A war file is just a jar file (like a zip archive) with a standard structure.
Basic structure:
WEB-INF/ - directory for application support lib/ - supporting jar files web.xml - configuration file for the application ...
'WEB-INF' is used to package:
Configuration
Supporting compiled java code.
Other non-public information.
The 'web.xml' file tells the J2EE container (Tomcat) what to do.
Everything outside of 'WEB-INF' is public content available via the web server (Tomcat).