According to the documentation: In Struts 2.3, an option was added to restrict the methods that DMI can invoke.
First, set the attribute strict-method-invocation="true" on your <package>
element. Then specify <allowed-methods> as a comma-separated list of method
names in your <action>. A request for any other method will be rejected. (If you
specify a method attribute for your action, you do not need to list it in
<allowed-methods>.)

It's not defined what will happen if a method attribute for the action is
specified (wildcard or not) and <allowed-methods> is also specified.

Can you make the documentation of <allowed-methods> and strict-method-invocation
more clear?

What does strict-method-invocation mean: set to true: -method attribute must be specified or allowed-methods must be defined?

set to false: -method attribute need not be specified and allowed-methods need not be defined.
But what will happen if i add allowed-methods? (is the invocation limited to
these methods?)

What does <allowed-methods> mean: If a method attribute and allowed-methods is specified, will allowed-methods be
respected (this makes only sense if the method attribute contains a wildcard)?

From my point of view <allowed-methods> should be treated independently of
strict-method-invocation:

allowed_method: if specified, it should be respected, even if
strict-method-invocation is turned off. strict-method-invocation: if turned on, methods must be specified (by
method-attribute or allowed_method)

Thanks Andi