直接アクセスを防ぐ

WEB-INFの外に置いてあるファイルへの直接アクセスを防ぐ方法。

[web.xml]

<security-constraint>
  <display-name>AccessControl</display-name>
  <web-resource-collection>
    <web-resource-name>XHTML</web-resource-name>
    <url-pattern>*.xhtml</url-pattern>
    <http-method>DELETE</http-method>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    <http-method>PUT</http-method>
  </web-resource-collection>
  <auth-constraint>
  </auth-constraint>
</security-constraint>