title: How to Restrict access to web-inf folder from accessing outside without using security-constraint
body: <p>My Web application structure is</p>
  <pre><code>&gt;     App1.war
  &gt;     -WEB-INF
  &gt;        - web.xml
  &gt;        - classes
  &gt;        - config etc.
  </code></pre>
  <p>and due to some other functionality implementation, we have added a filter</p>
  <pre><code>&lt;filter-mapping&gt;
      &lt;filter-name&gt;CustomerFilter&lt;/filter-name&gt;
      &lt;url-pattern&gt;/customer/pages/*&lt;/url-pattern&gt;
  &lt;/filter-mapping&gt;
  </code></pre>
  <p>And the filter class CustomerFilter.java</p>
  <pre><code>  public void doFilter(ServletRequest re, ServletResponse response, FilterChain chain)
              throws IOException, ServletException {
          String requestURI = ((HttpServletRequest)re).getRequestURI();
          if (requestURI.endsWith(&quot;.action&quot;)) {
              chain.doFilter(request, response);
          }
          else {
              request.getRequestDispatcher(
                      requestURI.replace(config.getServletContext().getContextPath() + &quot;/customer/pages&quot;, &quot;&quot;))
                      .forward(request, response);
          }
      }
  </code></pre>
  <p>due to this change, I can directly access the web.xml via URL
  yourserver/App1/customer/pages/WEB-INF/web.xml and it's a security vulnerability,
  so I added a security-constraint to solve this leakage.
  My question is do we have any other ways to handle this efficiently? or what is the other solutions for Directory traversal.
  ex:</p>
  <pre><code>&lt;security-constraint&gt;
    &lt;display-name&gt;SecurityConstraintForDirA&lt;/display-name&gt;
    &lt;web-resource-collection&gt;
      &lt;web-resource-name&gt;DirAResources&lt;/web-resource-name&gt;
      &lt;url-pattern&gt;customer/pages/WEB-INF/*&lt;/url-pattern&gt;
    &lt;/web-resource-collection&gt;
    &lt;auth-constraint&gt;
      &lt;role-name&gt;adm&lt;/role-name&gt;
    &lt;/auth-constraint&gt;  
  &lt;/security-constraint&gt;
  </code></pre>
  <p>Keep in mind my application is a struts-based old web application.</p>