Forum:

Struts

How to hide url: in struts

Vic Hood

Ranch Hand

Posts: 477

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hi ,
Im developing a web page , where upon clicking a method , the parameters are being passed through the url ,and hence my parameters, are being exposed . This query may not be specific to struts. But id like to know how I could hide my parameters .I ve placed the code of my jsp below . Please advice .

<body >

<html:form action="/login.do?param=addDomain"> // exposed link!!
 
<TABLE width="100%" height="100%" border="1" cellspacing="0"
	cellpadding="0">
	<TR>
		<TD height="75" class="header"><%@ include file="/jsp/header.jsp"%>
		</TD>
	</TR>
	<TR>
		<TD height="30" class="menu"><%@ include file="/jsp/Menu.jsp"%>

</TD>
	</TR>

<TR>
		<TD class="content" valign="top">
		<TABLE class="DocMasterBodyTable">
		<html:form action="/login.do?param=addDomain">  // exposed link!!
!!		
			<TR class="odd">
				<TD class="cssLabel">DomainType</TD>
				<TD class="cssComboBox">
								
							
			<html:select property="domainType" onchange="OnChange(this);">
				<html:option value="-1" >--Select-- </html:option>
				
				<html:option value="emp" >Employee</html:option>
				<html:option value="test" >Test</html:option>
				</html:select>
				
				<html:hidden property="objid" value="objectid" />
				</TD>
				<TD colspan="3"></TD>
			</TR>

<TR class="even">
				<TD class="cssLabel">Code</TD>
				<TD class="cssComboBox"><html:text property="code"></html:text>
				</TD>
				<TD></TD>
				<TD class="cssLabel">Description</TD>
				<TD class="cssComboBox"><html:text property="description"></html:text>
				</TD>
				
			</TR>
			<TR class="odd">
				<TD class="cssLabel">Active</TD>
				<TD><html:checkbox property="active" value="1"></html:checkbox></TD>
				<TD></TD>
				<TD class="cssLabel">Editable</TD>
				<TD><html:checkbox property="edit" value="1"></html:checkbox></TD>
			</TR>
			<TR class="even">
				<TD colspan="5" align="right"><html:submit value="Submit"></html:submit>
				<html:reset value="Clear "></html:reset>
			<input type="hidden" name="hdnDomainId"  value="0">		
				</TD>

</TR>
</html:form>
		</TABLE>
<logic:notEmpty name="list" scope="session">
		<TABLE class="DocMasterFooterTable" width="75%" border="1">
			<TR>

<TD>Code</TD>
				<TD>Description</TD>
				<TD>IsActive?</TD>
				<TD>IsEditable?</TD>

</TR>

<logic:iterate id="listDetails" name="list" scope="session" type="com.enzen.domain.vo.DomainDetailsVO" >  
   <tr>
		 	<td><bean:write name="listDetails" property="code"/></td> 
            <td><bean:write name="listDetails" property="description"/></td>
            <td><bean:write name="listDetails" property="active"/></td>			
			<td><bean:write name="listDetails" property="edit"/></td>	
			<td><html:link action="login.do?param=editEmployee"  scope="session" paramId="objid" paramProperty="objid" paramName="listDetails" >Edit</html:link></td>    // exposed link!!
						<td><html:button property="audit" value="Audit Trail"/></td>

</tr> 
</logic:iterate>

</TABLE>
		</logic:notEmpty> 
		</TD>

</TR>

</TD>
	</TR>
</TABLE>

Learning and Learning!-- Java all the way!

Suraj Jadhav

Greenhorn

Posts: 29

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

There are various ways. Simple could be, to pass the parameter through request/session. Or you can implement unique token for each request so that url cannot be tempered. One third party tool is CSRF Guard. You can also use AJAX in your code to hide url. There are various ways so check which one suites for you.

Vic Hood

Ranch Hand

Posts: 477

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hi Suraj,
Thanks for replying!! Could you please give me an example on how to implement it using request /session .As im relatively new to Java and am trying to learn on the job . Thank you.

Learning and Learning!-- Java all the way!

sri ramvaithiyanathan

Ranch Hand

Posts: 109

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hi,
Use method="post" in your html:form tag

Regards,
Sriram.V

For java examples,ebooks,interview questions,visit this blog
http://periodicupdates.blogspot.com/

Vic Hood

Ranch Hand

Posts: 477

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

sri ramvaithiyanathan wrote:Hi,
Use method="post" in your html:form tag
<html:form action="/login.do?param=addDomain" method="post">

Regards,
Sriram.V

Hi,
I did try out the post method as you have mentioned before too , but there was no change . I'm pasting that ;line from my code and also the url being generated upon clicking the respective button , please let me know where im going wrong.
Thanks .

Upon Submitting the form , the url generated is --

URL--http://localhost:8080/StrutsDBApp/login.do?param=addDomain

Im trying to do away with the "param=addDomain " part here ..

