Must all the controllers, models and views be placed in the private folders? If so, what are the roles of the public folder? What are the correct terminologies for such roles in computer science? How does the GUI relate with such concepts?

Otherwise, does the controllers and/or views have to be distributed across the private and public folders? In that case, the scripts that are directly invoked via POST, are just interfaces, or controller interfaces, or view interfaces?

  • 3
    Folder arrangements aren't software design patterns. In general, folder arrangements are a matter of taste; you create them in a way that makes it easy for you to find things. Microsoft even says that here: You can keep your Web site's files in any folder structure that is convenient for your application. Oct 23 '15 at 17:22
  • Who enforces MVC compliance? I know of MVC as a pattern, not of something that could be scored to see if it fits with a textbook definition.
    – JB King
    Oct 23 '15 at 17:25
  • @RobertHarvey that makes things way more simple. I was thinking about folders and files as objects, just as functions and classes, I didn't even think a whole application can be in one file, and still be MVC, because I am used to PHP, where there is not even compilation in the programmer's routine. Your comment gave me the level of abstraction I needed, which is a relief, thanks.
    – mikl
    Oct 23 '15 at 17:40
  • @JBKing, edited
    – mikl
    Oct 23 '15 at 17:45

The role of the public folder is to have those views that would be publicly accessible in the application. For example, a Login page would generally be a page that anonymous users could access to then log into the site.

Some MVC web applications may not have any public pages as they may use some internal security system that checks before accessing any page such as a SharePoint site that may use Windows credentials to identify users as an example so it can exist but doesn't have to exist.

Within Computer Science this would fall under Information Security and looking at Authorization policies. Each application may use different methods for enforcing security so this could go in a bunch of different directions potentially.

GUI being the Graphical User Interface fits as part of the architecture here. Each view is a User Interface and thus a GUI may well interact with the View portion where the public and private folder concept would apply within security behind the scenes though some sites may use locks and other symbols to denote what pages require authentication and authorization to visit.

Controllers can be lumped into a folder though some may want them spread and depending on the technologies used there may be different ways to implement this. Views would likely be in folders that again depending on the technologies could have security handled in various ways.

POST requests to the server would likely go through a controller to a view in the MVC architecture since there would likely be data to process that is the role of the controller. The view is responsible for returning to the user the data of the page requested.

In response to the comment:

Controller security could be done on a file level or on a function level where the latter may make more sense in some cases as the same controller could have different functions. For example, consider the Yahoo! home page where if you aren't signed in, then the most popular stuff may be shown while if you are signed in then the personalized page would be shown that could be going through the same base controller potentially. Thus, file level permissions would be pointless here since all the controller code would likely be run under the same server account.

While there can exist some web applications that have no public views, this depends a great deal on how one wants to implement security which can be done in various ways using various technologies, not unlike how two people communicate can be done in various formats, languages and grammar. Keep in mind that by keeping this so generic, there are likely dozens of different answers depending on what implementation you choose to use, e.g. you could take ASP.Net Webforms and implement your own MVC or you could use ASP.Net MVC or you could look into PHP open source code bases that may implement the pattern, etc.


In many MVC frameworks (e.g. Rails), the public folder is used to serve static files. So for example, you often see 404.html, 500.html and favicon.ico files in there when creating the project through the "usual" means provided by such frameworks. These are "dumb" files that don't interact w/the backend. The assumption is that these don't require a context generated by your controllers to render them; for example the 404.html might just express that nothing exists at this URL, where the URL is something that isn't matched by the framework's routing system.

You may also see compiled assets placed there (e.g. a framework's asset pipeline combining multiple CSS files into one to reduce # of connections required to render a page).

Additionally, when deployed to a non-development webserver, the webroot is often set to the public directory.

Re: how a GUI relates to this concept... well it's a stretch to associate these things, but assuming you are using an IDE that has source control features (e.g. git integration) it might be automatically detected as containing directories to exclude from version control. For instance, you probably do not want your compiled assets showing up in your repository since they can be generated by the committed pipeline config combined w/the dev files.

Not the answer you're looking for? Browse other questions tagged or ask your own question.