java - How to use the URL http://localhost:8080/appcontext/META-INF/index.html? -

i have example application running locally http://localhost:8080/appcontext (the context /appcontext).

now when http://localhost:8080/appcontext/meta-inf/index.html accessed in browser want display text hello, world!.

code servlet mappings

this how tried map servlet /meta-inf url. didn't work:

<?xml version="1.0" encoding="utf-8"?> <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/xmlschema-instance"     xsi:schemalocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5" >     <servlet>         <servlet-name>myservlet</servlet-name>         <servlet-class>com.example.mapmetainf.myservlet</servlet-class>     </servlet>      <!--     <servlet-mapping>         <servlet-name>myservlet</servlet-name>         <url-pattern>/meta-inf/index.html</url-pattern>     </servlet-mapping>     -->      <!--     <servlet-mapping>         <servlet-name>myservlet</servlet-name>         <url-pattern>/meta-inf/*</url-pattern>     </servlet-mapping>     -->      <servlet-mapping>         <servlet-name>myservlet</servlet-name>         <url-pattern>/*</url-pattern>     </servlet-mapping> </web-app> 

servlet specification

java servlet specification 3.1, chapter srv.9.6 web application archive file:

this directory must not directly served content container in response web client’s request, [...]. also, requests access resources in meta-inf directory must returned sc_not_found(404) response.

this forbids direct mapping of meta-inf directory of .war. don't think forbids mapping servlet /appcontext/meta-inf url.

i believe asking not possible @ application level. specification talks meta-inf folder, url implied well. using term "implied" here because let's think minute consequences of server allowing want.

if server allowed /appcontext/meta-inf url reach 1 of filters/servlets has no way of knowing if (the developer) handle case according specification or not. strictly speaking, not conform specification. worse, relies on web developer that. if case, every web application default behaviour desired (i.e. meta-inf not accessible), developer have implement servlet/filter server should doing in first place (!)

so believe ask can available @ server level , if server allows i.e. if server gives configuration option that, or allows write own interceptor class handle request in way different default behaviour.

in tomcat 7 example meta-inf access forbidden in standardcontextvalve class in invoke() method:

public final void invoke(request request, response response) throws ioexception, servletexception {      // disallow direct access resources under web-inf or meta-inf     messagebytes requestpathmb = request.getrequestpathmb();     if ((requestpathmb.startswithignorecase("/meta-inf/", 0))             || (requestpathmb.equalsignorecase("/meta-inf"))             || (requestpathmb.startswithignorecase("/web-inf/", 0))             || (requestpathmb.equalsignorecase("/web-inf"))) {             notfound(response);   // <-- issues response.senderror(httpservletresponse.sc_not_found);             return;     }     ... } 

so have create own valve implementation (i.e. allowmetainfaccessvalve copy of above class without "disallow" check), package in jar , put in <tomcat_home>/lib folder.

then in server.xml declare below. using approach urls attempt access meta-inf folder, reach servlet , own responsibility.

... <host appbase="webapps" autodeploy="true" name="localhost" unpackwars="true">     ...     <valve classname="com.mypackage.valves.allowmetainfaccessvalve" allow="true"/>     ... </host> ... 

---

update: clarify reasoning little more: true servlet many things other serving files meta-inf folder. that. or worse sufficient web developer forget forbid access, meta-inf folder become accessible.

the point here though not servlet or not do. point is: should people implemented server depend on web developer conform specification? guess wouldn't feel comfortable thought. specification set of rules. if want able "my server follows set of rules" cannot depend on third person do. put in shoes. do? depend on developer or make sure server follows rules?
believe people make same decision i.e. default forbid access , provide extension point of sort. if decision or bad one, time tell. after all, specifications evolve too. hope more clear now