title: Prevent direct access to composite components by placing them inside /WEB-INF
body: <p>I'm trying to define some composite components in my web application. According to the tutorials i read, i have to place the xhtml files inside a resource folder located in webcontent.
  This solution is problematic, given that it would make those files available for public access from an url.
  Is there a way to put this components inside the web-inf folder, and make the jsf look for the files there?
  If not, is there another way to avoid direct access?</p>
  
  <p>Thanks.</p>
  
  <p>P.S.: I have looked into <a href="https://stackoverflow.com/questions/7059420/where-to-put-composition-componentsjsf-2-0">this answer</a>, and if i understood BalusC's answer correctly, what I intend to do is possible.</p>