Any help would be appreciated.

Learning and Learning!-- Java all the way!

Bear Bibeault

Sheriff

Posts: 67752

173

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Of course anything you put into the action value will be used as is. If you don't want it on the URL, then don't put it there!

[Asking smart questions] [About Bear] [Books by Bear]

HTML 5 (verified skill)
Skill verified by Jeanne Boyarsky

CSS 3 (verified skill)
Skill verified by Jeanne Boyarsky

JavaScript (verified skill)
Skill verified by Jeanne Boyarsky

Vic Hood

Ranch Hand

Posts: 477

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Bear Bibeault wrote:Of course anything you put into the action value will be used as is. If you don't want it on the URL, then don't put it there!

Thanks for replying! Pardon my ignorance, So there is no method where i can hide the parameter that i pass through to the form ??

Learning and Learning!-- Java all the way!

Bear Bibeault

Sheriff

Posts: 67752

173

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Make it a hidden input rather than a parameter on the action URL.

By the way, I hope you're not doing this for security reasons. POSTs are not any more secure than GETs.

[Asking smart questions] [About Bear] [Books by Bear]

amit punekar

Ranch Hand

Posts: 544

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hello,
Have a look at MappingDispatchAction class.
This will help you to get rid of the parameter.

Keep in mind though as mentioned earlier if you choose to prepare URL with query string parameters then you cannot hide them. Looking at your URL I felt that you are trying to use conditions based on the parameter to decide what action to be taken. This can be best addressed using the above approach (in STRUTS).

Regds,
Amit

Vic Hood

Ranch Hand

Posts: 477

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Hi Amit ,
Thanks for replying.
Could you please explain with an example?

Learning and Learning!-- Java all the way!

amit punekar

Ranch Hand

Posts: 544

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

hi,
the link to the Struts API itself has a very good self-explanatory example.

Regds,
Amit

Vic Hood

Ranch Hand

Posts: 477

I like...

posted 13 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

amit punekar wrote:Hello,
Have a look at MappingDispatchAction class.
This will help you to get rid of the parameter.

Keep in mind though as mentioned earlier if you choose to prepare URL with query string parameters then you cannot hide them. Looking at your URL I felt that you are trying to use conditions based on the parameter to decide what action to be taken. This can be best addressed using the above approach (in STRUTS).

Regds,
Amit

Hi Amit,
I did try out your method. The MappingDispatch Action is effective for passing urls , however when i call a particular method to which a parameter is being passed , the "param" is back on the querystring . It would be great if anyone could help me to get the param part out of the url . Im placing the modified struts config and action class after using Mapping Dispatch , please have a look at if I'm on the right track .
Thanks in Advance,

Struts- config

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE struts-config PUBLIC "-//Apache Software Foundation//DTD Struts Configuration 2//EN" "http://struts.apache.org/dtds/struts-config_1_2.dtd">

<struts-config>
	<data-sources />
	<form-beans>

<form-bean name="loginFn"  type="com.enzen.domain.form.DomainForm" />

</form-beans>

<global-exceptions />
	<global-forwards>
		<forward name="login" path="/login.do?" />
	</global-forwards>

<action-mappings>
		<action path="/login" name="loginFn"
			type="com.enzen.domain.action.DomainAction" 
			parameter="loadDomain"
			scope="session" 
			validate="false">
			<forward name="success" path="/jsp/test.jsp" />
			</action>	
			
			<action path="/login" name="loginFn"
			type="com.enzen.domain.action.DomainAction" 
			parameter="listDetails"
			scope="session" 
			validate="false">
			<forward name="success" path="/jsp/test.jsp" />
			</action>
			
			<action path="/login" name="loginFn"
			type="com.enzen.domain.action.DomainAction" 
			parameter="addDomain"
			scope="session" 
			validate="false">
			<forward name="success" path="/jsp/test.jsp" />
			</action>	
			<action path="/login" name="loginFn"
			type="com.enzen.domain.action.DomainAction" 
			parameter="listDetails"
			scope="session" 
			validate="false">
			<forward name="success" path="/jsp/test.jsp" />
			</action>	
			<action path="/login" name="loginFn"
			type="com.enzen.domain.action.DomainAction" 
			parameter="editEmployee"
			scope="session" 
			validate="false">
			<forward name="success" path="/jsp/test.jsp" />
			</action>	
					
			
																			
		
		
		
		</action-mappings>

<plug-in className="org.apache.struts.tiles.TilesPlugin">
		<set-property property="definitions-config"
			value="/WEB-INF/tiles-defs.xml" />
		<set-property property="moduleAware" value="true" />
	</plug-in>

