Tuesday, September 3, 2002 09:21 AM
WEB-INF, as per Servlet Specifications, is a special directory that cannot be accessed from the web. This because it contains the web application descriptor (web.xml) that could contain relevant information regarding the configuration of your web application.
Inside the WEB-INF directory, besides the web application descriptor, there are the classes and the lib used by the application... accessing to this dir from 'outside' should also allow users to access to the code of the application.
You should never put files that required to be accessed from 'outside' (jsp, html, gif, css, etc.) inside this directory (and subdirectories).