Cant do internal forward to /WEB-INF

Question

I've seen this problem referred to in earlier posts, but could not get a
          clear read on whether it represents "normal" behavior or a bug in Weblogic.
          I'm using Weblogic 6.1 SP1:
          I'm using the jakarta-struts-1.0.2 framework to develop a web app, and
          desire that certain JSPs not be accessible directly via the client's
          browser, but only through execution of a struts "Action". Thus, I put these
          JSPs in /<context-root/WEB-INF. Such JSPs are forwarded to via the struts
          servlet ("ActionServlet") per code similar to the following:
          RequestDispatcher rd =
          getServletContext().getRequestDispatcher("/WEB-INF/somefile.jsp");
          rd.forward(request, response);
          But I get the same 404-Not Found error as if I had targeted the JSP
          directly. My understanding of the Servlet/JSP spec is that such internal
          forwards are exempt from the WEB-INF restriction that applies to direct
          access.
          Is there a workaround for this? I'd like to have some mechanism whereby a
          given JSP can be targeted only after some initial processing by a Struts
          action.
          Thanks for any help on this ...
          

Answer 1

It's my understanding that this point in the specification was interpreted differently by BEA, such that it doesn't allow forwards or includes of content in WEB-INF. I also believe I heard that an option to control this will be introduced in the next major release.
          I've envisioned a possible workaround, although I haven't tried this. If all the JSP pages that you want to protect access to are also protected by security-constraints in your web.xml, then you can set the only role for all the JSP pages to "nobody", and then ensure that all protected JSP pages are only accessed through a forward from an action.