</struts-config>

Action Class--

/*
 * To change this template, choose Tools | Templates
 * and open the template in the editor.
 */

package com.enzen.domain.action;

import com.enzen.domain.form.DomainForm;
import com.enzen.domain.service.DomainService;
import com.enzen.domain.vo.DomainDetailsVO;
import com.sun.xml.internal.messaging.saaj.packaging.mime.util.BEncoderStream;

import java.util.ArrayList;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import org.apache.catalina.Session;
import org.apache.commons.beanutils.BeanUtils;
import org.apache.struts.action.Action;
import org.apache.struts.action.ActionForm;
import org.apache.struts.action.ActionForward;
import org.apache.struts.action.ActionMapping;
import org.apache.struts.actions.DispatchAction;
import org.apache.struts.actions.MappingDispatchAction;

/**
 *
 * @author Administrator
 */
public class DomainAction extends MappingDispatchAction {

public ActionForward loadDomain(ActionMapping mapping, ActionForm form,
			HttpServletRequest request, HttpServletResponse response)
	throws Exception {
		try {
			HttpSession session = request.getSession(true);
			if (session == null){
				System.out.println("Sesion null");
			}
			DomainForm dmForm = new DomainForm();
			DomainService service = new DomainService();
			ArrayList domainType = service.loadDomainType();
			System.out.println("Size: "+domainType.size());
			dmForm.setDomainList(domainType);
			session.setAttribute("domainType", domainType);

} catch (Exception e) {
			e.printStackTrace(System.out);
		}

return mapping.findForward("success");

}

public ActionForward listDetails(ActionMapping mapping, ActionForm form,
			HttpServletRequest request, HttpServletResponse response)
	throws Exception {
		try {
			HttpSession session = request.getSession(true);
			System.out.println("In List Domain");
			String code= request.getParameter("code");
			System.out.println("Code"+code);
			String hdnDomainId= request.getParameter("hdnDomainId");
			System.out.println("Domainid"+hdnDomainId);
			String objid=request.getParameter("objid");
			hdnDomainId=objid;
			System.out.println("Domain ID now has a value"+hdnDomainId);
			DomainService service = new DomainService();
			
			@SuppressWarnings("rawtypes")
			ArrayList list= service.listDomain(code);
			System.out.println(list.size());
			session.setAttribute("list", list);
			// Code for Inserting link.. modified.
			
	
		
		} catch (Exception e) {
			e.printStackTrace(System.out);
		}

return mapping.findForward("success");

}
	
	public ActionForward addDomain(ActionMapping mapping, ActionForm form,
			HttpServletRequest request, HttpServletResponse response)
	throws Exception {
		try {
			HttpSession session = request.getSession(true);
			System.out.println("In addDomain");
			DomainForm dmForm = (DomainForm)form;  // (DomainForm) done so that form contains values from jsp.
			DomainDetailsVO dvo = new DomainDetailsVO();
			BeanUtils.copyProperties(dvo, dmForm);
			if(dvo.getActive() != null && dvo.getActive()!=""){ 
                if (dvo.getActive().equalsIgnoreCase("1")) 
                        {dvo.setActive("1");} 
                } 
                else 
                        {dvo.setActive("0");} 
                if(dvo.getEdit() != null && dvo.getEdit()!=""){ 
                if (dvo.getEdit().equalsIgnoreCase("1")) 
                        {dvo.setEdit("1");} 
                } 
                else 
                        {dvo.setEdit("0");}

DomainService service = new DomainService();
			service.addDomain(dvo);

} catch (Exception e) {
			e.printStackTrace(System.out);
		}
		//return mapping.findForward("empStatus");
		return mapping.findForward("success");

}       
    	
	
	public ActionForward editEmployee(ActionMapping mapping, ActionForm form,
			HttpServletRequest request, HttpServletResponse response)
	throws Exception {
		try {
			HttpSession session = request.getSession(true);
			System.out.println("In Edit List");
			//ring code= request.getParameter("code");
			//stem.out.println(code);
			System.out.println("this doesnt work");
			 String hdnDomainId= request.getParameter("objid");
			DomainService service = new DomainService();
			
			@SuppressWarnings("rawtypes")
		//rrayList list= service.listDomain(code);
	//System.out.println(list.size());
//	session.setAttribute("list", list);
			// Code for Inserting link.. modified.
			DomainForm dmForm=(DomainForm) form;
			//request.getParameterValues("objid");
		//	String objid=request.getParameter("objid");
		//	String objid=session.getAttribute("objid").toString();
		//	session.setAttribute(objid,"objid");
			String objid=request.getParameter("objid");

DomainDetailsVO dvo=service.editEmployee(objid);
		
			
			if(dvo!=null){

BeanUtils.copyProperties(dmForm,dvo);

}

} catch (Exception e) {
			e.printStackTrace(System.out);
		}

return mapping.findForward("success");

}

Thanks

Have you no shame? Have you no decency? Have you no tiny ad?

Smokeless wood heat with a rocket mass heater

https://woodheat.net