I’m working on a simple CRUD app that will be hosted on our intranet, available to a few users. I’m using struts2 and Tomcat 5.5.
I’ve read a bunch of guides on how to implement security using Tomcat; using code; using LDAP integration; or a combination of them. As the app is simple, I’d like the auth to be of equivalent simplicity.
My current idea involves storing a “logged in” attribute in the session, and if that’s not present, redirecting users to an error message and the login page. I think, though, that I’d have to do this in every action method, to prevent someone from doing a form submit directly to an action.
What’s the easiest/most basic way to implement security on such an app?
One simple yet good solution is to make use of interceptor,create a login interceptors and configure it to all those actions where you think user needs to be logged -in
You need to check if the user attribute is in session and if not can return INPUT string as results and can show the login page.
for more details refer to this tutorial