Should we allow JSPs to change on a running application server on a production system?

My gut feeling is no. However, I can't seem to find any information to justify it.

From a performance end, having to detect and recompile the JSPs will cause slow down for the user. You also lose the capability of precompiling the JSPs to prevent the first user hit.

From a security end, it feels like allowing someone who has access to a content management system to run a CGI file.

  • How would they be changing and who would be changing them? Aug 29, 2013 at 16:58
  • Let's say it's through a CMS that "publishes" JSP files from non-development team such as content providers. Aug 29, 2013 at 19:30
  • I wouldn't recommend running code that you have not tested in a separate environment. If you do need to run third party code you would need to think of things like sandboxing, filtering, automated code review, etc.
    – Eric G
    Sep 8, 2013 at 6:25


You must log in to answer this question.

Browse other questions tagged .