To turn off JSP access in your JBoss or other favorite application server add this to your web.xml.

  
    you_cant_touch_this
    *.jsp
  
  

To prevent Apache from sending JSP requests to JBoss add the following to your configuration.

## DISALLOW FROM REACHING JBOSS (security-related filter):
!/*.jsp=name_of_your_app
!/*.xml=name_of_your_app