<package name="struts2" extends="struts-default">
        <interceptors>
            <!-- 定义一个包含权限控制的拦截器栈 -->
            <interceptor name="authority"
                class="com.pde.web.common.AuthorityInterceptor" />

            <!-- 定义一个包含权限控制的拦截器栈 -->
            <interceptor-stack name="mydefault">
                <interceptor-ref name="authority" />
                <interceptor-ref name="defaultStack" />
            </interceptor-stack>
            <!-- 定义一个包含权限控制和tokenSession的拦截器栈 -->
            <interceptor-stack name="mysession">
                <interceptor-ref name="authority" />
                <interceptor-ref name="tokenSession"/>
            </interceptor-stack>
        </interceptors>

        <!-- 定义默认拦截器 -->
        <default-interceptor-ref name="mydefault" />

        <!-- 定义全局处理结果 -->
        <global-results>
            <result name="loginout">/page/loginout.jsp</result>
        </global-results>
        
        <action name="usermenu" class="UseMenuAction">
            <result name="sucess">/page/common/left.jsp</result>
        </action>
        <action name="sysuser" class="SysUserAction">
            <interceptor-ref name="mysession">
                <param name="includeMethods">save</param> 
            </interceptor-ref>
            <interceptor-ref name="mydefault"/>
            <result name="sucess">/page/SysUserList.jsp</result>
            <result name="edit">/page/SysUserEdit.jsp</result>
            <result name="input">/page/SysUserEdit.jsp</result>
            <result name="changpwd">/page/ChangePwd.jsp</result>
        </action>
   </package>

public class AuthorityInterceptor extends MethodFilterInterceptor{
    private static final long serialVersionUID = 1358600090729208361L;
    public String doIntercept(ActionInvocation actionInvocation) throws Exception{
        ActionContext ctx=actionInvocation.getInvocationContext();

        Map session=ctx.getSession();
        SysUser user=(SysUser)session.get("SysUser");
        if(user!=null){
            return actionInvocation.invoke();
        }
        ctx.put("tip","您还没有登录，请登陆系统");
        return "loginout";
    }
}

<result name="invalid.token">/page/invalidToken.jsp</result>