Security configuration and hardening of Struts 2 framework

To protect Struts 2 applications, you can use the following security configurations: Disable unused features Enable content type checking Validate input Enable security tokens Prevent CSRF attacks Use RBAC to restrict role-based access

Security Configuration and Hardening of the Struts 2 Framework

Struts 2 is a popular Java web application framework. To protect your Struts 2 applications from security threats, it is crucial to implement appropriate security configurations. This tutorial will guide you step by step on how to secure your Struts 2 application.

1. Disable unused functionality

Disabling unused Struts 2 functionality in your application can reduce the potential attack surface. In the struts.xml configuration file, you can achieve this by limiting the defaultAction servlet filter to parsing the default action. For example:

<struts>
  <constant name="struts.action.excludePattern" value="^/.*/$" />
</struts>

2. Enable content type checking

Struts 2 provides content type checking functionality that prevents users from submitting content that does not match the data type expected by the application. It can be enabled by setting a few properties in the struts.properties file:

struts.multipart.parser=jakarta-multipart
struts.multipart.multiPartParser.maximumRequestSize=2MB
struts.multipart.multiPartParser.maximumFileSize=1MB

3. Validating input

Validate the input received from the user Input is critical to preventing injection attacks. Struts 2 provides built-in validators that you can use in Action classes. For example:

@Validate
public class MyAction extends ActionSupport {

  private String name;

  @Required
  public String getName() {
    return name;
  }

}

4. Enable security tokens

Security tokens are used to prevent cross-site request forgery (CSRF) attacks, in which an attacker tricks a victim into submitting Requests that do not belong to them. Struts 2 allows you to create and verify security tokens before submitting a form. You can enable it by configuring the following in the web.xml file:

<filter>
  <filter-name>struts2-token</filter-name>
  <filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
</filter>

<filter-mapping>
  <filter-name>struts2-token</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

5. Restricting access

Role-based access control ( RBAC) ensures that only authorized users can access certain resources in an application. Struts 2 supports RBAC through the @RolesAllowed annotation. For example:

@RolesAllowed("admin")
public String doAdminAction() {
  // 只有管理员才有权访问此操作
}

Practical case

The following is an example Struts 2 Action class that demonstrates the comprehensive use of security configuration:

@Namespace("/")
@Action("/secureAction")
@RolesAllowed("secure")
public class SecureAction extends ActionSupport {

  @Required
  private String input;

  @Override
  public String execute() {
    if (!TokenHelper.validToken()) {
      return INPUT;
    }

    if (someValidationRule()) {
      return SUCCESS;
    } else {
      addFieldError("input", "Invalid input");
      return INPUT;
    }
  }

}

By implementing these Security Configuration, you can significantly enhance the security of your Struts 2 application and make it safe from common threats.

The above is the detailed content of Security configuration and hardening of Struts 2 framework. For more information, please follow other related articles on the PHP Chinese website!