org.apache.struts2.interceptor

## Class RolesInterceptor

- java.lang.Object
- - org.apache.struts2.interceptor.AbstractInterceptor
  - - com.opensymphony.xwork2.interceptor.AbstractInterceptor
    - - org.apache.struts2.interceptor.RolesInterceptor

- All Implemented Interfaces:
    Serializable, ConditionalInterceptor, Interceptor

      public class RolesInterceptor
      extends AbstractInterceptor

  This interceptor ensures that the action will only be executed if the user has the correct role.

  Interceptor parameters:

  - allowedRoles - a comma-separated list of roles to allow
  - disallowedRoles - a comma-separated list of roles to disallow

  When both allowedRoles and disallowedRoles are configured, then disallowedRoles takes precedence, applying the following logic: (if ((inRole(role1) || inRole(role2) || ... inRole(roleN)) && !inRole(roleA) && !inRole(roleB) && ... !inRole(roleZ)) { //permit ...

  There are three extensions to the existing interceptor:

  - isAllowed(HttpServletRequest,Object) - whether or not to allow the passed action execution with this request
  - handleRejection(ActionInvocation) - handles an unauthorized request.
  - areRolesValid(List<String> roles) - allows subclasses to lookup roles to ensure they are valid. If not valid, RolesInterceptor will log the error and cease to function. This helps prevent security misconfiguration flaws.

        <!-- START SNIPPET: example -->
        <!-- only allows the admin and member roles -->
        <action name="someAction" class="com.examples.SomeAction">
            <interceptor-ref name="completeStack"/>
            <interceptor-ref name="roles">
              <param name="allowedRoles">admin,member</param>
            </interceptor-ref>
            <result name="success">good_result.ftl</result>
        </action>
        <!-- END SNIPPET: example -->

  See Also:
    Serialized Form

- - ### Nested Class Summary

    - ### Nested classes/interfaces inherited from interface com.opensymphony.xwork2.interceptor.ConditionalInterceptor

      `ConditionalInterceptor.LegacyAdapter`

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `protected List<String>` | `allowedRoles`
    `protected List<String>` | `disallowedRoles`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `RolesInterceptor()`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `protected boolean` | `areRolesValid(List<String> roles)` Extension point for sub-classes to test if configured roles are known valid roles.
    `protected String` | `handleRejection(ActionInvocation invocation, javax.servlet.http.HttpServletResponse response)` Handles a rejection by sending a 403 HTTP error
    `String` | `intercept(ActionInvocation invocation)` Override to handle interception
    `protected boolean` | `isAllowed(javax.servlet.http.HttpServletRequest request, Object action)` Determines if the request should be allowed for the action
    `void` | `setAllowedRoles(String roles)`
    `void` | `setDisallowedRoles(String roles)`
    `protected List<String>` | `stringToList(String val)` Splits a string into a List

    - ### Methods inherited from class com.opensymphony.xwork2.interceptor.AbstractInterceptor

      `intercept, shouldIntercept, shouldIntercept`

    - ### Methods inherited from class org.apache.struts2.interceptor.AbstractInterceptor

      `destroy, init, setDisabled`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

    - ### Methods inherited from interface com.opensymphony.xwork2.interceptor.ConditionalInterceptor

      `adapt`

    - ### Methods inherited from interface com.opensymphony.xwork2.interceptor.Interceptor

      `adapt`

    - ### Methods inherited from interface org.apache.struts2.interceptor.Interceptor

      `destroy, init`

- - ### Field Detail

    - #### allowedRoles

          protected List<String> allowedRoles

    - #### disallowedRoles

          protected List<String> disallowedRoles

  - ### Constructor Detail

    - #### RolesInterceptor

          public RolesInterceptor()

  - ### Method Detail

    - #### setAllowedRoles

          public void setAllowedRoles(String roles)

    - #### setDisallowedRoles

          public void setDisallowedRoles(String roles)

    - #### intercept

          public String intercept(ActionInvocation invocation)
                           throws Exception

      Description copied from class: `AbstractInterceptor`
      Override to handle interception
      Specified by:
        `intercept` in class `AbstractInterceptor`
      Throws:
        `Exception`

    - #### stringToList

          protected List<String> stringToList(String val)

      Splits a string into a List
      Parameters:
        `val` - the string to split
      Returns:
        the string list

    - #### isAllowed

          protected boolean isAllowed(javax.servlet.http.HttpServletRequest request,
                                      Object action)

      Determines if the request should be allowed for the action
      Parameters:
        `request` - The request
        `action` - The action object
      Returns:
        True if allowed, false otherwise

    - #### handleRejection

          protected String handleRejection(ActionInvocation invocation,
                                           javax.servlet.http.HttpServletResponse response)
                                    throws Exception

      Handles a rejection by sending a 403 HTTP error
      Parameters:
        `invocation` - The invocation
        `response` - the servlet response object
      Returns:
        The result code
      Throws:
        `Exception` - in case of any error

    - #### areRolesValid

          protected boolean areRolesValid(List<String> roles)

      Extension point for sub-classes to test if configured roles are known valid roles. Implementations are encouraged to implement this method to prevent misconfigured roles. If this method returns false, the RolesInterceptor will be disabled and block all requests.
      Parameters:
        `roles` - allowed and disallowed roles
      Returns:
        whether the roles are valid or not (always true for the default implementation)

Copyright © 2000–2026 Apache Software Foundation. All rights reserved.