Which XHTML files do I need to put in /WEB-INF and which not?

by

Files in /WEB-INF folder are indeed not publicly accessible by enduser. So you cannot have something like http://localhost:8080/contextname/WEB-INF/some.xhtml. That would be a potential security hole as the enduser would be able to view among others /WEB-INF/web.xml and so on.

You can however use the /WEB-INF folder to put master template files, include files and tag files in. For example, the following template client page.xhtml which is placed outside /WEB-INF and is accessible by http://localhost:8080/contextname/page.xhtml:

<ui:composition template="/WEB-INF/templates/template.xhtml"
    xmlns="http://www.w3.org/1999/xhtml"
    xmlns:f="http://java.sun.com/jsf/core"
    xmlns:h="http://java.sun.com/jsf/html"
    xmlns:ui="http://java.sun.com/jsf/facelets"
>
    <ui:define name="content">
        ...
        <ui:include src="https://stackoverflow.com/WEB-INF/includes/include.xhtml" />
        ...
    </ui:define>
</ui:composition>

The advantage of placing master templates and include files in /WEB-INF is that the enduser won’t be able to open them directly by entering/guessing its URL in the browser addres bar. The normal pages and template clients which are intented to be accessed directly must not be placed in /WEB-INF folder.

By the way, the composite component files are in turn also not supposed to be publicly accessible, however they are by specification required to be placed in /resources folder which is by default publicly accesible. If you make sure that you access all resources using the therefor provided components so that they are never accessed by /resources in URL (but instead by /javax.faces.resource), then you can add the following constraint to web.xml to block all public access to the /resources folder:

<security-constraint>
    <display-name>Restrict direct access to the /resources folder.</display-name>
    <web-resource-collection>
        <web-resource-name>The /resources folder.</web-resource-name>
        <url-pattern>/resources/*</url-pattern>
    </web-resource-collection>
    <auth-constraint />
</security-constraint>

More Related Contents:

  1. JSTL in JSF2 Facelets… makes sense?
  2. JSF returns blank/unparsed page with plain/raw XHTML/XML/EL source instead of rendered HTML output
  3. How to include another XHTML in XHTML using JSF 2.0 Facelets?
  4. How to reference CSS / JS / image resource in Facelets template?
  5. Why do I need to nest a component with rendered=”#{some}” in another component when I want to ajax-update it?
  6. Obtaining Facelets templates/files from an external filesystem or database
  7. Packaging Facelets files (templates, includes, composites) in a JAR
  8. How can I set id of a component/tag inside ui:repeat
  9. How to create a custom Facelets tag?
  10. Avoiding duplicate ids when reusing facelets compositions in the same naming container
  11. How to implement a dynamic list with a JSF 2.0 Composite Component?
  12. Error Parsing /page.xhtml: Error Traced[line: 42] The entity “nbsp” was referenced, but not declared
  13. Why is the getter called so many times by the rendered attribute?
  14. Does it matter whether place f:event inside f:metadata or not?
  15. How to provide a file download from a JSF backing bean?
  16. When should I use h:outputLink instead of h:commandLink?
  17. How to dynamically add JSF components
  18. Upgrade JSF / Mojarra in JBoss AS / EAP / WildFly
  19. JSF 2.0 File upload
  20. How to call a method with a parameter in JSF
  21. Specify conditional rendering of element inside ? The does not seem to work
  22. How validate two password fields by ajax?
  23. How control access and rights in JSF?
  24. JSF + PrimeFaces: `update` attribute does not update component
  25. Is it possible to disable f:event type=”preRenderView” listener on postback?
  26. Bookmarkability via View Parameters feature
  27. Are @ManagedBeans obsolete in JavaEE6 because of @Named in CDI/Weld?
  28. action is only invoked on second click
  29. Why doesn’t JSF 2.0 RI (Mojarra) scan my class’ annotations?
  30. JSF/Facelets: why is it not a good idea to mix JSF/Facelets with HTML tags?

Leave a Comment