Page-Level Access Controls in Struts 2 - Part 1

Background

Applications should ensure users are properly authenticated and have sufficient permissions to access pages before content is displayed. Page-level access controls are one security control that enforces this behavior.

Part 1 and 2 of this article describes one of many ways to implement a Struts 2 AuthenticationInterceptor and a RolesInterceptor to verify users have authenticated successfully and belong to an approved role before allowing access to pages. The key features targeted by both interceptors include a default deny policy and a centralized location for defining access control rules.

Struts 2 AuthenticationInterceptor

In the struts.xml file below, the AuthenticationInterceptor is defined and included in the defaultSecurityStackWithAuthentication. The "excludeActions" parameter provided to the interceptor lists the actions that do not require users to be authenticated. In this case, the "Login" and "ProcessSimpleLogin" actions do not require authentication, however the "Internal" page does require authentication.

Struts.xml

(Click the image above to view the XML)

When the AuthenticationInterceptor is called, the interceptor verifies the requested action is in the exclude list or the user has the "authenticated" session variable set to "True."

AuthenticationInterceptor

(Click the image above to view the code)

Finally, to allow users access to authenticated pages, the ProcessSimpleLogin action verifies the submitted credentials and then sets the "authenticated" session variable to "True."

ProcessSimpleLogin

(Click the image above to view the code)

The code repository containing updated struts 2 modules can be found below:

http://code.google.com/p/struts2securityaddons/

Additionally, you can see discussion of these modules in my earlier blog posts:

• http://nickcoblentz.blogspot.com/2008/09/jsessionid-regeneration-in-struts-2.html
• http://nickcoblentz.blogspot.com/2008/10/http-caching-headers-in-struts-2.html
• http://nickcoblentz.blogspot.com/2008/10/ssltls-in-struts-2.html
• http://nickcoblentz.blogspot.com/2008/10/custom-error-pages-in-struts-2.html
• http://nickcoblentz.blogspot.com/2008/11/csrf-prevention-in-struts-2.html
• http://nickcoblentz.blogspot.com/2008/11/page-level-access-controls-in-struts-2.html
• http://nickcoblentz.blogspot.com/2008/12/page-level-access-controls-in-struts-2.html