CODEWITHSUNDEEP
javahttpstruts
Jonathan
Jonathan

Reputation: 191

Restrict HTTP requests to 'POST' only in Struts 1.x

Is there a configurable way in Struts 1.x so my action classses are only executed on HTTP 'POST' only.

I understand I can use request.getMethod() within my action class and then do certain 'stuff' based on that.

Regards, Jonathan

Upvotes: 6

Views: 11291

Answers (4)

Breton F.
Breton F.

Reputation: 312

McDowell answer is far from acceptable unless you do have some specific requirements. You should get a 503 HTTP error that you can catch to show meaningfull info to users or just leave it to actual errors management from your current web config.

Upvotes: 0

McDowell
McDowell

Reputation: 108899

You can use your web.xml to define access permissions. This constraint prevents GET requests:

  <security-constraint>
    <web-resource-collection>
      <web-resource-name>struts action servlet</web-resource-name>
      <url-pattern>*.do</url-pattern>
      <http-method>GET</http-method>
    </web-resource-collection>
    <auth-constraint>
      <!-- no one! -->
    </auth-constraint>
  </security-constraint>

Upvotes: 5

skaffman
skaffman

Reputation: 403491

One way of doing this without changing your application is to write a servlet Filter which rejects non-POST requests. You can then plug this filter into your web.xml file and configure its url-patterns to match your Struts controllers' paths.

Upvotes: 2

Kevin Hakanson
Kevin Hakanson

Reputation: 42200

Here's and idea that is both some programmatic and config solution. You can create a custom ActionMapping...

public class YourPOSTRequiredActionMapping extends ActionMapping { }

... and use in your struts config for the mappings that are POST only.

<action path="/your/path" type="YourAction" className="YourPOSTRequiredActionMapping" />

Then, you could extend the struts RequestProcessor and override processMapping

public class YourRequestProcessor extends RequestProcessor {
    protected ActionMapping processMapping(HttpServletRequest request, HttpServletResponse response, String path) throws IOException {
        ActionMapping mapping = super.processMapping(request, response, path);
        if (mapping instanceof YourPOSTRequiredActionMapping) {
            if (!request.getMethod().equals("POST")) {
                mapping = null;
            }
        }
        return mapping;
    }
}

Make sure to configure your struts config to use YourRequestProcessor.

<controller processorClass="YourRequestProcessor" nocache="true" contentType="text/html; charset=UTF-8" locale="false" />

I based this on some old working code, but I haven't even compiled the sample code above.

Upvotes: 3

Related Questions