According to the documentation: In Struts 2.3, an option was added to restrict the methods that DMI can invoke. First, set the attribute strict-method-invocation="true" on your <package> element. Then specify <allowed-methods> as a comma- separated list of method names in your <action>. A request for any other method will be rejected. (If you specify a method attribute for your action, you do not need to list it in <allowed-methods>.)

It's not defined what will happen if a method attribute for the action is specified (wildcard or not) and <allowed-methods> is also specified.

Can you make the documentation of <allowed-methods> and strict- method-invocation more clear?

What does strict-method-invocation mean: set to true: -method attribute must be specified or allowed-methods must be defined?

set to false: -method attribute need not be specified and allowed-methods need not be defined. But what will happen if i add allowed-methods? (is the invocation limited to these methods?)

What does <allowed-methods> mean: If a method attribute and allowed-methods is specified, will allowed-methods be respected (this makes only sense if the method attribute contains a wildcard)?

From my point of view <allowed-methods> should be treated independently of strict-method-invocation:

allowed_method: if specified, it should be respected, even if strict- method-invocation is turned off. strict-method-invocation: if turned on, methods must be specified (by method-attribute or allowed_method)

Thanks Andi