You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Tim Christopher <ti...@gmail.com> on 2005/04/02 19:20:00 UTC
Struts Security
Hi,
At the moment almost all of my CRUD operations are performed (through
service calls) within LookupDispatchAction files; is this considered
good practice within Struts?
I've noticed that by using LookupDispatchAction files the user has the
ability to save a page offline, modify the nameof the submit button,
and then gain access to other CRUD operations that are contained
within the same Java file. Obviously this has serious security
implications.
Using the same principle it is also possible for a user to add an
additional field to a form, so if BeanUtils.copyProperties is called
(depending on how the db call is structured) the user may be able to
update restricted values.
Is it possible to safeguard the application from users exploting this
behaviour whilst still using a LookupDispatchAction? I know I could
put a isUserInRole at the start of every CRUD operation, however that
sounds very messy and would means that the role attribute on the
action is pointless.
Tim Christopher
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
RE: Struts Security
Posted by Folashade Adeyosoye <sh...@gmail.com>.
What I do is when the user logs in, I put a token in the session and for
every call to my action classes, there is abase class action that checks to
see if that token is in the session and if the user is logged in, if not
send them to the login screens
-----Original Message-----
From: Tim Christopher [mailto:tim.christopher@gmail.com]
Sent: Saturday, April 02, 2005 12:20 PM
To: Struts Users Mailing List
Subject: Struts Security
Hi,
At the moment almost all of my CRUD operations are performed (through
service calls) within LookupDispatchAction files; is this considered
good practice within Struts?
I've noticed that by using LookupDispatchAction files the user has the
ability to save a page offline, modify the nameof the submit button,
and then gain access to other CRUD operations that are contained
within the same Java file. Obviously this has serious security
implications.
Using the same principle it is also possible for a user to add an
additional field to a form, so if BeanUtils.copyProperties is called
(depending on how the db call is structured) the user may be able to
update restricted values.
Is it possible to safeguard the application from users exploting this
behaviour whilst still using a LookupDispatchAction? I know I could
put a isUserInRole at the start of every CRUD operation, however that
sounds very messy and would means that the role attribute on the
action is pointless.
Tim Christopher
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org