Question

A request to an Action can be validated using the Interceptors. Also, Direct request to a JSP page can be avoided using an empty action declaration. It is something like this;

<action name="home" >
        <result>home.jsp</result>
</action>  

I want to validate this calling to the JSP page. As I feel that a simple approach can be adding an Action (ActionSupport) with an Interceptor which checks the action name( and do some validation using session etc). But I’ve a doubt that whether it reduces the performance,because that action class doesn’t do anything and just execute its execute() only(useless task…), and where there should be an empty Action .(BUT: as I ve read some docs on Struts2, it is said that even though we don’t add an Action calss,the framework itself adds and action class which returns “success” therefore,adding an action class or not ourselves, doesn’t affect newly )

Any way, I d like to know what your best approaches are to validate or authorized access to some JSP pages.( number of pages can be many.. not only to one jsp page)

Added:
Example:
Lets say that, there are some restricted pages where all users can’t have access,for example user’s account page can be visited only to logged in users.There can be more such type of pages. If a request comes to a such page,the user has to be validated.Then, if the request comes through a empty/anonymous action (as explained in above code snip -only action name-no real class) how to validate such requests to JSP pages? Should an action class be used for this?

Answer 1

If your attention is to secure some part of your application so as only Authenticated as well authorize use can access that part, than you have two option

1. Use an interceptor based authentication
2. User a security API like Spring -security

Interceptor based authentication is quite easy. here is an example how to do this, but such authentication is not recommended for a production based and real life application since its really a very simple case.

if you are looking for a complete authentication system, i suggest you to look at Spring security.Its quite easy and configurable, all you need to tell the underlying spring mechanism which all areas and under secure tag and Spring security will intercept them before your action get called and only successful and authorize action will get called by spring security.