Page History

Introduction

Your Struts 2 application may need to access the HTTP session object. Struts 2 provides an interface, SessionAware, that your Action class should implement to obtain a reference to the HTTP session object.

...

private Map<String, Object> userSession ;

public void setSession(Map<String, Object) session) {

   userSession = session ;

}

...

private void increaseHelloCount() {
			
   Integer helloCount = (Integer) userSession.get(HELLO_COUNT);
		
   if (helloCount == null ) {
		
     helloCount = 1;
			
   } else {
			
     helloCount++;

   }
		
   userSession.put(HELLO_COUNT, helloCount);
	
}

...

Struts 2 provides an easy way to get an object stored in the HTTP session from within the view page. In the example application is HelloWorld.jsp with this markup:

   <p>I've said hello to you <s:property value="#session.helloCount" /> times!</p>

...

	public boolean acceptableParameterName(String parameterName) {
		
		boolean allowedParameterName = true ;
		
		if ( parameterName.contains("session")  || parameterName.contains("request") ) {
		
			allowedParameterName = false ;
			
		} 
		
		return allowedParameterName;
	}

This method will be called by the Struts 2 framework for each parameter in the request scope. By returning false if the parameter name contains "session" we are telling the Struts 2 framework to ignore that parameter. This will prevent a malicious user from trying to hack the HTTP session object.

Instead of having each action that implements SessionAware also implement the ParameterNameAware interface you can tell the params interceptor to exclude specific request attributes for all actions in a package. In struts.xml configure the struts-default set of interceptors as follows:

	<package name="basicstruts2" extends="struts-default">

 		<interceptors>
	 		<interceptor-stack name="appDefault">
	        	 <interceptor-ref name="defaultStack">
	      			<param name="exception.logEnabled">true</param>
	      			<param name="exception.logLevel">ERROR</param>
	      			<param name="params.excludeParams">dojo\..*,^struts\..*,^session\..*,^request\..*,^application\..*,^servlet(Request|Response)\..*,parameters\...*</param>
	   			</interceptor-ref>
	 	    </interceptor-stack>
		</interceptors>
		
		<default-interceptor-ref name="appDefault" />

...

When your Action class needs to access the HTTP session object implement the SessionAware interface and override the setSession method. Be sure to also implement the ParameterNameAware interface and override the acceptableParameterName method to mitigate a potential security vulnerability. If you have multiple actions that implement SessionAware then consider modifying the params interceptor's excludeParams value as part of your Struts 2 package setup.