How to disable direct access to jsp pages?

Question

I have a jsp page in java project, and i use from below code for hidden jsp extension from url, but also load my page with jsp extension in url. how to prevent of this? my code:

<servlet> 
<servlet-name>myTest</servlet-name>
<jsp-file>/testing.jsp</jsp-file>
</servlet>
<servlet-mapping>
<servlet-name>myTest</servlet-name>
<url-pattern>/test</url-pattern>
</servlet-mapping>

and url testing is : localhost/testing.jsp and my testing page is access.

Answer 1

For a quick solution, just put your JSP pages to the WEB-INF folder (then they will not be directly accessible) and define them like this:

   <servlet>
        <description>
        </description>
        <display-name>hidden</display-name>
        <servlet-name>hidden</servlet-name>
        <jsp-file>/WEB-INF/hidden.jsp</jsp-file>
    </servlet>
    <servlet-mapping>
        <servlet-name>hidden</servlet-name>
        <url-pattern>/hidden</url-pattern>
    </servlet-mapping>

but you should consider using frameworks to do it, like Struts2 or Spring.