Why put JSP in WEB-INF?

Question

I noticed a common pattern is to put JSP pages in WEB-INF folder (as opposed to WAR root). What\'s the difference? Why is that preferred?

Answer 1

I don't think it's a good design pattern, but I believe I can explain the reasoning.

Servlet containers won't serve any content in WEB-INF. By putting your JSPs there, you prevent anyone from directly accessing a JSP by navigating to it in the browser by name. This might be considered good practice, if some of your JSPs are just fragments of code/markup, and not meant to be used directly, and perhaps open some security hole you haven't though of.

It's still possible to get the container to see and use the JSPs as expected even in WEB-INF.