title: Tomcat serving static content
body: <p>I have a Spring app and I'm wondering the best way to serve static content. I have tried the following:</p>
  
  <pre><code>&lt;servlet-mapping&gt;
      &lt;servlet-name&gt;default&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/static/*&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  &lt;servlet-mapping&gt;
      &lt;servlet-name&gt;app&lt;/servlet-name&gt;
      &lt;url-pattern&gt;/&lt;/url-pattern&gt;
  &lt;/servlet-mapping&gt;
  </code></pre>
  
  <p>This works, but the behaviour of the DefaultServlet means that any request of the form <code>/static/PATH</code> serves the file from <code>webapp/PATH</code>. This exposes a massive vulnerability, allowing sensitive information to be shown with URLs such as: <a href="http://localhost/app/static/META-INF/context.xml" rel="noreferrer">http://localhost/app/static/META-INF/context.xml</a></p>
  
  <p>What's the common solution for this? Should I move the sensitive files? Write my own DefaultServlet? Or is there a better way to serve static content?</p>