Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.apache.struts2.interceptor
Class RolesInterceptor

    java.lang.Object
      com.opensymphony.xwork2.interceptor.AbstractInterceptor
          org.apache.struts2.interceptor.RolesInterceptor

All Implemented Interfaces:
  Interceptor, Serializable

    public class RolesInterceptor

extends AbstractInterceptor

This interceptor ensures that the action will only be executed if the user has the correct role.

Interceptor parameters:

- allowedRoles - a comma-separated list of roles to allow
- disallowedRoles - a comma-separated list of roles to disallow

When both allowedRoles and disallowedRoles are configured, then disallowedRoles takes precedence, applying the following logic: (if ((inRole(role1) || inRole(role2) || ... inRole(roleN)) && !inRole(roleA) && !inRole(roleB) && ... !inRole(roleZ)) { //permit ...

There are three extensions to the existing interceptor:

- isAllowed(HttpServletRequest,Object) - whether or not to allow the passed action execution with this request
- handleRejection(ActionInvocation) - handles an unauthorized request.
- areRolesValid(List roles) - allows subclasses to lookup roles to ensure they are valid. If not valid, RolesInterceptor will log the error and cease to function. This helps prevent security misconfiguration flaws.

      <!-- START SNIPPET: example -->
      <!-- only allows the admin and member roles -->
      <action name="someAction" class="com.examples.SomeAction">
          <interceptor-ref name="completeStack"/>
          <interceptor-ref name="roles">
            <param name="allowedRoles">admin,member</param>
          </interceptor-ref>
          <result name="success">good_result.ftl</result>
      </action>
      <!-- END SNIPPET: example -->

See Also:
  Serialized Form

Field Summary
`protected List<String>` | `allowedRoles`
`protected List<String>` | `disallowedRoles`

Constructor Summary
`RolesInterceptor()`

Method Summary
`protected boolean` | `areRolesValid(List<String> roles)` Extension point for sub-classes to test if configured roles are known valid roles.
`protected String` | `handleRejection(ActionInvocation invocation, javax.servlet.http.HttpServletResponse response)` Handles a rejection by sending a 403 HTTP error
`String` | `intercept(ActionInvocation invocation)`
`protected boolean` | `isAllowed(javax.servlet.http.HttpServletRequest request, Object action)` Determines if the request should be allowed for the action
`void` | `setAllowedRoles(String roles)`
`void` | `setDisallowedRoles(String roles)`
`protected List<String>` | `stringToList(String val)` Splits a string into a List

Methods inherited from class com.opensymphony.xwork2.interceptor.AbstractInterceptor
`destroy, init`

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Field Detail

### allowedRoles

    protected List<String> allowedRoles

### disallowedRoles

    protected List<String> disallowedRoles

Constructor Detail

### RolesInterceptor

    public RolesInterceptor()

Method Detail

### setAllowedRoles

    public void setAllowedRoles(String roles)

### setDisallowedRoles

    public void setDisallowedRoles(String roles)

### intercept

    public String intercept(ActionInvocation invocation)
                     throws Exception

  Specified by:
    `intercept` in interface `Interceptor`
  Specified by:
    `intercept` in class `AbstractInterceptor`
  Throws:
    `Exception`

### stringToList

    protected List<String> stringToList(String val)

  Splits a string into a List

### isAllowed

    protected boolean isAllowed(javax.servlet.http.HttpServletRequest request,
                                Object action)

  Determines if the request should be allowed for the action

  Parameters:
    `request` - The request
    `action` - The action object
  Returns:
    True if allowed, false otherwise

### handleRejection

    protected String handleRejection(ActionInvocation invocation,
                                     javax.servlet.http.HttpServletResponse response)
                              throws Exception

  Handles a rejection by sending a 403 HTTP error

  Parameters:
    `invocation` - The invocation
  Returns:
    The result code
  Throws:
    `Exception`

### areRolesValid

    protected boolean areRolesValid(List<String> roles)

  Extension point for sub-classes to test if configured roles are known valid roles. Implementations are encouraged to implement this method to prevent misconfigured roles. If this method returns false, the RolesInterceptor will be disabled and block all requests.

  Parameters:
    `roles` - allowed and disallowed roles
  Returns:
    whether the roles are valid or not (always true for the default implementation)

Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

Copyright © 2000–2018 Apache Software Foundation. All rights reserved.