[prev in list] [next in list] [prev in thread] [next in thread] 

List:       struts-user
Subject:    Warning:  Spring Security and FileUploadInterceptor filter order
From:       dusty <dustin_pearce () yahoo ! com>
Date:       2008-12-29 18:19:56
Message-ID: 21207025.post () talk ! nabble ! com
[Download RAW message or body]


Hello,

This vexed me, so I thought I would share to help anyone stuck with
something similar....

I have Spring Security protecting my Struts2 app.  Originally I had my
filters setup like this:
    <filter-mapping>
        <filter-name>struts-prepare</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>securityFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>sitemesh</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>lazyLoadingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>    
    <filter-mapping>
        <filter-name>struts-execute</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

The problem is that the FileUploadInterceptor looks at the request and tries
to cast it to the Struts2 wrapper MultiPartRequestWrapper.  With the Spring
Security filter where it is above, the Struts2 dispatcher wraps the request
(when it detects multipart/form-data)  but then Spring Security builds its
own request wrapper class for the request.  The FileUploadInterceptor
doesn't think its a MultiPartRequest and doesn't populate the setters on
your action.

The answer is to put Spring Security first:
    <filter-mapping>
        <filter-name>securityFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>struts-prepare</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>sitemesh</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>lazyLoadingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>    
    <filter-mapping>
        <filter-name>struts-execute</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

This way Spring Security does its thing and then Struts builds its wrapper
after the user is authenticated.  Knowing what I know now it seems obvious
to put the Spring Security filter first, but I guess it wasn't that obvious
to me originally.  So maybe someone else will miss that as well and somehow
google this post....
-- 
View this message in context: \
http://www.nabble.com/Warning%3A--Spring-Security-and-FileUploadInterceptor-filter-order-tp21207025p21207025.html
 Sent from the Struts - User mailing list archive at Nabble.com.


---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org


[prev in list] [next in list] [prev in thread] [next in thread]