org.apache.struts2.interceptor

## Class TokenInterceptor

- java.lang.Object
- - org.apache.struts2.interceptor.AbstractInterceptor
  - - com.opensymphony.xwork2.interceptor.AbstractInterceptor
    - - com.opensymphony.xwork2.interceptor.MethodFilterInterceptor
      - - org.apache.struts2.interceptor.TokenInterceptor

- All Implemented Interfaces:
    Serializable, ConditionalInterceptor, Interceptor
  Direct Known Subclasses:
    TokenSessionStoreInterceptor

      public class TokenInterceptor
      extends MethodFilterInterceptor

  Ensures that only one request per token is processed. This interceptor can make sure that back buttons and double clicks don't cause un-intended side affects. For example, you can use this to prevent careless users who might double click on a "checkout" button at an online store. This interceptor uses a fairly primitive technique for when an invalid token is found: it returns the result invalid.token, which can be mapped in your action configuration. A more complex implementation, `TokenSessionStoreInterceptor`, can provide much better logic for when invalid tokens are found.

  Note: To set a token in your form, you should use the token tag. This tag is required and must be used in the forms that submit to actions protected by this interceptor. Any request that does not provide a token (using the token tag) will be processed as a request with an invalid token.

  Internationalization Note: The following key could be used to internationalized the action errors generated by this token interceptor

  - struts.messages.invalid.token

  NOTE: As this method extends off MethodFilterInterceptor, it is capable of deciding if it is applicable only to selective methods in the action class. See `MethodFilterInterceptor` for more info.

  Interceptor parameters:

  - None

  Extending the interceptor:

  While not very common for users to extend, this interceptor is extended by the `TokenSessionStoreInterceptor`. The `handleInvalidToken(com.opensymphony.xwork2.ActionInvocation)` and `handleValidToken(com.opensymphony.xwork2.ActionInvocation)` methods are protected and available for more interesting logic, such as done with the token session interceptor.

  Example code:

       <action name="someAction" class="com.examples.SomeAction">
           <interceptor-ref name="token"/>
           <interceptor-ref name="basicStack"/>
           <result name="success">good_result.ftl</result>
       </action>

       <-- In this case, myMethod of the action class will not
              get checked for invalidity of token -->
       <action name="someAction" class="com.examples.SomeAction">
           <interceptor-ref name="token">
              <param name="excludeMethods">myMethod</param>
           </interceptor-ref name="token"/>
           <interceptor-ref name="basicStack"/>
           <result name="success">good_result.ftl</result>
       </action>

  See Also:
    `TokenSessionStoreInterceptor`, `TokenHelper`, Serialized Form

- - ### Nested Class Summary

    - ### Nested classes/interfaces inherited from interface com.opensymphony.xwork2.interceptor.ConditionalInterceptor

      `ConditionalInterceptor.LegacyAdapter`

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static String` | `INVALID_TOKEN_CODE`

    - ### Fields inherited from class com.opensymphony.xwork2.interceptor.MethodFilterInterceptor

      `excludeMethods, includeMethods`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `TokenInterceptor()`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `protected String` | `doIntercept(ActionInvocation invocation)` Subclasses must override to implement the interceptor logic.
    `protected String` | `getErrorMessage(ActionInvocation invocation)`
    `protected String` | `getErrorMessage(ActionInvocation invocation)`
    `protected String` | `handleInvalidToken(ActionInvocation invocation)`
    `protected String` | `handleInvalidToken(ActionInvocation invocation)` Determines what to do if an invalid token is provided.
    `protected String` | `handleToken(ActionInvocation invocation)`
    `protected String` | `handleToken(ActionInvocation invocation)`
    `protected String` | `handleValidToken(ActionInvocation invocation)`
    `protected String` | `handleValidToken(ActionInvocation invocation)` Called when a valid token is found.
    `void` | `setTextProviderFactory(TextProviderFactory textProviderFactory)`

    - ### Methods inherited from class com.opensymphony.xwork2.interceptor.MethodFilterInterceptor

      `applyInterceptor, applyInterceptor, doIntercept, getExcludeMethodsSet, getIncludeMethodsSet, intercept, setExcludeMethods, setIncludeMethods`

    - ### Methods inherited from class com.opensymphony.xwork2.interceptor.AbstractInterceptor

      `intercept, shouldIntercept, shouldIntercept`

    - ### Methods inherited from class org.apache.struts2.interceptor.AbstractInterceptor

      `destroy, init, setDisabled`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

    - ### Methods inherited from interface com.opensymphony.xwork2.interceptor.ConditionalInterceptor

      `adapt`

    - ### Methods inherited from interface com.opensymphony.xwork2.interceptor.Interceptor

      `adapt`

    - ### Methods inherited from interface org.apache.struts2.interceptor.Interceptor

      `destroy, init`

- - ### Field Detail

    - #### INVALID_TOKEN_CODE

          public static final String INVALID_TOKEN_CODE

      See Also:
        Constant Field Values

  - ### Constructor Detail

    - #### TokenInterceptor

          public TokenInterceptor()

  - ### Method Detail

    - #### setTextProviderFactory

          public void setTextProviderFactory(TextProviderFactory textProviderFactory)

    - #### doIntercept

          protected String doIntercept(ActionInvocation invocation)
                                throws Exception

      Description copied from class: `MethodFilterInterceptor`
      Subclasses must override to implement the interceptor logic.
      Specified by:
        `doIntercept` in class `MethodFilterInterceptor`
      Parameters:
        `invocation` - the action invocation
      Returns:
        the result of invocation
      Throws:
        `Exception` - in case of any errors
      See Also:
        `MethodFilterInterceptor.doIntercept(com.opensymphony.xwork2.ActionInvocation)`

    - #### handleToken

          protected String handleToken(ActionInvocation invocation)
                                throws Exception

      Throws:
        `Exception`

    - #### handleToken

          protected String handleToken(ActionInvocation invocation)
                                throws Exception

      Throws:
        `Exception`

    - #### handleInvalidToken

          protected String handleInvalidToken(ActionInvocation invocation)
                                       throws Exception

      Throws:
        `Exception`

    - #### handleInvalidToken

          protected String handleInvalidToken(ActionInvocation invocation)
                                       throws Exception

      Determines what to do if an invalid token is provided. If the action implements `ValidationAware`
      Parameters:
        `invocation` - the action invocation where the invalid token failed
      Returns:
        the return code to indicate should be processed
      Throws:
        `Exception` - when any unexpected error occurs.

    - #### getErrorMessage

          protected String getErrorMessage(ActionInvocation invocation)

    - #### getErrorMessage

          protected String getErrorMessage(ActionInvocation invocation)

    - #### handleValidToken

          protected String handleValidToken(ActionInvocation invocation)
                                     throws Exception

      Throws:
        `Exception`

    - #### handleValidToken

          protected String handleValidToken(ActionInvocation invocation)
                                     throws Exception

      Called when a valid token is found. This method invokes the action by can be changed to do something more interesting.
      Parameters:
        `invocation` - the action invocation
      Returns:
        invocation result
      Throws:
        `Exception` - when any unexpected error occurs.

Copyright © 2000–2026 Apache Software Foundation. All rights reserved.