Web-inf under the page can not be directly rhetorical questions, must be through the servlet page jump, security high.
Web-root page can be accessed directly through the address bar, the security is low.
Which pages are placed under Web-root, and which are under Web-inf? For example: Ordinary users and administrators two identities we generally put the public pages under Web-root, such as the home page, ordinary users and administrators can access. However, because an administrator is an identity that has permissions (such as modifying data content, increasing deletion data, and so on), the normal user does not have permissions. So the only administrator to operate the page into the Web-inf, so that ordinary users can not directly access this page to operate, to ensure the security of the page.
About the usefulness of web-root and Web-inf
