Protecting Web-Accessible Directory and Subcontents

[eluser]sophistry[/eluser]
it all depends how you wrap it up. if you put an entire 'web page' and its prerequisites ouside the webroot you'll run into the problems you outlined. if the paths to content are exposed in the HTML, they are exposed and there is nothing you can do about it short of re-writing the app.

and realistically speaking, you can't protect js anyhow without a lot of pain - it has to get downloaded to the browser to work.

what exactly is the sensitive part your boss wants to defend? images, videos, flash? whichever it is, just sequester that out of the webroot and write a little CI controller to serve the content, taking care to only allow the localhost (or whatever IP) to access it.