You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@struts.apache.org by "lukaszlenart (via GitHub)" <gi...@apache.org> on 2026/07/29 06:55:51 UTC
[PR] docs: secure-usage guidance on trust state in the Chaining Interceptor [struts-site]
lukaszlenart opened a new pull request, #318:
URL: https://github.com/apache/struts-site/pull/318
Adds a short **Security Considerations** section to the Chaining Interceptor page covering the design-level guidance around action chaining that is currently not written down anywhere on the site.
Because chaining populates the target action implicitly from the value stack, the guidance is:
- keep authorization, trust, identity and approval state out of the chain — re-derive it from the session or security context in the target action;
- prefer avoiding chaining where practical, since it couples actions and hides the target's data path;
- if chaining is required, narrow what is copied via `org.apache.struts2.Unchainable` or the interceptor's `includes` / `excludes` parameters;
- do not expose a public setter on the target for state that must not be settable from outside that action.
It also cross-links the existing "Where authorization applies" overview on the `@StrutsParameter` page.
Docs-only. This is ordinary design guidance and deliberately does not restate the `struts.chaining.requireAnnotations` mechanism already documented in #303, nor does it change any default or behaviour claim. Framework names (`Unchainable`, `includes`/`excludes`) were checked against `apache/struts` main.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs: secure-usage guidance on trust state in the Chaining Interceptor [struts-site]
Posted by "lukaszlenart (via GitHub)" <gi...@apache.org>.
lukaszlenart merged PR #318:
URL: https://github.com/apache/struts-site/pull/318
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] docs: secure-usage guidance on trust state in the Chaining Interceptor [struts-site]
Posted by "asf-ci (via GitHub)" <gi...@apache.org>.
asf-ci commented on PR #318:
URL: https://github.com/apache/struts-site/pull/318#issuecomment-5114296231
Staged site is ready at https://struts.staged.apache.org/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@struts.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org