title: Block direct access to *.jsp and *.action in Struts2
body: <p>I'm using Struts2+Spring+Hibernate in Tomcat.</p>
  
  <p>I'm having an issue with users being able to type in a .jsp or .action url directly.  Everything they need to access is accessible from the homepage so I want to block this access. </p>
  
  <p>I've been looking for an answer and I've found some stuff, particularly pertaining to .jsp blocking.  I've added </p>
  
  <pre><code>&lt;security-constraint&gt;
  &lt;web-resource-collection&gt;
  &lt;web-resource-name&gt;Deny Direct Access&lt;/web-resource-name&gt;
  &lt;description&gt;&lt;/description&gt;
  &lt;url-pattern&gt;*.jsp&lt;/url-pattern&gt;
  &lt;/web-resource-collection&gt;
  &lt;auth-constraint&gt;
  &lt;role-name&gt;Denied&lt;/role-name&gt;
  &lt;/auth-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;security-role&gt;
  &lt;role-name&gt;Denied&lt;/role-name&gt;
  &lt;/security-role&gt;
  </code></pre>
  
  <p>to my web.xml but that doesn't seem to do anything.  Then I changed</p>
  
  <pre><code>&lt;filter-mapping&gt;
      &lt;filter-name&gt;struts2&lt;/filter-name&gt;
      &lt;url-pattern&gt;*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt; 
  </code></pre>
  
  <p>to</p>
  
  <pre><code>&lt;filter-mapping&gt;
      &lt;filter-name&gt;struts2&lt;/filter-name&gt;
      &lt;url-pattern&gt;*.action&lt;/url-pattern&gt;
      &lt;url-pattern&gt;*.html&lt;/url-pattern&gt;
      &lt;url-pattern&gt;/index.jsp&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt; 
  </code></pre>
  
  <p>which blocks some .jsp files but not others.  I've made sure not to put </p>
  
  <pre><code>&lt;url-pattern&gt;*.jsp&lt;/url-pattern&gt;
  </code></pre>
  
  <p>in any of my security roles.</p>
  
  <p>I've heard I can put all my jsps in /Web-inf but this seems like a big hassle as I'll then have to change the paths in every instance of my application where I reference them.</p>
  
  <p>I also can't find anything involving blocking direct access to .action classes.  If there is someone I can be pointed to find this information, it would be much appreciated.  Thanks.</p>