title: Role based authorizations to actions in Java/Struts
body: <p>I have an application based on Java/Struts/Hibernate. It has 2 types of users. Admin and Normal user. I created separate Struts pages for both roles and actions.</p>
  
  <p>But when I type admin action in the URL after logged as Normal user, the admin pages are accessible to the normal user. How can I fix this?</p>
  
  <p>i have entered action class of admin and user are in separate in xml pages and are included in the <code>struts.xml</code> page. if you're using the application everything works fine.but consider an action in struts-admin, e.g.: <code>adminHome</code>, it will be <code>localhost:8080/app/adminHome</code>. if a normal user logged in, the URL will be <code>localhost:8080/app/normalHome</code>. But if the normal user types changes <code>normalHome</code> to <code>adminHome</code>, he can access Admin pages.</p>
  
  <p><strong>UPDATE:</strong></p>
  
  <p>As I said earlier, I have admin and user actions in different packages in <code>struts.xml</code>. Can I get its package name in Java? Then I compare with <code>user_role</code> and direct to admin <code>/normal</code> pages..</p>