lukaszlenart opened a new pull request, #318: URL: https://github.com/apache/struts-site/pull/318
Adds a short **Security Considerations** section to the Chaining Interceptor page covering the design-level guidance around action chaining that is currently not written down anywhere on the site. Because chaining populates the target action implicitly from the value stack, the guidance is: - keep authorization, trust, identity and approval state out of the chain — re-derive it from the session or security context in the target action; - prefer avoiding chaining where practical, since it couples actions and hides the target's data path; - if chaining is required, narrow what is copied via `org.apache.struts2.Unchainable` or the interceptor's `includes` / `excludes` parameters; - do not expose a public setter on the target for state that must not be settable from outside that action. It also cross-links the existing "Where authorization applies" overview on the `@StrutsParameter` page. Docs-only. This is ordinary design guidance and deliberately does not restate the `struts.chaining.requireAnnotations` mechanism already documented in #303, nor does it change any default or behaviour claim. Framework names (`Unchainable`, `includes`/`excludes`) were checked against `apache/struts` main. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
