Whatever JSP engine you are using will have documentation on this. But in a nutshell...
Place the JSPs anywhere under the app root that you want. To hide the JSPs from direct access (which I almost always do), place them in a folder hierarchy unde WEB-INF. For direct access, place them anywhere outside of WEB-INF.
Class files go in the folder hierarchy under WEB-INF/classes. Be sure that all classes are in a package other than the default.
