What security features are available in Struts?
I am tasked with developing a web application and am thinking about using the Struts framework as it seems to be standard and easy to implement.
However, before making a decision, I need to know the security features available in Struts.
Are there efficient ways to handle OWASP Top 10 using Struts? And if so, how would I do it?
source to share
Struts offers you an MVC framework and has limited security features like. you can map roles to actions. I would recommend that you learn something more complete like Spring Security (formerly Acegi).
source to share
Even for the features YC mentions, you probably don't want to use the Struts config file out of the box to set up the ACL for your actions. It might be better to programmatically examine the state in the HttpRequest as it exits the ActionServlet before it reaches your Struts actions (i.e. is it an HttpRequest coming from an authenticated and authorized user given a URL?). Alternatively, you can intercept the request with the ServletFilter, although you need to be careful to make sure it is thread safe.
source to share