Alternate location for WEB-INF folder

Does anyone know if it is possible to specify a different location for the WEB-INF folder in a Windows (IIS) install of Lucee 5 (Tomcat 8)?

For example, have the web root be c:\inetpub\wwwroot\mysite but have the WEB-INF folder reside at c:\contexts\mysite\WEB-INF.

Lucee seems to automatically create the WEB-INF folder and place it in the web site’s root folder.

Yes it is possible, if you configure the root tomcat web.xml file and specify the init param lucee-web-directory you can specify the path.

See example:

Pete Freitag
Foundeo Inc.

1 Like

Thanks Pete. That almost gets me there. However, that changes the path for all contexts on that server. I was only looking the change the path for one context.

Hi Mike - Correct that setting would apply to all site/contexts - I’m not aware of a way to do it for just one context, not to say it isn’t possible.

my question is why does it matter? is it a grumpy sysadmin?

could always try a virtual directory called web-inf and map it to other path and see if that works… #nastyworkarounds

Still would like to know why?

why is it recommended?

because keep absolutely everything which doesn’t need to be under the webroot, out of the webroot reduces the potential attack surface

In fact, why is the lucee-web-directory param in /opt/lucee/tomcat/conf/web.xml commented out by default? Seems like the extra security of WEB-INF being outside each web root would be the best setup with each new installation.

I know this is a whish of other Lucee core devs too. The main problem is, that if you just uncomment that line, the Lucee installation willl not run and will throw 500 errors, because then the low privileged user running Tomcat won’t have permissions to create/write that web-inf folder. That means: The installer (also) would need creating that directory, give the user running Tomcat writing privileges to it. Another point is, that this directory entry needs to be created dynamically depending on the OS somewhere. I think, the best place would be Tomcats users home directory (or maybe somewhere else, depending on the OS administrators preference). You may need to create a new dialogue at the installer, prefilling the users home directory in that manner that the OS administrator would know or change that directory location. If you want to see the insallers code, it’s open source as a Lucee github repository.

1 Like

@Zackster has a great update here:

“With Lucee 6, we’re going to move the WEB-INF folder out of the web root.”

1 Like