Re: Struts 7: error when "s:action" is used on jsp page and jsp is invoked directly in browser
Lukasz Lenart <[email protected]>
| Newsgroups | gmane.comp.jakarta.struts.user |
|---|---|
| Message-ID | <CAMopvkM+nXd-T=xBTE8Egcs9gSO2pWw7GB0Kn=29x9uaCOjaSw@mail.gmail.com> |
sob., 19 paź 2024 o 15:18 Wolfgang Knauf <[email protected]> napisał(a): > I have a "index.jsp" and invoke an action using "s:action" tag, then render data from this action. In the browser I navigate to this jsp direcly ("http://localhost/index.jsp" instead of browsing to ".../index.action"). This is against our security recommendations and acceccing JSPs directly won't be supported because in such case all the framework guards are omitted https://struts.apache.org/security/#never-expose-jsp-files-directly Cheers Łukasz