How can direct access to a JSP page from a browser be…

You can use several approaches:

Storing JSPs in the WEB-INF directory: The contents of the WEB-INF directory are not directly accessible from the browser. This is a standard and most common method.
```
// Project structure
WEB-INF/
    web.xml
    jsp/
        myPage.jsp
    classes/
    lib/
```
Access to myPage.jsp in this case is done through a servlet or another controller that performs RequestDispatcher.forward().

Configuring access restrictions in web.xml: You can use the <security-constraint> element to restrict access to URL patterns corresponding to JSP pages.

<!-- web.xml -->
<security-constraint>
    <web-resource-collection>
        <web-resource-name>Protect JSP pages</web-resource-name>
        <url-pattern>*.jsp</url-pattern>
    </web-resource-collection>
    <auth-constraint/> <!-- Empty auth-constraint means no one has access -->
</security-constraint>

This method intercepts requests to any JSP files and prevents direct access.

Using servlets as controllers: Instead of direct access to JSPs, requests are directed to a servlet that handles the logic and then forwards to the corresponding JSP page located in WEB-INF.

// Example servlet
@WebServlet("/myController")
public class MyController extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // Request processing logic
        request.getRequestDispatcher("/WEB-INF/jsp/myPage.jsp").forward(request, response);
    }
}

The most effective and reliable method is a combination of storing JSPs in the WEB-INF directory and using servlets (or other controllers) to access them. This ensures separation of logic and presentation, as well as controlled access to pages.

How can direct access to a JSP page from a browser be prevented?