> See also Tomcat instruction (I need refresh my memory myself).
>

Using container-managed security in this way is indeed portable.

A second portable mechanism (assuming that your container works correctly per the
servlet spec) is to put your JSP pages under WEB-INF.  This works because the servlet
container is prohibited from allowing a client to access these JSP pages directly --
but it is entirely legal to do a RequestDispatcher.include() or
RequestDispatcher.forward() call to access them, as Struts does when you forward to
the appropriate page.

Craig