You need to disable directory browsing in your web container.
Keep in mind that an entry in pages.xml ONLY protects resources that go through Faces
Servlet. It will not protect resources on the server (directory listings/static files)
that aren't served through it.
View the original post :
http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4055070#...
Reply to the post :
http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...