org.apache.struts2.action

## Class CspReportAction

- java.lang.Object
- - org.apache.struts2.ActionSupport
  - - com.opensymphony.xwork2.ActionSupport
    - - org.apache.struts2.action.CspReportAction

- All Implemented Interfaces:
    LocaleProvider, TextProvider, Serializable, Action, ServletRequestAware, ServletResponseAware, ValidationAware, Validateable
  Direct Known Subclasses:
    DefaultCspReportAction

      public abstract class CspReportAction
      extends ActionSupport
      implements ServletRequestAware, ServletResponseAware

  An abstract Action that can be extended to process the incoming CSP violation reports. Performs necessary checks to extract the JSON string of the CSP report and make sure it's a valid report. Always returns a 204 response. Override the `processReport(String jsonCspReport)` method to customize how the action processes the CSP report. See `DefaultCspReportAction` for the default implementation. Add the action to the endpoint that is the `reportUri` in the `CspInterceptor` to collect the reports.

           <package name="csp-reports" namespace="/" extends="struts-default">
               <action name="csp-reports" class="org.apache.struts2.action.DefaultCspReportAction">
                   <result type="httpheader">
                       <param name="status">204</param>
                   </result>
               </action>
           </package>

  See Also:
    `DefaultCspReportAction`, Serialized Form

- - ### Nested Class Summary

    - ### Nested classes/interfaces inherited from interface com.opensymphony.xwork2.interceptor.ValidationAware

      `ValidationAware.LegacyAdapter`

  - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `static int` | `DEFAULT_MAX_REPORT_SIZE` Default upper bound, in characters, on the report body accepted by `withServletRequest(javax.servlet.http.HttpServletRequest)`.

    - ### Fields inherited from class org.apache.struts2.ActionSupport

      `container`

    - ### Fields inherited from interface org.apache.struts2.action.Action

      `ERROR, INPUT, LOGIN, NONE, SUCCESS`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `CspReportAction()`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `javax.servlet.http.HttpServletRequest` | `getServletRequest()`
    `void` | `setMaxReportSize(String maxReportSize)` Sets the upper bound, in characters, on an accepted report body.
    `void` | `setServletRequest(javax.servlet.http.HttpServletRequest request)`
    `void` | `withServletRequest(javax.servlet.http.HttpServletRequest request)` Applies the HTTP request object in implementing classes.
    `void` | `withServletResponse(javax.servlet.http.HttpServletResponse response)` Applies the HTTP response object in implementing classes.

    - ### Methods inherited from class org.apache.struts2.ActionSupport

      `addActionError, addActionMessage, addFieldError, clearActionErrors, clearErrors, clearErrorsAndMessages, clearFieldErrors, clearMessages, clone, execute, getActionErrors, getActionMessages, getContainer, getFieldErrors, getFormatted, getLocale, getLocaleProvider, getText, getText, getText, getText, getText, getText, getText, getText, getText, getTextProvider, getTexts, getTexts, hasActionErrors, hasActionMessages, hasErrors, hasFieldErrors, hasKey, input, isValidLocale, isValidLocaleString, pause, setActionErrors, setActionMessages, setContainer, setFieldErrors, toLocale, validate`

    - ### Methods inherited from class java.lang.Object

      `equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

    - ### Methods inherited from interface org.apache.struts2.action.Action

      `execute`

    - ### Methods inherited from interface org.apache.struts2.Validateable

      `validate`

    - ### Methods inherited from interface com.opensymphony.xwork2.interceptor.ValidationAware

      `adapt`

    - ### Methods inherited from interface org.apache.struts2.interceptor.ValidationAware

      `addActionError, addActionMessage, addFieldError, getActionErrors, getActionMessages, getFieldErrors, hasActionErrors, hasActionMessages, hasErrors, hasFieldErrors, setActionErrors, setActionMessages, setFieldErrors`

- - ### Field Detail

    - #### DEFAULT_MAX_REPORT_SIZE

          public static final int DEFAULT_MAX_REPORT_SIZE

      Default upper bound, in characters, on the report body accepted by `withServletRequest(javax.servlet.http.HttpServletRequest)`. CSP violation reports are small JSON documents; anything larger is not treated as a report.
      See Also:
        Constant Field Values

  - ### Constructor Detail

    - #### CspReportAction

          public CspReportAction()

  - ### Method Detail

    - #### setMaxReportSize

          public void setMaxReportSize(String maxReportSize)

      Sets the upper bound, in characters, on an accepted report body. A body exceeding this size is discarded and not passed to `processReport(String)`.

      The value is injected from `struts.csp.report.maxSize` when the action is built, which is before the interceptor stack runs. It is deliberately not an action property: the report body is read by `withServletRequest(HttpServletRequest)`, which the `servletConfig` interceptor invokes ahead of `staticParams` and `params`, so a value applied by either of those would arrive too late to have any effect.

      Parameters:
        `maxReportSize` - maximum accepted report size in characters
      Since:
        6.11.0

    - #### withServletRequest

          public void withServletRequest(javax.servlet.http.HttpServletRequest request)

      Description copied from interface: `ServletRequestAware`
      Applies the HTTP request object in implementing classes.
      Specified by:
        `withServletRequest` in interface `ServletRequestAware`
      Parameters:
        `request` - the HTTP request.

    - #### withServletResponse

          public void withServletResponse(javax.servlet.http.HttpServletResponse response)

      Description copied from interface: `ServletResponseAware`
      Applies the HTTP response object in implementing classes.
      Specified by:
        `withServletResponse` in interface `ServletResponseAware`
      Parameters:
        `response` - the HTTP response.

    - #### setServletRequest

          public void setServletRequest(javax.servlet.http.HttpServletRequest request)

    - #### getServletRequest

          public javax.servlet.http.HttpServletRequest getServletRequest()

Copyright © 2000–2026 Apache Software Foundation. All rights reserved.