如何知道从哪个班级收到的请求

Question

I have a login.jsp page in my application. I am using Struts 2 and a simple validate() method to validate my form. I have two questions:

1. validate() method in my form bean class validates the form. Ie checks for empty fields etc. If I need to check my username and password combination should I do this inside validate() or in my action class?

2. If I am doing the same in my action class, correct combination leads to success page. I want the incorrect combination to lead to my JSP page along with the error message: "Incorrect combination". How can I check in my JSP page that the request has come from action class so that it can print the error message "Incorrect combination"?

Answer 1

Authentication belongs in the action, not in validation, IMO.

I might consider using XML or annotation validations for the fields themselves and put the login attempt in validate() , but the code is small, and I'd be pretty comfortable with it either way.

public String execute() {
    if (userService.loginValid(username, password) {
        return SUCCESS;
    }

    addActionError(getText("login.failure"));
    return FAILURE;
}

I would use the framework's support for action-level error messages rather than using a flag (and I wouldn't duplicate that flag with a local if I did), and I strongly recommend using something you can inject to do the actual logging in to make testing easier.

Using the validate() approach makes things pretty tight:

public void validate() {
    if (!userService.loginValid(username, password)) {
        addActionError(getText("login.failure"));
    }
}

Assuming you define reasonable "input" and "success" results that might be all you need. If developers looking at the code are familiar with the framework the validate() version is relatively clear.

If you're not interested in using XML or annotation validations, you can do that manually as well. That definitely belongs in validate() , and for common utility methods like this, static imports make the code still relatively concise:

public void validate() {
    boolean tryLogin = true;

    if (isBlank(username)) {
        addFieldError("username", getText("login.username.required"));
        tryLogin = false;
    }

    if (isBlank(password)) {
        addFieldError("password", getText("login.password.required"));
        tryLogin = false;
    }

    if (tryLogin && !userService.loginValid(username, password)) {
        addActionError(getText("login.failure"));
    }
}

(I added the tryLogin flag to avoid seeing the error message for a login that will obviously fail, although this could be handled in other ways as well. Post-login processing elided.)

Answer 2

I would say you definitely don't want the login logic in the validate method; that's for validating data.

I would suggest that if your login fails, just expose a data property on the action like:

execute () {

   boolean authenticated = login( getUsername(), getPassword() );
   setLoginValid( authenticated );

   if ( authenticated ) 
      result = SUCCESS;
   else 
      result = FAILURE;

   return result;

}

And then in your login.jsp, simply wrap a message about bad credentials in the struts if tag, with a test on the loginValid property.

Answer 3

The purpose of the validation framework is to check field values to be valid to prevent unexpected errors while executing the action.

It is a good practice to separate the validation logic from the business logic. Authentication has nothing to do with validation logic. It is a separate process provided by security mechanisms. Of course you can create the action or interceptor that performs authentication, and as with any action you can configure it for validation.

In Struts2 it's even more simplified by applying a validation interceptor is a part of the job for processing request. In more sophisticated scenarios authentication becomes a part of the business logic, but the method to validate the input fields renames the same. If your action is only do is authenticating then you may not require the validation to process authentication.

To your second question: all you need is to addActionError(getText("error.key")) to invalidate the action. Then return to the result where <s:actionerror> to display the message.

What is more important the validation logic remains the same if you decide to move it to the action. In this case the only thing you have to do is to remove the validation stack. The only reason of such validation is to return the result that is different than "input" .