spring mvc and jsp pages location under webapp vs WEB-INF

Question

I have question on spring mvc and jsp pages location under webapp vs under WEB-INF.

Lets say we have below setup.

webapp
  WEB-INF
    mvc-dispatcher.xml
    web.xml
  login.jsp
  register.jsp
  success.jsp
  error.jsp
  index.jsp

I can refer to pages from browser using urls like http://host.com/app/index.jsp and from there I can link (a href) to register.jsp. From register.jsp I post to controller which can return success view that resolves to success.jsp (using InternalResourceViewResolver).

If I move jsp pages under WEB-INF (instead of earlier under webapp) I will be unable to refer http://host.com/app/index.jsp from browser. Also from success.jsp currently I link to index.jsp using a href="index.jsp" which will need to change to map to controller (may be at / like the dispatcher servlet) that would return index as view name. So all my links will need to be served by controller. am I right ? or is there a way to refer to jsp pages without any mapped controller when jsp pages are located under WEB-INF (given InternalResourceViewResolver is configured).

Regards,

Miten.

madhead - StandWithUkraine madhead - StandWithUkraine · Accepted Answer · 2013-02-19T11:51:50

You are absolutely right. You cannot refer to JSPs inside WEB-INF directly from browser. And this is very good. All you requests should be forwarded to JSP via controller, and all your JSP should be under WEB-INF. There are many reasons to do so:

Users cannot get actual source of you JSPs, and it positively impacts on security.
Many JSPs rely on some request attributes to exist (The Model). When user calls JSPs directly from browser, the Model is not present. This may break some logic.
One JSP under WEB-INF may be used to serve different URLs without any changes, and users will know nothing about it!
It's just a good practice, when you do MVC (Model 2, not Model 1)

Considering you question about direct referring to JSPs without Controller:

You can directly map HTTP exceptions / Throwables to JSPs via JSP error pages. A simple technique is good for custom 404, for example.
When using Apache Tiles + Spring and accessing some /notmappedurl Spring (Tiles) will try to find notmappedurl template definition. (From my experience with Tiles + Spring). I think other view technologies have similar behavior.
It is not very difficult to write: @RequestMapping("/someurl")void someurl(){}. Spring will try to find someurl view, based on method name. Just a stub.

spring mvc and jsp pages location under webapp vs WEB-INF

1 Answers