betweenGo

To turn off JSP access in your JBoss or other favorite application server add this to your web.xml.

<!-- Restrict direct access to jsps -->
<security-constraint>
  <web-resource-collection>
    <web-resource-name>you_cant_touch_this</web-resource-name>
    <url-pattern>*.jsp</url-pattern>
  </web-resource-collection>
  <auth-constraint/>
</security-constraint>

To prevent Apache from sending JSP requests to JBoss add the following to your configuration.

## DISALLOW FROM REACHING JBOSS (security-related filter):
!/*.jsp=name_of_your_app
!/*.xml=name_of_your_app

Related posts:

1. mod_rewrite to bypass security
2. Recurring Illegal Access Errors in JBoss when running ATG
3. Create Additional JBoss Application Server Configurations
4. Trim White Space from JSP
5. NameNotFoundExceptions during start up of ATG application on JBoss