Joe Harry wrote:But the browser need not access it directly.
Yes, it must. There is no difference between an HTML page requesting a resource and requesting it via the address var, The request is identical. You cannot prevent one without the other.
Only the jsp page that the user requests will have access to those static files
Incorrect, The JSP doesn't do anything except execute on the server to generate an HTML page. It's the HTML that then causes the browser to request any resources referenced within it.
But at the same time, I do not want to put them under WEB-INF.
Whether you want to or not is irrelevant. If you put them under WEB-INF, they cannot be used. So it's a moot point.