Moves JSP files into WEB-INF/jsp to promote best practises

apps/blank/src/main/resources/example.xml

@@ -8,16 +8,16 @@
     <package name="example" namespace="/example" extends="default">
 
         <action name="HelloWorld" class="example.HelloWorld">
-            <result>/example/HelloWorld.jsp</result>
+            <result>/WEB-INF/jsp/example/HelloWorld.jsp</result>
         </action>
 
         <action name="Login_*" method="{1}" class="example.Login">
-            <result name="input">/example/Login.jsp</result>
+            <result name="input">/WEB-INF/jsp/example/Login.jsp</result>
             <result type="redirectAction">Menu</result>
         </action>
 
         <action name="*" class="example.ExampleSupport">
-            <result>/example/{1}.jsp</result>
+            <result>/WEB-INF/jsp/example/{1}.jsp</result>
         </action>
 
         <!-- Add actions here -->

apps/blank/src/main/resources/struts.xml

@@ -13,7 +13,7 @@
         <default-action-ref name="index" />
 
         <global-results>
-            <result name="error">/error.jsp</result>
+            <result name="error">/WEB-INF/jsp/error.jsp</result>
         </global-results>
 
         <global-exception-mappings>

apps/blank/src/main/webapp/WEB-INF/web.xml

@@ -1,5 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<web-app id="WebApp_9" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
+<web-app id="WebApp_9" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
 
     <display-name>Struts Blank</display-name>
 
@@ -17,4 +19,16 @@
         <welcome-file>index.html</welcome-file>
     </welcome-file-list>
 
+    <!-- Restricts access to pure JSP files - access available only via Struts action -->
+    <security-constraint>
+        <display-name>No direct JSP access</display-name>
+        <web-resource-collection>
+            <web-resource-name>No-JSP</web-resource-name>
+            <url-pattern>*.jsp</url-pattern>
+        </web-resource-collection>
+        <auth-constraint>
+            <role-name>no-users</role-name>
+        </auth-constraint>
+    </security-constraint>
+
 </web-app>