static content. difference in tomcat6 and tomcat7 behaviors

Question

I'm sorry if i'm asking something which have been asked 1000 times but i searched for it and didn't find anything:)

I have 2 tomcat installations. tomcat 6 on windows and tomcat 7 on linux machine. i have a project which uses spring and has some static content which i'd like to be able to serve without making the requests go through Spring.

here's my servlet configuration:

<servlet-mapping>
  <servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
  <url-pattern>/</url-pattern>
</servlet-mapping>
<servlet-mapping>
 <servlet-name>default</servlet-name>
 <url-pattern>/static/*</url-pattern>
</servlet-mapping>

my static files are located in "static" folder next to WEB-INF folder.

Now the funny thing is that on tomcat7 when i do a request to http://myserver.com/myproject/static/css/main.css it looks for the file in /webapps/myproject/static/css/main.css but on tomcat6 it looks for it in /webapps/myproject/css/main.css and produces an error saying that there's no such file.

what configuration should i tweak for both servers to work the same way?

Answer 1

You're actually abusing Tomcat's default servlet. The default servlet is not definied by the servlet API and specific to the servlet container. Tomcat's default servlet is known to have a bug to be able to expose all the contents of /WEB-INF and /META-INF when abused this way, hereby putting doors open to sensitive information. This is been reported as issue 50026 and is been fixed in Tomcat 6.0.30 and onwards.

The solution is simple: you should not explicitly be mapping the default servlet in your web.xml at all. As stated in the bug report, you have to use this approach instead.

Answer 2

Another, simpler answer provided by casey to the same question that BalusC links to is to specify a welcome file list and map the last welcome file to your application servlet's URL pattern. In this configuration, the default servlet handles static content while any unmatched URLs fall through to the application.

The full answer, with code, from casey