title: Jetty 9.4.38 exposes monitoredPath (contexts) as own context
body: <p>i checked all configuration files and searched the jetty docs as well as github issues for this topic, but couldn't find any related information.</p>
  <p>When running jetty 9.4.38 as standalone, it exposes the folder set as monitoredDir in etc/jetty-deploy.xml as an own context.</p>
  <pre><code>          &lt;Arg&gt;
              &lt;New class=&quot;org.eclipse.jetty.deploy.providers.WebAppProvider&quot;&gt;
                &lt;Set name=&quot;monitoredDirName&quot;&gt;
                  &lt;Property&gt;
                    &lt;Name&gt;jetty.deploy.monitoredPath&lt;/Name&gt;
                    &lt;Default&gt;
                      &lt;Property name=&quot;jetty.base&quot; default=&quot;.&quot; /&gt;/&lt;Property name=&quot;jetty.deploy.monitoredDir&quot; deprecated=&quot;jetty.deploy.monitoredDirName&quot; default=&quot;contexts&quot;/&gt;  
                    &lt;/Default&gt;
                  &lt;/Property&gt;
                &lt;/Set&gt; 
  </code></pre>
  <p>from outside im able to access this context and then browse the files in the folder (context xmls...)</p>
  <p><img src="https://i.stack.imgur.com/h9AGL.png" alt="image: jetty exposing monitoredDir as context" /></p>
  <p>i can prohibit the file browsing by setting</p>
  <pre><code>&lt;init-param&gt;
        &lt;param-name&gt;dirAllowed&lt;/param-name&gt;
        &lt;param-value&gt;false&lt;/param-value&gt;
  &lt;/init-param&gt;
  </code></pre>
  <p>in etc/webdefaults.xml</p>
  <p>but still I can access a file contained in the folder, if I know the path.</p>
  <p>I would appreciate any hints on how to disable this context, so that it cannot be accessed from outside.</p>