struts2 - Role based authorizations to actions in Java/Struts -
i have application based on java/struts/hibernate. has 2 types of users. admin , normal user. created separate struts pages both roles , actions.
but when type admin action in url after logged normal user, admin pages accessible normal user. how can fix this?
i have entered action class of admin , user in separate in xml pages , included in struts.xml
page. if you're using application works fine.but consider action in struts-admin, e.g.: adminhome
, localhost:8080/app/adminhome
. if normal user logged in, url localhost:8080/app/normalhome
. if normal user types changes normalhome
adminhome
, can access admin pages.
update:
as said earlier, have admin , user actions in different packages in struts.xml
. can package name in java? compare user_role
, direct admin /normal
pages..
see code
in login action class write after user has entered correct details
session.setattribute("user_id","userid");//store user id in session scope session.setattribute("user_designation","userdesignation");//store designation in session scope
later return role (user designation) either admin
or user
in login action class.
return "userdesignation";//admin or user
in struts.xml write forwards conf login action
<action input="/index.jsp" name="login_check" path="/login" scope="request" type="com.mycompany.login_action" validate="true"> <forward name="admin" path="adminhome.jsp"/>//if action returns `admin` <forward name="user" path="userhome.jsp""/>//if action returns `user` </action>
in respective jsps check designation like
if (session.getattribute("user_designation").equals("admin"))//for admin jsps (ex: adminhome.jsp) { ..............//jsp content } else response.sendredirect("some page"); if (session.getattribute("userd_esignation").equals("user"))//for user jsps(ex: userhome.jsp) { ..............//jsp content } else response.sendredirect("some page");
if true display respective jsp. otherwise plz! redirect him/her login or index , display message.
Comments
Post a Comment