Should I be able to browse to /WEB-INF/whatever?

Question

All the documentation I can find says that files and folders underneath the /WEB-INF directory should, by default, be inaccesible to someone browsing my site. Any attempts to access these files or folders should return a "404 - File Not Found".
However, when I try to browse to, say, /WEB-INF/classes/someresourcebundle.properties my browser happily loads it. The same with /WEB-INF/struts-config.xml, or any other file under this directory.
It is my understanding the servlet specification states that any attempts to access the /WEB-INF hierarchy should be met with a "404 - File Not Found". I can restrict access to WEB-INF by adding some lines to my httpd.conf, like so:
<Location "/WEB-INF/*">
        AllowOverride None
        deny from all
</Location>
<Directory "C:/siteroot/WEB-INF/">
        AllowOverride None
        deny from all
</Directory>...but this returns a "403 - Forbidden" rather than a 404.
Am I supposed to explicitly map WEB-INF to be served by Tomcat? If so, how do I do this? If not, what's going on here? What do I need to do to make this behave as it's supposed to?
Thanks,
millz

Answer 1

Are you using Tomcat with Apache? AFAIK, under these conditions, WEB-INF will be accessible since it is Apache that is serving the files and not Tomcat.
[edit]
The final step in our Apache/Tomcat integration is a step that restricts all requests to the /example application's WEB-INF directory. This is done by telling Apache that it should deny all requests to the /examples/WEB-INF directory. The following <Location> element enforces this constraint:
<location "/examples/web-inf/">
AllowOverride None
deny from all
</location>
This is what it says in the ONJava tutorial for running Tomcat with Apache http://www.onjava.com/pub/a/onjava/2002/11/20/tomcat.html?page=2, one of the last steps.
[edit]
Message was edited by:
nogoodatcoding