在web-app下添加如下，可限制不能访问JSP，只有action可以访问

<!-- Restricts access to pure JSP files - access available only via Struts action -->

<!--

<security-constraint>

<display-name>No direct JSP access</display-name>

<web-resource-collection>

<web-resource-name>No-JSP</web-resource-name>

<url-pattern>*.jsp</url-pattern>

</web-resource-collection>

<auth-constraint>

<role-name>no-users</role-name>

</auth-constraint>

</security-constraint>


<security-role>

<description>Don't assign users to this role</description>

<role-name>no-users</role-name>

</security-role>

-->