Is WEB-INF in the CLASSPATH?

Question

Is the WEB-INF folder in the CLASSPATH of a Java Web application?

This question seems to ask a similar thing: http://stackoverflow.com/questions/305285/servlet-containers-and-class-path — andri, Apr 27 '09 at 15:03

score 77 · Accepted Answer · edited Apr 27 '12 at 18:57

77

I'm assuming you're referring to the /WEB-INF directory in the root of the web application folder structure.

No, it's not in the classpath.

/WEB-INF/classes is on the classpath though, and so are the JAR files in /WEB-INF/lib.

edited Apr 27 '12 at 18:57

answered Apr 27 '09 at 15:03

Jack Leow

8

If /WEB-INF is not on the classpath, then why are the official 'deployment descriptor files' , such as web.xml , in that folder? Do they still get loaded somehow even if they are supposedly not on the classpath? – djangofan Dec 29 '15 at 00:21

score 12 · Answer 2 · answered Apr 27 '09 at 15:13

12

Additionally files in WEB-INF are protected against being requested by the web-container, i.e. they are invisible to the outside world.

answered Apr 27 '09 at 15:13

Unless you forward the request (although BEA had a broken implementation of this many years ago). – Tom Hawtin - tackline Apr 27 '09 at 15:37
1

You can almost always circumvent protection. – Thorbjørn Ravn Andersen Feb 09 '10 at 16:43

2 Answers2