I'd like to disable JSP in my JBoss 7.1.1 final application server. I have read the documentation for the jsp-configuration element and tried using the following XML snippet in my "standalone.xml":
<subsystem xmlns="urn:jboss:domain:web:1.1" default-virtual-server="default-host" native="false">
<configuration>
<jsp-configuration disabled="true"/>
</configuration>
<connector name="http" protocol="HTTP/1.1" scheme="http" socket-binding="http"/>
<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">
...
Then, using jboss-cli.sh, I can examine the web resource properties:
[disconnected /] connect
/subsystem=web:read-resource(recursive=true):read-resource
{
"outcome" => "success",
"result" => {
"default-virtual-server" => "default-host",
"instance-id" => undefined,
"native" => "false",
"configuration" => {
"container" => {
"mime-mapping" => undefined,
"welcome-file" => undefined
},
...
"jsp-configuration" => {
"check-interval" => 0,
"development" => false,
"disabled" => "true",
"display-source-fragment" => true,
...
With this configuration set, test JSP files are still getting compiled and run. I would expect to instead see the source code of the JSP file in my web browser (served as a static resource), if JSP features have been disabled properly.
Notice that the "disabled" attribute in the CLI output has a string value of "true" -- surrounded by quotes. It's not a boolean as in other jsp-configuration properties.
Is this a bug? How can I set this to a boolean true value? Even if I did that, would that even disable whatever servlet is mapped to *.jsp?