Security in web.xml

nibr40, as kev already pointed out, it is not bullet proof but at least a container should never serve your web.xml to clients. A quote from the Java Servlet Specification (Version 2.3, Web Applications, SRV.9.5 Directory Structure):

'A special directory exists within the application hierarchy named WEB-INF. This directory contains all things related to the application that arent in the document root of the application. The WEB-INF node is not part of the public document tree of the application. No file contained in the WEB-INF directory may be served directly to a client by the container. However, the contents of the WEB-INF directory are visible to servlet code using the getResource and getResourceAsStream method calls on the ServletContext.'

Of course, a bug in your container implementation could make it possible. Well, nothing is really save today...

HTH, Markus

Howlingmad at 2007-7-5 >