Put the jsp under WEB-INF. Then it will not be accessible by filename in the url. You obviously will have to change your web.xml accordingly:
<servlet>
<servlet-name>myapp</servlet-name>
<jsp-file>/WEB-INF/dfg.jsp</jsp-file>
</servlet>
<servlet-mapping>
<servlet-name>myapp</servlet-name>
<url-pattern>/myapp</url-pattern>
</servlet-mapping>