Spring Filter过滤器,Spring拦截未登录用户权限限制

╰+攻爆jí腚メ 2022-08-06 11:27 173阅读 0赞

实现的功能：判断用户是否已登录，未登录用户禁止访问任何页面或action，自动跳转到登录页面。  
比较好的做法是不管什么人都不能直接访问jsp页面，要访问就通过action，这样就变成了一个实实在在的权限控制了。  
那么就有3种方法可以解决楼主的问题  
1，直接使用filter  
2，直接使用webwork的interceptor，  
3，将action交给spring管理，使用spring的Aop机制  
  
让用户可以直接访问jsp本来就违反了mvc的本意了  
1 直接使用filter  
web.xml配置  
  
<filter>    
        <filter-name>SecurityServlet</filter-name>    
        <filter-class>com.\*.web.servlet.SecurityServlet</filter-class>    
    </filter>    
    <filter-mapping>    
        <filter-name>SecurityServlet</filter-name>    
        <url-pattern>\*.jsp</url-pattern>    
    </filter-mapping>    
    <filter-mapping>    
        <filter-name>SecurityServlet</filter-name>    
        <url-pattern>\*.do</url-pattern>    
    </filter-mapping>  
  
  
SecurityServlet 类  
  
package com.\*.web.servlet;  
  
import java.io.IOException;  
import javax.servlet.Filter;  
import javax.servlet.FilterChain;  
import javax.servlet.FilterConfig;  
import javax.servlet.ServletException;  
import javax.servlet.ServletRequest;  
import javax.servlet.ServletResponse;  
import javax.servlet.http.HttpServlet;  
import javax.servlet.http.HttpServletRequest;  
import javax.servlet.http.HttpServletResponse;  
import javax.servlet.http.HttpSession;  
public class SecurityServlet extends HttpServlet implements Filter \{  
    private static final long serialVersionUID = 1L;  
  
    public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) throws IOException, ServletException \{  
             HttpServletRequest request=(HttpServletRequest)arg0;    
           HttpServletResponse response  =(HttpServletResponse) arg1;      
           HttpSession session = request.getSession(true);      
           String usercode = (String) request.getRemoteUser();// 登录人  
           String user\_role = (String)session.getAttribute("role");//登录人角色  
           String url=request.getRequestURI();    
           if(usercode==null || "".equals(usercode) || user\_role == null || "".equals(user\_role)) \{        
                //判断获取的路径不为空且不是访问登录页面或执行登录操作时跳转    
                if(url!=null && !url.equals("") && ( url.indexOf("Login")<0 && url.indexOf("login")<0 )) \{    
                    response.sendRedirect(request.getContextPath() + "/login.jsp");    
                    return ;    
                \}                
            \}    
            arg2.doFilter(arg0, arg1);    
            return;    
    \}  
    public void init(FilterConfig arg0) throws ServletException \{  
    \}  
  
\}  
配置中的filter-mapping，定义的是需过滤的请求类型，上面的配置即过滤所有对jsp页面和action的请求。过滤器的实现与struts2、spring框架无关，在用户请求被相应前执行，在过滤器中，可使用response.sendRedirect("")等方法  
  
跳转到需要的链接，如登录页面、错误页面等，不需要跳转时，arg2.doFilter(arg0, arg1);即可继续执行用户的请求。注意使用filter时避免连续两次跳转，否则会报java.lang.IllegalStateException错误，具体配置方法网上有，除非必要，不建议使用/\*(过滤所有访问)的配置方式，这样配置，图片、js文件、css文件等访问都会被过滤  
  
  
2 Spring拦截  
  
Spring配置  
  
<bean id="springSessionInterceptor" class="com.\*.web.servlet.SpringLoginInterceptor" >  
     </bean>  
<bean id="autoPorxyFactoryBean1"  
        class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator">  
        <property name="interceptorNames">  
            <list>  
                <value>springLoginInterceptor</value>  
            </list>  
        </property>  
        <property name="beanNames" >  
        <list>  
            <value>\*Controller</value>  
            </list>  
        </property>  
    </bean>  
SpringLoginInterceptor实现类  
  
package com.web.servlet;  
  
import javax.servlet.http.HttpServletRequest;  
import javax.servlet.http.HttpServletResponse;  
import javax.servlet.http.HttpSession;  
  
import org.aopalliance.intercept.MethodInterceptor;  
import org.aopalliance.intercept.MethodInvocation;  
import org.apache.log4j.Logger;  
import org.apache.struts.action.ActionMapping;  
  
public class SpringLoginInterceptor implements MethodInterceptor \{  
    private static final Logger log = Logger  
    .getLogger(SpringLoginInterceptor .class);  
  
    @Override  
    public Object invoke(MethodInvocation invocation) throws Throwable \{  
        log.info("拦截开始！");  
        Object\[\] args = invocation.getArguments();    
        HttpServletRequest request = null;  
        HttpServletResponse response = null;  
        ActionMapping  mapping = null;  
        for (int i = 0 ; i < args.length ; i++ )    \{  
          if (args\[i\] instanceof HttpServletRequest) request = (HttpServletRequest)args\[i\];    
          if (args\[i\] instanceof HttpServletResponse) response = (HttpServletResponse)args\[i\];    
          if (args\[i\] instanceof ActionMapping) mapping = (ActionMapping)args\[i\];    
        \}  
        if (request != null && mapping != null) \{  
            String url=request.getRequestURI();    
            HttpSession session = request.getSession(true);      
            String usercode = (String) request.getRemoteUser();// 登录人  
            String user\_role = (String)session.getAttribute("user\_role");//登录人角色  
              
            if (usercode == null || usercode.equals("")) \{  
                if ( url.indexOf("Login")<0 && url.indexOf("login")<0 ) \{  
                      
                    return mapping.findForward("loginInterceptor");  
                \}    
                return invocation.proceed();  
            \}  
            else \{  
                return invocation.proceed();  
            \}  
        \}  
        else \{  
            return invocation.proceed();  
        \}  
    \}  
\}  
//================================================================  
在 SPRING 3 MVC 模式下，还可以如下实现：  
public class SecurityFilter extends HandlerInterceptorAdapter  \{  
  
    @Override  
    public boolean preHandle(HttpServletRequest request,  
            HttpServletResponse response, Object handler) throws Exception \{  
        System.out.println("==>>Begin to Filter session====");  
        HttpSession session = request.getSession();  
        String user = (String) session.getAttribute("user");  
        System.out.println("===??Current User=="+user);  
        String curPath=request.getRequestURL().toString();  
        System.out.println("===>> curpath:"+curPath);  
        if (curPath.indexOf("GPS/User/Index")>=0)\{  
            return true;  
        \}  
        if(null==user || "".equals(user))\{  
            return true;  
            /\*\*  
             \* handle session and security if you want.  
             \*/  
            //request.getRequestDispatcher("/index.jsp").forward(request, response);  
        \}          
        return super.preHandle(request, response, handler);  
    \}  
      
      
  
\}  
在 name-servlet.xml spring 的配置文件中注明：  
<bean id="urlMapping" class="org.springframework.web.servlet.mvc.annotation.DefaultAnnotationHandlerMapping" >  
        <property name="interceptors">    
           <list>    
               <bean class="com.ibm.tds.filter.SecurityFilter"/>    
           </list>    
        </property>  
    </bean>  
  
就可以用了。