Filter is used as controller in Struts2

Question

In struts2 why is a Filter is used as a controller instead of ActionServlet?

What is the advantage of using a Filter over ActionServlet?

Answer 1

As per Struts2 Budi Karnival struts2 book, There is one distinct advantage of using a filter over a servlet as a controller. With a filter you can conveniently choose to serve all the resources in your application, including static ones.

With a servlet, your controller only handles access to the dynamic part of the application. Note that the url-pattern element in the web.xml file in the previous application is

<servlet> 
  <servlet-name>Controller</servlet-name>
  <servlet-class>...</servlet-class>
</servlet>

<servlet-mapping>
  <servlet-name>Controller</servlet-name>
  <url-pattern>*.action</url-pattern>
</servlet-mapping>

With such a setting, requests for static resources are not handled by the servlet controller, but by the container. You wouldn't want to handle static resources in your servlet controller because that would mean extra work.

A filter is different. A filter can opt to let through requests for static contents. To pass on a request, call the filterChain.doFilter method in the filter's doFilter method.

Consequently, employing a filter as the controller allows you to block all requests to the application, including request for static contents. You will then have the following setting in your deployment descriptor:

<filter>
   <filter-name>filterDispatcher</filter-name>
   <filter-class>...</filter-class>
</filter>
<filter-mapping>
  <filter-name>filterDispatcher</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

Advantage of this filter : One thing for sure, you can easily protect your static files from curious eyes.

The following code will send an error message if a user tries to view a JavaScript file:

public void doFilter(ServletRequest request, ServletResponse response,FilterChain      filterChain) throws IOException, ServletException { 
    HttpServletRequest req = (HttpServletRequest) request; 
HttpServletResponse res = (HttpServletResponse) response; 
String uri = req.getRequestURI(); 
if (uri.indexOf("/css/") != -1 && req.getHeader("referer") == null) { 
    res.sendError(HttpServletResponse.SC_FORBIDDEN);
} else {
    // handle this request
}
 }

It will not protect your code from the most determined people, but users can no longer type in the URL of your static file to view it. By the same token, you can protect your images so that no one can link to them at your expense.

Another advantage :

The introduction of Interceptors in Struts2 framework.It not just reduce our coding effort,but helps us write any code which we would have used filters for coding and necessary change in the web.xml as opposed to Struts1.So now any code that fits better in Filter can now moved to interceptors( which is more controllable than filters), all configuration can be controlled in struts.xml file, no need to touch the web.xml file