Hopefully this will help clear things up a bit...
(from Ted Husted's Struts Catalog) (http://husted.com/about/scaffolding/catalog.htm) ----------- Place all Java ServerPages below WEB-INF Note: This is not supported by all containers (e.g. WebLogic). If you believe it should be, contact your vendor. The Servlet 2.3 specification makes it much clearer that this is allowed. The container provides security for all files below WEB-INF. This applies to client requests, but not forwards from the ActionServlet. Placing all JSPs below WEB-INF ensure that they are only accessed through Actions, and not directly by the client or each other. This allows security to be moved up into the Controller, where it can be handled more efficiently, and out of the base presentation layer. However, if your Java ServerPages need to access a number of other HTML resources, like images and stylesheets, it may be more convenient to leave them in the document root. If you are using Link only to Actions, then the address of your JSP's is never exposed anyway, and this strategy loses much of its value. Link only to Actions is usually sufficient. ------------ we're following Ted's suggestion for putting jsps in WEB-INF and it's been working well so far. the only downside i've seen is that jBuilder5's webapp format isn't open-minded to jsps being under WEB-INF. (if anyone knows a work-around please share! =) _\|/_______________________________ generation-d development andrew b forman aim: ph0rman > -----Original Message----- > From: Tom Lister [mailto:[EMAIL PROTECTED]] > Sent: Tuesday, December 18, 2001 10:40 AM > To: 'Struts Users Mailing List' > Subject: RE: 404 error when placing JSPs beneath WEB-INF > I thought that although you cannot access directly, you are allowed to > forward from a servlet/jsp. And that this is an option for securing pages. > Does this have any bearing on my earlier post re trying to access > WEB-INF/javadoc/index.html? > :-) > Regards > [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> > Advanced Banking Solutions Limited > +44 (0)20 7448 9146 > -----Original Message----- > From: D. Veniseleas [SMTP:[EMAIL PROTECTED]] > Hi, > > You shouldn't have jsp's under WEB-INF, but only xml-files for > webapp-configuration, > compiled classes, libraries, tag-lib-descriptor-files etc. > WEB-INF and beneath is not accessible from outside. > > Regards, > > Dimitris > > -----Urspr�ngliche Nachricht----- > > Von: [EMAIL PROTECTED] [SMTP:[EMAIL PROTECTED]] > After reading the Struts Catalogue and having spent a good > > amount of time trying to get the JSPs run under the > > web-inf directory, I figured out that there has been a thread > > on "Can't place JSP beneath WEB-INF in WebLogic 6.0". -- To unsubscribe, e-mail: <mailto:[EMAIL PROTECTED]> For additional commands, e-mail: <mailto:[EMAIL PROTECTED]>
