2 Replies Latest reply on Sep 5, 2013 3:19 PM by ctomc

    Disabling JSP: jsp-configuration disable="true" broken?


      I'd like to disable JSP in my JBoss 7.1.1 final application server.  I have read the documentation for the jsp-configuration element and tried using the following XML snippet in my "standalone.xml":


               <subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
                       <jsp-configuration disabled="true"/>
                   <connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
                   <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">


      Then, using jboss-cli.sh, I can examine the web resource properties:

      [disconnected /] connect
         "outcome" => "success",
         "result" => {
         "default-virtual-server" => "default-host",
         "instance-id" => undefined,
         "native" => "false",
         "configuration" => {
         "container" => {
         "mime-mapping" => undefined,
         "welcome-file" => undefined
         "jsp-configuration" => {
         "check-interval" => 0,
         "development" => false,
         "disabled" => "true",
         "display-source-fragment" => true,


      With this configuration set, test JSP files are still getting compiled and run.  I would expect to instead see the source code of the JSP file in my web browser (served as a static resource), if JSP features have been disabled properly.


      Notice that the "disabled" attribute in the CLI output has a string value of "true" -- surrounded by quotes.  It's not a boolean as in other jsp-configuration properties.

      Is this a bug?   How can I set this to a boolean true value?  Even if I did that, would that even disable whatever servlet is mapped to *.jsp?