[jetty-dev] Forbidden URLs are too restrictive in Jetty

["Arend v. Reinersdorff" <arend@xxxxxxxxxxx>]

Hi,

Background:

Most Servlet containers forbid mapping Servlets or Filters to META-INF and WEB-INF paths:

<applicationContext>/META-INF

<applicationContext>/META-INF/*

<applicationContext>/WEB-INF
<applicationContext>/WEB-INF/*

(all URLs case insensitive)

Problem:

Jetty is more restrictive and forbids any URL starting with META-INF or WEB-INF:

<applicationContext>/META-INF*

<applicationContext>/WEB-INF*

Example URLs that Tomcat allows but Jetty forbids:

<applicationContext>/META-INFX/index.html

<applicationContext>/META-INF.HTML

I see no reason why Jetty is more restrictive than Tomcat in this case.

Regards,

Arend