GitLab

Created by: zspitzer

it would be really good to add moving the WEB-INF folder outside the webroot by default, to provide a much better locked down experience out of the box.

It's only a simple change to the \tomcat\conf.web.xml file

<init-param>
      <param-name>lucee-web-directory</param-name>
      <param-value>c:/Lucee/web-contexts/{web-context-label}</param-value>
      <description>Lucee Web Directory (for Website-specific configurations, settings, and libraries)>/description>
</init-param>

https://docs.lucee.org/guides/installing-lucee/windows/installing-the-boncode-connector-and-mod_cfml.html#optional-relocating-web-inf-files-outside-the-web-root

the only minor problem is that by default the context directory names are just a hash, as opposed to something human readable like the context names which mod_cfml generates

https://luceeserver.atlassian.net/browse/LDEV-150