I can't find the list of interceptors used in the defaultStack. My app works when I use the defaultStack but I don't want to have all the interceptors, only the ones I need (like I don't want the CSP interceptor contained in the defaultStack).
Where can I find this list?
My bad, we can find it in struts-default.xml:
<interceptor-stack name="defaultStack">
<interceptor-ref name="exception"/>
<interceptor-ref name="alias"/>
<interceptor-ref name="servletConfig"/>
<interceptor-ref name="i18n"/>
<interceptor-ref name="cspInterceptor">
<param name="enforcingMode">false</param>
</interceptor-ref>
<interceptor-ref name="prepare"/>
<interceptor-ref name="chain"/>
<interceptor-ref name="scopedModelDriven"/>
<interceptor-ref name="modelDriven"/>
<interceptor-ref name="fileUpload"/>
<interceptor-ref name="checkbox"/>
<interceptor-ref name="datetime"/>
<interceptor-ref name="multiselect"/>
<interceptor-ref name="staticParams"/>
<interceptor-ref name="actionMappingParams"/>
<interceptor-ref name="params"/>
<interceptor-ref name="conversionError"/>
<interceptor-ref name="coepInterceptor">
<param name="enforcingMode">false</param>
<param name="disabled">false</param>
<param name="exemptedPaths"/>
</interceptor-ref>
<interceptor-ref name="coopInterceptor">
<param name="exemptedPaths"/>
<param name="mode">same-origin</param>
</interceptor-ref>
<interceptor-ref name="fetchMetadata"/>
<interceptor-ref name="validation">
<param name="excludeMethods">input,back,cancel,browse</param>
</interceptor-ref>
<interceptor-ref name="workflow">
<param name="excludeMethods">input,back,cancel,browse</param>
</interceptor-ref>
<interceptor-ref name="debugging"/>
</interceptor-stack>
It is possible to map multiple actions url in a single action configuration with wildcard ? I can able to do like */* */*/* in action names. But I don't know exactly how many nested path will come.
Since all my urls load render CommonLayout. So, I don't want to add multiple entries.
What I am doing now
<package name="myapp" extends="default" namespace="/">
<global-results>
<result type="tiles">CommonLayout</result>
</global-results>
<action name="a" />
<action name="a/create" />
<action name="b" />
<action name="b/customize" />
<action name="b/customize/app" />
<action name="d/create" />
<action name="d/view" />
<action name="d/view/list" />
</package>
Below is the configuration which I want to have, But It is not working for all nested actions.
<package name="myapp" extends="default" namespace="/">
<global-results>
<result type="tiles">CommonLayout</result>
</global-results>
<action name="*" />
</package>
I have an action which I should protect it from CSRF attack. I have used Strut's tokenSession Interceptor to achieve this.
<action name="showBranchSelection" class="action.Request.BranchSelectionAction"
method="showBranchSelection">
<interceptor-ref name="tokenSession" />
<interceptor-ref name="basicStack" />
<result name="success">
/jsp/customer/request/branchSelection.jsp
</result>
</action>
and works great where this action has been called directly from jsp.
<s:form id="frmRequestShowBranchSelection" action="../../showBranchSelection" method="post" theme="simple" onsubmit="return false;">
<s:token name="tknRequestShowBranchSelection" />
<s:submit />
</s:form>
But I also have other actions (protected and not protected) which will be chained to this action in some situations.
<!-- not protected action chains to protected one -->
<action name="entranceCustomerLoginAction" class="action.Request.CustomerLoginAction"
method="entrance">
<result name="success">/jsp/login/success.jsp</result>
<result name="showBranchSelection" type="chain"> showBranchSelection
</result>
</action>
<!-- protected action chains to another protected one -->
<action name="continueReimTable" class="action.Request.ReimburseTableControllerAction"
method="continueReimTable">
<interceptor-ref name="tokenSession" />
<interceptor-ref name="basicStack" />
<result name="showBranchSelection" type="chain">
showBranchSelection
</result>
<result name="success" type="chain">
showBranchPage
</result>
</action>
What's the proper way to use token in such chains?! i.e. in both, when a not protected action chains to a protected action and when a protected action chains to another protected action.
