Apache Struts

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

The reference material consulted while preparing these pages is listed in the section bibliography.

Part II covers Apache Struts 7.4.0 (released 2026-10-02), the current line of the action-based MVC framework, running on Apache Tomcat 11.0.26 with Jakarta Servlet 6.1, Jakarta Pages 4.0 and Jakarta Expression Language 6.0 on Java 21; the versions were verified on 2026-10-08, and every example was built into a WAR and run with curl. It builds bookshelf-struts, the Struts variant of the Bookshelf scenario described on the section landing page. Struts views are mostly JSP, so Part I, JSP, EL & JSTL, is the natural prerequisite, together with Servlet Fundamentals.

Diagram of the two Bookshelf applications on Tomcat 11. The browser sends requests either to a front servlet in bookshelf-jsp or to the Struts filter in bookshelf-struts. Both call the same service and repository, which read and write the data store, and then forward to a JSP view under WEB-INF that renders the HTML response back to the browser.
Figure 1. Part II builds the lower variant of the Bookshelf: the Struts filter runs the interceptors and the action, and a result dispatches to the JSP view

What Part II covers

Struts installs itself in a web application as one servlet filter. The filter asks the action mapper which action a URL names, an action proxy builds the invocation, a stack of interceptors wraps the action (parameter binding, validation, i18n, file upload, security), the action returns a string, and a result renders the response. Part II follows that sequence: the architecture and struts.xml, then actions, results and interceptors, then everything that reads and writes data (OGNL and the ValueStack, @StrutsParameter, conversion, validation, i18n), then tags, themes and views, the plugins, and finally testing, security, Struts 1 and deployment. Struts 7 is a security-sensitive framework: parameter injection and OGNL have a long bulletin history, so every page states the secure default and Security Bulletins lists the bulletins as a timeline.

Versions and end of life

Table 1. Struts release lines (verified 2026-10-08)
Line Status Facts

7.x

Current; 7.4.0 released 2026-10-02

7.0.0 was released on 2024-12-19. Java 17 and Servlet 6 or later; the org.apache.struts2 packages replace com.opensymphony.xwork2, and @StrutsParameter is mandatory for request parameter binding. Struts 7 runs on Tomcat 10.1 and 11

6.x

Maintained; 6.12.0 released 2026-10-02

6.0.0 was released on 2022-06-06. The javax.* namespace and the com.opensymphony.xwork2 packages, as in 2.5

2.5.x

End of life since 2023-10-30

The last release is 2.5.33; the line that moved StrutsPrepareAndExecuteFilter to the org.apache.struts2.dispatcher.filter package

2.3.x

End of life since 2019-09-12

The Java EE era line of Struts 2

1.x

End of life since 2013-04-05

Struts Classic, a different framework (the last release is 1.3.10); see Struts 1 (Classic) & Migration

Source: Apache Struts — End of Life versions, Apache Struts — Releases, Announcements 2026

The upgrade path between the lines, one line at a time, is on What’s Changed & Migration.

Maven coordinates

The struts2-bom manages the version of struts2-core and of every plugin that exists at the same version, so a project states the Struts version once and declares the artifacts without versions. There is no Maven archetype for Struts 7: the archetypes stop at 6.0.0.

The Struts 7 dependencies of bookshelf-struts
<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>org.apache.struts</groupId>
            <artifactId>struts2-bom</artifactId>
            <version>7.4.0</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>

<dependencies>
    <dependency>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-core</artifactId>
    </dependency>
    <dependency>
        <groupId>org.apache.struts</groupId>
        <artifactId>struts2-convention-plugin</artifactId>
    </dependency>
</dependencies>

Source: struts2-bom 7.4.0 on Maven Central, Struts — How To Create A Struts Web Application

The Servlet, Pages and EL APIs are provided by the container and JSTL is added to the WAR as in the Maven coordinates of Part I. The plugin artifacts follow the pattern struts2-<name>-plugin (struts2-json-plugin, struts2-rest-plugin, struts2-spring-plugin, struts2-tiles-plugin, struts2-bean-validation-plugin, struts2-cdi-plugin); the BOM of 7.4.0 also lists a few plugins that are not published at 7.4.0, which Other Plugins lists.

Reading order

  1. Foundations: start with the architecture and the request lifecycle, then Struts Getting Started, struts.xml, packages, actions, wildcards, results, exceptions and interceptors.

  2. Data, parameters and validation: the ValueStack and OGNL first, then @StrutsParameter, conversion, validation, i18n, ModelDriven, chaining, file upload and tokens.

  3. Tags and views: the generic and UI tags, themes, FreeMarker and Velocity, and Tiles.

  4. Integrations and plugins: Convention, Spring, CDI, JSON, REST and the rest of the plugins.

  5. Quality and operations: testing, devMode and debugging, security hardening, security headers, the bulletins, Struts 1 and deployment.

mindmap root((Apache Struts)) Foundations Request lifecycle struts.xml Actions and results Interceptors Data and validation OGNL and ValueStack StrutsParameter Type conversion Validation i18n File upload Tags and views Struts tags Themes FreeMarker and Velocity Tiles Plugins Convention Spring and CDI JSON and REST Operations Testing Security Struts 1 Deployment

What’s covered

Foundations

Data, parameters and validation

Tags and views

Integrations and plugins

Quality and operations

References