Forum:

Struts

struts2: what kicks in first- the interceptors or the form's validation?

Ranch Hand

Posts: 755

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

hey all,

what kicks in first? the interceptors or the form's validation?
logically, I would expect the validation to go first (unless I did not set it properly)

package com.struts.security.login;
 
import com.opensymphony.xwork2.Action;
import com.opensymphony.xwork2.validator.annotations.RequiredStringValidator;
import com.opensymphony.xwork2.validator.annotations.Validation;
 
@Validation
public class UserLogin extends LoginSupport
{
private String mypassword;
private String myusername;

public String execute() 
{
System.out.println(myusername+" <=========> "+mypassword);
return "success-login";
}

public String authenticate()
{
System.out.println("ok les invoked");
System.out.println(myusername+" / "+mypassword);
return Action.SUCCESS;
}

public String register()
{
System.out.println("pal it shall be!");
System.out.println(myusername+" / "+mypassword);
return Action.INPUT;
}

public String getMypassword()
{
return mypassword;
}
 
@RequiredStringValidator(message="password is missing")
public void setMypassword(String mypassword)
{
this.mypassword = mypassword;
}

@RequiredStringValidator(message="username is missing")
public String getMyusername()
{
return myusername;
}
 
public void setMyusername(String myusername)
{
this.myusername = myusername;
}
}

or the xml file.

Eric Nielsen

Ranch Hand

Posts: 194

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Annotation based Validation is accomplished by an interceptor --
specificly the "validation" interceptor which is quite close to the end of the interceptor stack. So most of the interceptors would have run first.

[Edit: actually further research indicates that both annotation and xml based validation are handled through the same interceptor, so the initial qualifier I had in my response isn't really needed, but still correct)
[ January 03, 2008: Message edited by: Eric Nielsen ]

Peter Primrose

Ranch Hand

Posts: 755

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

thank you Eric;

I did this:

as you can see the validation is almost at the very close to the end; however, it doesn't kick-in

Eric Nielsen

Ranch Hand

Posts: 194

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Just to make sure I understand, so you've submitted a form that should fail validation, but it doesn't?

First try switching to the method/execute based validation instead of the property validation, ie something like

@Validation()
 public class Create  extends ActionSupport {
  private String username;
  private String email;
  private String password;
  private String password_confirm;
  private UserDAO userDAO;
  
  @Validations(
        requiredStrings = {  
   @RequiredStringValidator(fieldName="username", message="Please enter a username."),
  @RequiredStringValidator(fieldName="email", message="Please enter an e-mail address."),
    @RequiredStringValidator(fieldName="password", message="Please enter a password."),
    @RequiredStringValidator(fieldName="password_confirm", message="Please repeat the password.")},
  emails = {
        @EmailValidator(fieldName="email",message="Please enter a valid e-mail address.")},
      expressions = {
        @ExpressionValidator(expression="password eq password_confirm", message="The two passwords must match.")
        }
        )
  public String execute() {
      final User user = new User();
      user.setUsername(getUsername());
      user.setEmail(getEmail());
      user.setPassword(getPassword());
      userDAO.makePersistent(user);
      return SUCCESS;
  }

Since I've gotten that type of validation to work. My interceptor stack looks like:

Which seems very comparable to yours, but I'm not sure if you had the default-interceptor-reg set. (and if you do have it set make sure that your action is in the same XWork Package as the interceptor definitions.

[ January 03, 2008: Message edited by: Eric Nielsen ]

[ January 03, 2008: Message edited by: Eric Nielsen ]
[ January 03, 2008: Message edited by: Eric Nielsen ]

Peter Primrose

Ranch Hand

Posts: 755

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

I really don't know. I tried every possible configuration (with or without the authorization interceptor) it simply doesn't invoke the validation.

mmmm....I;m reading practical apache struts2 and it says this:
"if you only use the provided validation you never need to provide a validation.xml" which is my case.

rrrrr...what do you mean by:

and if you do have it set make sure that your action is in the same XWork Package as the interceptor definitions

you mean the xml file and the interceptor class?

Eric Nielsen

Ranch Hand

Posts: 194

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

What I meant by that was....

Struts2 inherited from WebWork the confusing nomenclature of an "XWork Package" that is different from a Java Package. I don't think you're running into this, but it is worth checking. Here's be more or less complete setup (but I'm using the SmartURLs plugin so some stuff will be different.)

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE struts PUBLIC
    "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
    "http://struts.apache.org/dtds/struts-2.0.dtd">
<struts>
  <constant name="struts.objectFactory" value="spring" />
  <constant name="struts.devMode" value="true" />
  <constant name="struts.action.extension" value="" />
  <constant name="smarturls.action.packages" value="com.ballroomregistrar.compina
box.web.action" />
  <constant name="smarturls.action.default.parent.package" value="cib-default" />

<package name="cib-default" extends="struts-default">
    <interceptors>
          <interceptor name="authentication" class="com.ballroomregistrar.compina
box.web.interceptors.AuthenticationInterceptor" />
          <interceptor name="authorization" class="com.ballroomregistrar.compinab
ox.web.interceptors.AuthorizationInterceptor" />
      <interceptor-stack name="cibStack">
        <interceptor-ref name="authentication" />
        <interceptor-ref name="authorization" />
        <interceptor-ref name="defaultStack" />
      </interceptor-stack>
        </interceptors>
    <default-interceptor-ref name="cibStack" />
        <global-results>
      <result name="login" type="redirect">/account/login</result>
      <result name="access_denied" type="redirect">/accessDenied</result>
        </global-results>
   </package>
 
</struts>

Notice near the top there is the constant for "smarturls.action.default.parent.package" set to "cib-default". This means, effectively, that all my actions are "inside" the "cib-default" "XWork Package" and thus pickup the packages default-interceptor stack.

