Making Struts 2 and JSTL share message resources nicely.

It doesn't happen often, but occasionally ... you need to use your Struts 2 message resources in a jsp that is not part of a struts flow.

Normally, you have declared your struts 2 message resources (I put mine in global scope, i.e. global.properties at the root of my /WEB-INF/classes), and you use them as follows:

...

...

But in a simple JSP, you don't have access to these, so what do you do ? The obvious, simple solution is:

...

<%@ taglib prefix="fmt" 
           uri="http://java.sun.com/jsp/jstl/fmt" %>

...



...

Now, you might expect your text to appear right ? bzzzzt, Wrong! you get:

??some.random.text??

Now, why does this happen ? The answer is pretty simple, JSTL doesn't know about your struts message resources, you need to tell it about them.

This can be achieved with the following snippet in your web.xml:

  javax.servlet.jsp.jstl.fmt.localizationContextglobal
.

But be warned, as far as I can tell you can only specify one context, and thus you cannot use the struts 2 package style property cascading.

I personally use global propertiesm so this doesn't affect me.

Wildcards in Struts2 actions

Wildcards, and their possible applications in Struts2 action mapping are both diverse and powerful. More so than a lot of the content out there give them credit for, and more than I thought the were.

Rather thatn attempt to explain it all here, just go read the article here: https://cwiki.apache.org/WW/wildcard-mappings.html

there is also an article on what to do about ambiguous matches here: http://stackoverflow.com/questions/1742076/what-can-i-do-about-ambigous-wildcard-patterns-in-struts

Help debugging Struts 2

They say you learn something everyday, but today I genuinely did !

It turns out that there is a plugin included in the Struts 2 distributation that lets you browse the loaded configuration. This includes:

• Configuration settings
• Loaded jars
• Namespaces
• Mapped actions for each namespace
• Interceptor stacks
• Validation hooks 
• and many other useful things.

So, to make it work, you simply drop struts-config-browser-plugin-2.x.x.jar into your application path, and restart your app. You can then go visit: http://yourhost/yourapp/config-browser/index and there it is !

NB: If you are using sitemesh or equivalent with a global /* decorator, you may see some odd rendering. I had to change my config around a bit to prevent sitemesh decorating these pages.

Warning: This may seem obvious, but ... make sure you don't put this out into production (or even QA for that matter).

The full details on how this works can be found here: http://struts.apache.org/2.2.1/docs/debugging-struts.html

XSRF protection using Struts 2

I was recently ferretting around for different ways to handle XSRF protection in Struts 2.
(an explanation of this can be found here)

I was curious to see what other people are doing around this, but it seems that (as I expected) the general best practice still seems to be around unique token submission - which is fine.

At the same time. it dawned on me that I've not come across too much on how to do this with Struts 2.
But, fear not faithful readers, this blog entry here http://nickcoblentz.blogspot.com/2008/11/csrf-prevention-in-struts-2.html sums it up nicely.

Incidently, this guy also deals with several other Struts 2 topics in his blog, worth a look.