You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by AJ Morris <aj...@homeboyz.com> on 2001/11/28 20:20:55 UTC
Security for Actions or ActionClasses?
Hello, I am new Struts and evaluating whether to use it for my next project.
I wonder how struts handles security. I understand I can still apply
container security by applying security constraints to my ActionClasses.
But, is there some way to apply security based on the Actions? Does Struts
have its own implementation of security, like Tomcat and its JDBC realms?
Sorry for the dummy question, but I'm a newbie.
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Security for Actions or ActionClasses?
Posted by Ted Husted <hu...@apache.org>.
It would be like a branch at this point. I'm going to try it myself
soon, and if I like it as much as Matt did, then it could make it's way
into the distribution ;-)
It does help when people like Matt mention that it worked well on their
own projects.
AJ Morris wrote:
>
> Yes! This exactly what I was thinking of -- Especially because it uses the
> underlying security API, which could be Tomcat, Websphere, whatever. I would
> love to try this out, but what is the development status? Is this
> incorporated into Struts, or a branch, or a final submission?
>
> In the docs, Mr. Hobbs asks what should be done when an illegal access is
> attempted. Why not just send an "unauthorized" header back to the browser?
> That is the inline with Tomcat. I believe Websphere goes a step further and
> allows you to specify a page for unauthorized access -- Is there a place in
> the struts-config for this?
>
> -----Original Message-----
> From: Ted Husted [mailto:husted@apache.org]
> Sent: Wednesday, November 28, 2001 1:30 PM
> To: Struts Users Mailing List
> Subject: Re: Security for Actions or ActionClasses?
>
> Struts can also use the Tomcat JDBC Realms.
>
> Nic Hobbs has put together a Role-based security package at
>
> http://husted.com/struts/resources/struts-security.htm
>
> I'm about to give it a whirl myself. Let me know if you like it.
>
> -- Ted Husted, Husted dot Com, Fairport NY USA.
> -- Custom Software ~ Technical Services.
> -- Tel +1 716 737-3463
> -- http://www.husted.com/struts/
>
> AJ Morris wrote:
> >
> > Hello, I am new Struts and evaluating whether to use it for my next
> project.
> > I wonder how struts handles security. I understand I can still apply
> > container security by applying security constraints to my ActionClasses.
> > But, is there some way to apply security based on the Actions? Does Struts
> > have its own implementation of security, like Tomcat and its JDBC realms?
> >
> > Sorry for the dummy question, but I'm a newbie.
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Security for Actions or ActionClasses?
Posted by Matt Raible <ma...@yahoo.com>.
I've used Nic's extensions on a project, and actually mofified his code to
return an SC_FORBIDDEN status code. To specify an error page for this code,
you simply need to add the following to your web.xml:
<error-page>
<error-code>403</error-code>
<location>/forbidden.html</location>
</error-page>
You can get the modified Struts 1.0 jar file at
http://www.icsynergy.com/downloads/struts/struts-security.zip.
It also contains a fix (now in the nightly builds) that allows the
<html:present roles="..."> tag to take a comma-delimited list of roles.
Hope this helps,
Matt
--- AJ Morris <aj...@homeboyz.com> wrote:
> Yes! This exactly what I was thinking of -- Especially because it uses the
> underlying security API, which could be Tomcat, Websphere, whatever. I would
> love to try this out, but what is the development status? Is this
> incorporated into Struts, or a branch, or a final submission?
>
> In the docs, Mr. Hobbs asks what should be done when an illegal access is
> attempted. Why not just send an "unauthorized" header back to the browser?
> That is the inline with Tomcat. I believe Websphere goes a step further and
> allows you to specify a page for unauthorized access -- Is there a place in
> the struts-config for this?
>
> -----Original Message-----
> From: Ted Husted [mailto:husted@apache.org]
> Sent: Wednesday, November 28, 2001 1:30 PM
> To: Struts Users Mailing List
> Subject: Re: Security for Actions or ActionClasses?
>
>
> Struts can also use the Tomcat JDBC Realms.
>
> Nic Hobbs has put together a Role-based security package at
>
> http://husted.com/struts/resources/struts-security.htm
>
> I'm about to give it a whirl myself. Let me know if you like it.
>
> -- Ted Husted, Husted dot Com, Fairport NY USA.
> -- Custom Software ~ Technical Services.
> -- Tel +1 716 737-3463
> -- http://www.husted.com/struts/
>
>
> AJ Morris wrote:
> >
> > Hello, I am new Struts and evaluating whether to use it for my next
> project.
> > I wonder how struts handles security. I understand I can still apply
> > container security by applying security constraints to my ActionClasses.
> > But, is there some way to apply security based on the Actions? Does Struts
> > have its own implementation of security, like Tomcat and its JDBC realms?
> >
> > Sorry for the dummy question, but I'm a newbie.
> >
> > --
> > To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> > For additional commands, e-mail:
> <ma...@jakarta.apache.org>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
>
>
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
>
__________________________________________________
Do You Yahoo!?
Yahoo! GeoCities - quick and easy web site hosting, just $8.95/month.
http://geocities.yahoo.com/ps/info1
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Security for Actions or ActionClasses?
Posted by AJ Morris <aj...@homeboyz.com>.
Yes! This exactly what I was thinking of -- Especially because it uses the
underlying security API, which could be Tomcat, Websphere, whatever. I would
love to try this out, but what is the development status? Is this
incorporated into Struts, or a branch, or a final submission?
In the docs, Mr. Hobbs asks what should be done when an illegal access is
attempted. Why not just send an "unauthorized" header back to the browser?
That is the inline with Tomcat. I believe Websphere goes a step further and
allows you to specify a page for unauthorized access -- Is there a place in
the struts-config for this?
-----Original Message-----
From: Ted Husted [mailto:husted@apache.org]
Sent: Wednesday, November 28, 2001 1:30 PM
To: Struts Users Mailing List
Subject: Re: Security for Actions or ActionClasses?
Struts can also use the Tomcat JDBC Realms.
Nic Hobbs has put together a Role-based security package at
http://husted.com/struts/resources/struts-security.htm
I'm about to give it a whirl myself. Let me know if you like it.
-- Ted Husted, Husted dot Com, Fairport NY USA.
-- Custom Software ~ Technical Services.
-- Tel +1 716 737-3463
-- http://www.husted.com/struts/
AJ Morris wrote:
>
> Hello, I am new Struts and evaluating whether to use it for my next
project.
> I wonder how struts handles security. I understand I can still apply
> container security by applying security constraints to my ActionClasses.
> But, is there some way to apply security based on the Actions? Does Struts
> have its own implementation of security, like Tomcat and its JDBC realms?
>
> Sorry for the dummy question, but I'm a newbie.
>
> --
> To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
> For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Security for Actions or ActionClasses?
Posted by Ted Husted <hu...@apache.org>.
Struts can also use the Tomcat JDBC Realms.
Nic Hobbs has put together a Role-based security package at
http://husted.com/struts/resources/struts-security.htm
I'm about to give it a whirl myself. Let me know if you like it.
-- Ted Husted, Husted dot Com, Fairport NY USA.
-- Custom Software ~ Technical Services.
-- Tel +1 716 737-3463
-- http://www.husted.com/struts/
AJ Morris wrote:
>
> Hello, I am new Struts and evaluating whether to use it for my next project.
> I wonder how struts handles security. I understand I can still apply
> container security by applying security constraints to my ActionClasses.
> But, is there some way to apply security based on the Actions? Does Struts
> have its own implementation of security, like Tomcat and its JDBC realms?
>
> Sorry for the dummy question, but I'm a newbie.
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>