org.apache.struts2.interceptor.TokenSessionStoreInterceptor Maven / Gradle / Ivy
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.struts2.interceptor;
import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.Result;
import com.opensymphony.xwork2.util.ValueStack;
import org.apache.struts2.ServletActionContext;
import org.apache.struts2.dispatcher.HttpParameters;
import org.apache.struts2.util.InvocationSessionStore;
import org.apache.struts2.util.TokenHelper;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
/**
*
*
* This interceptor builds off of the {@link TokenInterceptor}, providing advanced logic for handling invalid tokens.
* Unlike the normal token interceptor, this interceptor will attempt to provide intelligent fail-over in the event of
* multiple requests using the same session. That is, it will block subsequent requests until the first request is
* complete, and then instead of returning the invalid.token code, it will attempt to display the same response
* that the original, valid action invocation would have displayed if no multiple requests were submitted in the first
* place.
*
*
*
* NOTE: As this method extends off MethodFilterInterceptor, it is capable of
* deciding if it is applicable only to selective methods in the action class. See
* MethodFilterInterceptor for more info.
*
*
*
*
* Interceptor parameters:
*
*
*
*
*
* - None
*
*
*
*
*
* Extending the interceptor:
*
*
*
* There are no known extension points for this interceptor.
*
*
*
* Example code:
*
*
*
*
* <action name="someAction" class="com.examples.SomeAction">
* <interceptor-ref name="tokenSession/>
* <interceptor-ref name="basicStack"/>
* <result name="success">good_result.ftl</result>
* </action>
*
* <-- In this case, myMethod of the action class will not
* get checked for invalidity of token -->
* <action name="someAction" class="com.examples.SomeAction">
* <interceptor-ref name="tokenSession>
* <param name="excludeMethods">myMethod</param>
* </interceptor-ref name="tokenSession>
* <interceptor-ref name="basicStack"/>
* <result name="success">good_result.ftl</result>
* </action>
*
*
*
*
*/
public class TokenSessionStoreInterceptor extends TokenInterceptor {
private static final long serialVersionUID = -9032347965469098195L;
@Override
protected String handleToken(ActionInvocation invocation) throws Exception {
//see WW-2902: we need to use the real HttpSession here, as opposed to the map
//that wraps the session, because a new wrap is created on every request
HttpSession session = ServletActionContext.getRequest().getSession(true);
synchronized (session.getId().intern()) {
if (!TokenHelper.validToken()) {
return handleInvalidToken(invocation);
}
return handleValidToken(invocation);
}
}
/**
* Handles processing of invalid tokens. If a previously stored invocation is
* available, the method will attempt to return and render its result. Otherwise
* it will return INVALID_TOKEN_CODE.
*
* Note: Because a stored (previously completed) invocation's PageContext will be closed,
* this method must replace the stored PageContext with the current invocation's one (or a null).
* See {@link org.apache.struts2.util.InvocationSessionStore#loadInvocation(String key, String token)} for details.
*
* @param invocation
*
* @return
* @throws Exception
*/
@Override
protected String handleInvalidToken(ActionInvocation invocation) throws Exception {
ActionContext ac = invocation.getInvocationContext();
HttpServletRequest request = (HttpServletRequest) ac.get(ServletActionContext.HTTP_REQUEST);
HttpServletResponse response = (HttpServletResponse) ac.get(ServletActionContext.HTTP_RESPONSE);
String tokenName = TokenHelper.getTokenName();
String token = TokenHelper.getToken(tokenName);
if ((tokenName != null) && (token != null)) {
HttpParameters params = ac.getParameters();
params.remove(tokenName);
params.remove(TokenHelper.TOKEN_NAME_FIELD);
String sessionTokenName = TokenHelper.buildTokenSessionAttributeName(tokenName);
ActionInvocation savedInvocation = InvocationSessionStore.loadInvocation(sessionTokenName, token);
if (savedInvocation != null) {
// set the savedInvocation's valuestack to the request scope
ValueStack stack = savedInvocation.getStack();
request.setAttribute(ServletActionContext.STRUTS_VALUESTACK_KEY, stack);
ActionContext savedContext = savedInvocation.getInvocationContext();
savedContext.getContextMap().put(ServletActionContext.HTTP_REQUEST, request);
savedContext.getContextMap().put(ServletActionContext.HTTP_RESPONSE, response);
Result result = savedInvocation.getResult();
if ((result != null) && (savedInvocation.getProxy().getExecuteResult())) {
result.execute(savedInvocation);
}
// turn off execution of this invocations result
invocation.getProxy().setExecuteResult(false);
return savedInvocation.getResultCode();
}
}
return INVALID_TOKEN_CODE;
}
/**
* Handles processing of valid tokens. Stores the current invocation for
* later use by {@link handleInvalidToken}.
* See {@link org.apache.struts2.util.InvocationSessionStore#storeInvocation(String key, String token, ActionInvocation invocation)} for details.
*
* @param invocation
*
* @return
* @throws Exception
*/
@Override
protected String handleValidToken(ActionInvocation invocation) throws Exception {
// we know the token name and token must be there
String key = TokenHelper.getTokenName();
String token = TokenHelper.getToken(key);
String sessionTokenName = TokenHelper.buildTokenSessionAttributeName(key);
InvocationSessionStore.storeInvocation(sessionTokenName, token, invocation);
return invocation.invoke();
}
}