I have been asked several times in the past whether files under WEB-INF can be accessed or not.
It is indeed somewhat confusing. The answer is YES and NO.
You cannot access them directly.
For instance the following URL would give a 404 error :
But you can access test.jsp indirectly.
For instance the following JSP, callTest.jsp, contains code that includes a call to the somewhat protected JSP test.jsp :
<%@ include file="WEB-INF/test.jsp" %>
The URL to call the JSP is :