Should we allow JSPs to change on a running application server on a production system?
My gut feeling is no. However, I can't seem to find any information to justify it.
From a performance end, having to detect and recompile the JSPs will cause slow down for the user. You also lose the capability of precompiling the JSPs to prevent the first user hit.
From a security end, it feels like allowing someone who has access to a content management system to run a CGI file.
