Support for JSP in Jar-Deployment

[djschilling]

I am using Spring-Boot with JSPs and a jar deployment with an embedded Tomcat. Everything works fine.

After reading the Spring-Boot Reference Documentation i am a bit confused: http://docs.spring.io/spring-boot/docs/current-SNAPSHOT/reference/htmlsingle/#boot-features-jsp-limitations

It says:

An executable jar will not work because of a hard coded file pattern in Tomcat.

So is this more a hint to not using JSPs or just a bug in the docs?

Here is the github page of the project with this setup: https://github.com/synyx/urlaubsverwaltung

[wilkinsona]

You are using the, IMO gross, hack that @ghillert blogged about. I'd much rather use an executable war and that's what the documentation encourages.

Do you have a specific requirement that means you have to use a jar?

[djschilling]

I do not have to use a jar deployment but i think there are some good reasons using it.

What are the problems/downsides of using this (gross) hack? I did not encounter any problems as for now.

[wilkinsona]

I dislike burying the JSPs in src/main/resources/META-INF/resources/WEB-INF/jsp/. It's cumbersome as it's so deeply nested and it makes them difficult to find as it's unconventional. I think it's far more elegant to use war packaging and keep the JSPs in their usual location.

[djschilling]

Okay, but there are no "real" known issues, other then inconvenient file paths, or things that can make problems in future Spring-Boot releases?

[wilkinsona]

Okay, but there are no "real" known issues, other then inconvenient file paths

META-INF/resources is intended for static content that'll be served as-is to the client. Therefore, there's a risk that the source for the JSPs in META-INF/resources/WEB-INF/jsp will be served to a client that manages to guess the path. You may be safe because the container should prevent access to content in a WEB-INF folder but that's typically located at the root of an archive rather than being nested in META-INF/resources. I'd recommend testing it.

or things that can make problems in future Spring-Boot releases?

Serving static content from META-INF/resources is part of the Servlet spec so that should continue to work. AFAICT, the trick of nesting WEB-INF/jsp beneath META-INF/resources isn't part of the specification. The fact that it works may be Tomcat specific and there's a chance it won't always work that way.

[djschilling]

Thanks for the answer. I will test that.

In my opinion the documentation for JSP's in jar Deployments should be changed. It should point out that this is not the recommended way, but that it is possible (because it is)

If wanted i can file a pull request for this.

[bclozel]

There are already a couple of notes about this: JSP limitations and a fair warning in the choice of template engine

[djschilling]

I know, thats the same page i linked in my first post. The only thing i would change is to replace the sentence: An executable jar will not work because of a hard coded file pattern in Tomcat.

[philwebb]

We could soften the wording a little but I think we should be clear in our documentation that we don't currently support JSPs in JARs. For one thing we have no tests for them so very little confidence that an upstream change won't break things.

[djschilling]

That sounds good.

[wilkinsona]

As described in this thread there's no guarantee that this will work. In fact, it's stopped working in 1.4.3 (I think due to a change in Tomcat). As a result, we'd risk misleading people if we soften the wording.