I am a beginner to struts2. i am using struts2 token interceptor to prevent CSRF. the token interceptor in working for the login page, but it is not working for the second page. the second page is just a JSP with hyperlinks, and when i change the token value it says "Could not find token name in params" . this is my code
Jsp
<div style="margin: 0 auto; font-size: 16px;">
<s:token />
<a href="<s:url value="view" />" >Click Here to View and Search Data</a>
<br/><br/>
<a href="<s:url value="Upload.jsp" />" >Click here to Upload Data (CSV format)</a>
<br/><br/>
<a href="<s:url value="Register.jsp" />" >Click here to Upload Data (FORM)</a>
</div>
Struts.xml
<package name="default" extends="struts-default, json-default">
<!-- CREATING INTERCEPTOR -->
<interceptors>
<interceptor-stack name="myStack">
<interceptor-ref name="defaultStack" />
<interceptor-ref name="tokenSession" />
<interceptor-ref name="timer"/>
<interceptor-ref name="logger"/>
<interceptor-ref name="fileUpload" />
</interceptor-stack>
</interceptors>
<default-interceptor-ref name="myStack"/>
<global-results>
<result name="invalid.token">/error.jsp</result>
</global-results>
<action name="login" class="action.loginAction">
<result name="input">/Login.jsp</result>
<result name="success">/Main.jsp</result>
<result name="error">/error.jsp</result>
</action>
how do i implement token intercepto for this jsp.
please suggest
Try changing order of interceptors , keep defaultStack in last.
<interceptors>
<interceptor-stack name="myStack">
<interceptor-ref name="tokenSession" />
<interceptor-ref name="timer"/>
<interceptor-ref name="logger"/>
<interceptor-ref name="fileUpload" />
<interceptor-ref name="defaultStack" />
</interceptor-stack>
</interceptors>
Try using token instead of tokenSession.
<interceptor-ref name="token" />
Also post the struts mapping for second page submit.
After a large file is uploaded, I only get the warning message in my console but it didn't stop me, the message is as follow:
WARN FileUploadInterceptor:56 - The file is to large to be uploaded:
_7fa0eae6b3a9b769f938dd52c0fde541_imgThumb "170587_10150170888553504_2474786_o.jpg"
"upload__24f6477e_140de810828__8000_00000008.tmp" 415411
Here is my Struts.xml setting:
<constant name="struts.multipart.maxSize" value="20480000" />
...
<package name="Image" extends="json-default,struts-default,my-default">
...
<action name="saveImage" class="example.Test" method="saveImg">
<interceptor-ref name="defaultStack"></interceptor-ref>
<interceptor-ref name="exception"/>
<interceptor-ref name="fileUpload">
<param name="maximumSize">1</param>
<param name="allowedTypes">image/tiff,image/jpeg</param>
</interceptor-ref>
<interceptor-ref name="params" />
<interceptor-ref name="validation" />
<interceptor-ref name="json">
<param name="contentType">application/json</param>
</interceptor-ref>
<result name="success" type="json">
<param name="root">save</param>
</result>
<result name="error" type="json">
<param name="root">save</param>
</result>
<result name="invalid.token">/WEB-INF/jsp/invalidToken.jsp</result>
</action>
Any help would be appreciated!
You are including the File Upload Interceptor twice, because it is already present in the Default Stack.
The Default Stack is defined as:
<!-- A complete stack with all the common interceptors in place.
Generally, this stack should be the one you use, though it
may do more than you need. Also, the ordering can be
switched around (ex: if you wish to have your servlet-related
objects applied before prepare() is called, you'd need to move
servletConfig interceptor up.
This stack also excludes from the normal validation and workflow
the method names input, back, and cancel. These typically are
associated with requests that should not be validated.
