Previous
Chapter 13
Securing Struts Applications
Security is one of the most critical issues in Web application development. As for servlet applications, there are two ways to secure application resources, by configuring the application and by writing Java code. The former is more popular because of its flexibility. By editing your deployment descriptor (web.xml file), you can change your security policy without rewriting code. For instance, you can restrict access to certain roles and HTTP methods, determine how users can authenticate themselves, and so forth. Since Struts is based on the Servlet technology, securing a Struts application will center on this configuration, plus the security feature in Struts itself.
To be good at security configuration, you need to be familiar with the concepts of principal and roles, therefore this chapter starts with a discussion of both. Afterwards, the chapter explains how to write a security policy and deals with authentication methods. After a section on how to hide resources and another on Struts-specific security features, this chapter concludes with the second way of security servlet applications: by writing Java code.