Since it doesn't look like you're using SmartURLs, this is probably less of a problem -- unless you have multiple <package>...</package> blocks in your struts.xml file and you've configured your action in one, and your interceptors in another... XWork packages are more than "just" namespaces as some books/tutorials present them.

I remember when I was first using validation I had some problems, which sounded similar to yours. Some of the other things I remember having to play with a lot...

the @Validation() annotation above the class. I think it requires the ()'s

I think I would make the advice to try a simpler example first -- single method per action (ie try it with the dispatch action style you're currently using as then there's fewer moving parts to debug)

Finally does your LoginSupport class extend from ActionSupport. I think part of the annotation magic might require that...

Eric Nielsen

Ranch Hand

Posts: 194

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Oh, one other thing... If validations fail then Struts2 will look for the "input" result, so make sure you have that configured. Ie the validation returns ActionSupport.INPUT, which equals "input" as its result...

Peter Primrose

Ranch Hand

Posts: 755

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Eric,

I got it (well...almost)
I used your last comment (return input) and it works!!! beautiful (you had to see the smile on my face :-) )

I did that without the authentication Interceptor 'user' (I used the 'guest'. code below); now, I tried using the 'user' but the validation doesn't seems to work. I mean, I would expect that the authentication-interceptor will not even work (get to play) because the validation is incorrect and it will return 'input'.
(I hope my assumption is right)

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE struts PUBLIC
    "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
    "http://struts.apache.org/dtds/struts-2.0.dtd">
 
<struts>
 
    <package name="security-default" namespace="/" extends="struts-default">
 
        <interceptors>
 
            <interceptor name="authentication" class="com.struts.security.AuthenticationInterceptor"/>                        
            
            <interceptor-stack name="user">
                <interceptor-ref name="servlet-config" />
                <interceptor-ref name="params" />
                <interceptor-ref name="authentication" />
                <interceptor-ref name="prepare" />
                <interceptor-ref name="chain" />
                <interceptor-ref name="model-driven" />
                <interceptor-ref name="fileUpload" />
                <interceptor-ref name="static-params" />
                <interceptor-ref name="params" />
                <interceptor-ref name="conversionError" />
                <interceptor-ref name="validation" />
                <interceptor-ref name="workflow" />
            </interceptor-stack>
            
            <interceptor-stack name="guest" >
                <interceptor-ref name="defaultStack"/>
            </interceptor-stack>
                                               
        </interceptors>
        
        
 
         <default-interceptor-ref name="user" />
 
        <global-results>
            <result name="input">/pages/security/login.jsp</result>        
            <result name="login" type="redirect-action">UserLogin</result>
        </global-results>
 
        <global-exception-mappings>
            <exception-mapping result="error" exception="java.lang.Throwable"/>
        </global-exception-mappings>
 
    </package>
 
</struts>

Eric - thank you so much!

Eric Nielsen

Ranch Hand

Posts: 194

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

I haven't worked with the Struts Authentication interceptor... I have my own rather simple home-grown solution. But I would definitely expect the struts authentication interceptor to fire before any validation.

Remember the interceptor isn't there to _handle_ authentication, but to ensure that the user has been authenticated. Typically you'd have a Login action, that sets a specific token on the session that the authentication interceptor checks.

Peter Primrose

Ranch Hand

Posts: 755

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

GOT IT!!!

You are right; I moved the authentication interceptor to the end of the stack (after the validation) and it works just as I wanted.

So, for the login page I *will not* use authentication because as you wrote, this suppose to come before validation (ie, on other functionality but login)

Case concluded thanks to you (I learned a lot!!!)
Thanks Eric

Eric Nielsen

Ranch Hand

Posts: 194

posted 16 years ago

Number of slices to send:

Optional 'thank-you' note:

Send

Yay!

Just for comparison, here's the way I'm handling Authentication

I have my own custom interceptor:

and a login action like

So in my case, by interceptor stack always includes the Authentication Interceptor, and the interceptor is "turned off" by the presence of the custom @Unsecured annotation on an action.

I also have a very similar custom Authorization interceptor that interacts with an @AllowAccess annotation (with some parameters. Since I wanted to code a "Secure By Default" model -- ie unless you've annotated the action with @Unsecured the action will force login, unless you've annotated with @AllowsAccess(list of roles) its super-user only. And theres only the single interceptor stack to worry about so nothing can skip the interceptors by accident.

Come have lunch with me Arthur. Adventure will follow. This tiny ad:

We need your help - Coderanch server fundraiser

https://coderanch.com/wiki/782867/Coderanch-server-fundraiser