-->
<interceptor-stack name="defaultStack">
<interceptor-ref name="exception"/>
<interceptor-ref name="alias"/>
<interceptor-ref name="servletConfig"/>
<interceptor-ref name="i18n"/>
<interceptor-ref name="prepare"/>
<interceptor-ref name="chain"/>
<interceptor-ref name="scopedModelDriven"/>
<interceptor-ref name="modelDriven"/>
<interceptor-ref name="fileUpload"/>
<interceptor-ref name="checkbox"/>
<interceptor-ref name="multiselect"/>
<interceptor-ref name="staticParams"/>
<interceptor-ref name="actionMappingParams"/>
<interceptor-ref name="params">
<param name="excludeParams">dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,parameters\...*</param>
</interceptor-ref>
<interceptor-ref name="conversionError"/>
<interceptor-ref name="validation">
<param name="excludeMethods">input,back,cancel,browse</param>
</interceptor-ref>
<interceptor-ref name="workflow">
<param name="excludeMethods">input,back,cancel,browse</param>
</interceptor-ref>
<interceptor-ref name="debugging"/>
</interceptor-stack>
Then what you are actually defining for your Action is
<action name="saveImage" class="example.Test" method="saveImg">
<!-- DEFAULT STACK IMPORT EXPLODED -->
<interceptor-ref name="exception"/>
<interceptor-ref name="alias"/>
<interceptor-ref name="servletConfig"/>
<interceptor-ref name="i18n"/>
<interceptor-ref name="prepare"/>
<interceptor-ref name="chain"/>
<interceptor-ref name="scopedModelDriven"/>
<interceptor-ref name="modelDriven"/>
<interceptor-ref name="fileUpload"/>
<interceptor-ref name="checkbox"/>
<interceptor-ref name="multiselect"/>
<interceptor-ref name="staticParams"/>
<interceptor-ref name="actionMappingParams"/>
<interceptor-ref name="params">
<param name="excludeParams">dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,parameters\...*</param>
</interceptor-ref>
<interceptor-ref name="conversionError"/>
<interceptor-ref name="validation">
<param name="excludeMethods">input,back,cancel,browse</param>
</interceptor-ref>
<interceptor-ref name="workflow">
<param name="excludeMethods">input,back,cancel,browse</param>
</interceptor-ref>
<interceptor-ref name="debugging"/>
<!-- YOUR ADDITIONAL SETTINGS -->
<interceptor-ref name="exception"/>
<interceptor-ref name="fileUpload">
<param name="maximumSize">1</param>
<param name="allowedTypes">image/tiff,image/jpeg</param>
</interceptor-ref>
<interceptor-ref name="params" />
<interceptor-ref name="validation" />
<interceptor-ref name="json">
<param name="contentType">application/json</param>
</interceptor-ref>
<result name="success" type="json">
<param name="root">save</param>
</result>
<result name="error" type="json">
<param name="root">save</param>
</result>
<result name="invalid.token">/WEB-INF/jsp/invalidToken.jsp</result>
</action>
As you can see, many Interceptors are defined twice. Simply create an custom Interceptor Stack, and use it in all the Actions you need, or specify the Interceptors manually without including the Default Stack.
Something like
<interceptor-ref name="exception"/>
<interceptor-ref name="alias"/>
<interceptor-ref name="servletConfig"/>
<interceptor-ref name="i18n"/>
<interceptor-ref name="prepare"/>
<interceptor-ref name="chain"/>
<interceptor-ref name="scopedModelDriven"/>
<interceptor-ref name="modelDriven"/>
<interceptor-ref name="fileUpload">
<param name="maximumSize">1</param>
<param name="allowedTypes">image/tiff,image/jpeg</param>
</interceptor-ref>
<interceptor-ref name="checkbox"/>
<interceptor-ref name="multiselect"/>
<interceptor-ref name="staticParams"/>
<interceptor-ref name="actionMappingParams"/>
<interceptor-ref name="params">
<param name="excludeParams">dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,parameters\...*</param>
</interceptor-ref>
<interceptor-ref name="conversionError"/>
<interceptor-ref name="validation">
<param name="excludeMethods">input,back,cancel,browse</param>
</interceptor-ref>
<interceptor-ref name="workflow">
<param name="excludeMethods">input,back,cancel,browse</param>
</interceptor-ref>
<interceptor-ref name="debugging"/>
<interceptor-ref name="json">
<param name="contentType">application/json</param>
</interceptor-ref>