Spring Security Rule

[pamir sonmez]

In my security.xml file , I implemented the access rights of admin/** page like that;

		<security:intercept-url pattern="/admin/**"
			access="ROLE_ADMIN" />

Then, In my strut.xml file, I have an action mapping like that;

		<action name="myAction" class="com.....MyAction">
			<interceptor-ref name="logger"></interceptor-ref>
			<result name="success">/admin/admin.jsp</result>
		</action>

I am able to call the myAction without logging in to the system
and at the result of the action I am forwarded to the admin.jsp page which I dont have required priveleges, However since action redirected me to that page, I am able to see the content of the page.

Since url is not changed after the action is called, security is not restricting the page show.
How can I handle this situation?
If security handle the forwarding, wouldnt it be better ?

[Peter Mularien]

Sounds like you may not have the relevant servlet filters in the right order. Can you post your web.xml fille as well?

[Jackie Li]

have you configured your ExceptionTranslationFilter, or in other ways, have you ever used your authorization settings?