在web-app下添加如下，可限制不能访问JSP，只有action可以访问  

<!-- Restricts access to pure JSP files - access available only via Struts action -->

  <!--

    <security-constraint>

        <display-name>No direct JSP access</display-name>

        <web-resource-collection>

            <web-resource-name>No-JSP</web-resource-name>

            <url-pattern>*.jsp</url-pattern>

        </web-resource-collection>

        <auth-constraint>

            <role-name>no-users</role-name>

        </auth-constraint>

    </security-constraint>

    <security-role>

        <description>Don‘t assign users to this role</description>

        <role-name>no-users</role-name>

    </security-role>

-->

struts不可直接方式jsp的web.xml配置