I found an issue related to Forced Browsing in my web-application.And I was able to verify that my static content(like text document...mainly help documents) can be accessed by simply hitting the URL like,
User was able to do that without authentication. I have a simple dynamic web application in java. I know spring can achieve this task using tag but I doubt there is any way I can achieve the same using only the web.xml.
For information: the static content are located outside the WEB-INF folder.
Are there any suggestions of alternate ways I can safe guard my static content from being accessed by unauthorized users?