判断用户是否已登录，未登录用户禁止访问任何页面或action，自动跳转到登录页面

实现的功能：判断用户是否已登录，未登录用户禁止访问任何页面或action，自动跳转到登录页面。
比较好的做法是不管什么人都不能直接访问jsp页面，要访问就通过action，这样就变成了一个实实在在的权限控制了。
那么就有3种方法可以解决楼主的问题
1，直接使用filter
2，直接使用webwork的interceptor，
3，将action交给spring管理，使用spring的Aop机制

让用户可以直接访问jsp本来就违反了mvc的本意了
1 直接使用filter
web.xml配置

Xml代码

1. <filter>   
2.     <filter-name>SecurityServlet</filter-name>   
3.     <filter-class>com.*.web.servlet.SecurityServlet</filter-class>   
4. </filter>   
5. <filter-mapping>   
6.     <filter-name>SecurityServlet</filter-name>   
7.     <url-pattern>*.jsp</url-pattern>   
8. </filter-mapping>   
9. <filter-mapping>   
10.     <filter-name>SecurityServlet</filter-name>   
11.     <url-pattern>*.do</url-pattern>   
12. </filter-mapping>  

 <filter>  
	    <filter-name>SecurityServlet</filter-name>  
	    <filter-class>com.*.web.servlet.SecurityServlet</filter-class>  
	</filter>  
	<filter-mapping>  
	    <filter-name>SecurityServlet</filter-name>  
	    <url-pattern>*.jsp</url-pattern>  
	</filter-mapping>  
	<filter-mapping>  
	    <filter-name>SecurityServlet</filter-name>  
	    <url-pattern>*.do</url-pattern>  
	</filter-mapping> 

SecurityServlet 类

Java代码

1. package com.*.web.servlet; 
2.  
3. import java.io.IOException; 
4. import javax.servlet.Filter; 
5. import javax.servlet.FilterChain; 
6. import javax.servlet.FilterConfig; 
7. import javax.servlet.ServletException; 
8. import javax.servlet.ServletRequest; 
9. import javax.servlet.ServletResponse; 
10. import javax.servlet.http.HttpServlet; 
11. import javax.servlet.http.HttpServletRequest; 
12. import javax.servlet.http.HttpServletResponse; 
13. import javax.servlet.http.HttpSession; 
14. public class SecurityServlet extends HttpServlet implements Filter { 
15.     private static final long serialVersionUID = 1L; 
16.  
17.     public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) throws IOException, ServletException { 
18.            HttpServletRequest request=(HttpServletRequest)arg0;    
19.            HttpServletResponse response  =(HttpServletResponse) arg1;     
20.            HttpSession session = request.getSession(true);      
21.            String usercode = (String) request.getRemoteUser();// 登录人 
22.            String user_role = (String)session.getAttribute("role");//登录人角色 
23.            String url=request.getRequestURI();    
24.            if(usercode==null || "".equals(usercode) || user_role == null || "".equals(user_role)) {       
25.                 //判断获取的路径不为空且不是访问登录页面或执行登录操作时跳转    
26.                 if(url!=null && !url.equals("") && ( url.indexOf("Login")<0 && url.indexOf("login")<0 )) {    
27.                     response.sendRedirect(request.getContextPath() + "/login.jsp");    
28.                     return ;    
29.                 }               
30.             }    
31.             arg2.doFilter(arg0, arg1);    
32.             return;    
33.     } 
34.     public void init(FilterConfig arg0) throws ServletException { 
35.     } 
36.  
37. } 

package com.*.web.servlet;

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
public class SecurityServlet extends HttpServlet implements Filter {
	private static final long serialVersionUID = 1L;

	public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) throws IOException, ServletException {
	  	   HttpServletRequest request=(HttpServletRequest)arg0;   
		   HttpServletResponse response  =(HttpServletResponse) arg1;    
		   HttpSession session = request.getSession(true);     
		   String usercode = (String) request.getRemoteUser();// 登录人
		   String user_role = (String)session.getAttribute("role");//登录人角色
		   String url=request.getRequestURI();   
		   if(usercode==null || "".equals(usercode) || user_role == null || "".equals(user_role)) {      
	            //判断获取的路径不为空且不是访问登录页面或执行登录操作时跳转   
	            if(url!=null && !url.equals("") && ( url.indexOf("Login")<0 && url.indexOf("login")<0 )) {   
	                response.sendRedirect(request.getContextPath() + "/login.jsp");   
	                return ;   
	            }              
	        }   
            arg2.doFilter(arg0, arg1);   
            return;   
	}
	public void init(FilterConfig arg0) throws ServletException {
	}

}

配置中的filter-mapping，定义的是需过滤的请求类型，上面的配置即过滤所有对jsp页面和action的请求。过滤器的实现与struts2、spring框架无关，在用户请求被相应前执行，在过滤器中，可使用response.sendRedirect("")等方法

跳转到需要的链接，如登录页面、错误页面等，不需要跳转时，arg2.doFilter(arg0, arg1);即可继续执行用户的请求。注意使用filter时避免连续两次跳转，否则会报java.lang.IllegalStateException错误，具体配置方法网上有，除非必要，不建议使用/*(过滤所有访问)的配置方式，这样配置，图片、js文件、css文件等访问都会被过滤


2 Spring拦截

Spring配置

Xml代码

1. <bean id="springSessionInterceptor" class="com.*.web.servlet.SpringLoginInterceptor" > 
2.      </bean> 
3. <bean id="autoPorxyFactoryBean1" 
4.         class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator"> 
5.         <property name="interceptorNames"> 
6.             <list> 
7.                 <value>springLoginInterceptor</value> 
8.             </list> 
9.         </property> 
10.         <property name="beanNames" > 
11.         <list> 
12.             <value>*Controller</value> 
13.             </list> 
14.         </property> 
15.     </bean> 

<bean id="springSessionInterceptor" class="com.*.web.servlet.SpringLoginInterceptor" >
	 </bean>
<bean id="autoPorxyFactoryBean1"
		class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator">
		<property name="interceptorNames">
			<list>
				<value>springLoginInterceptor</value>
			</list>
		</property>
		<property name="beanNames" >
		<list>
			<value>*Controller</value>
			</list>
		</property>
	</bean>

SpringLoginInterceptor实现类

Java代码

1. package com.web.servlet; 
2.  
3. import javax.servlet.http.HttpServletRequest; 
4. import javax.servlet.http.HttpServletResponse; 
5. import javax.servlet.http.HttpSession; 
6.  
7. import org.aopalliance.intercept.MethodInterceptor; 
8. import org.aopalliance.intercept.MethodInvocation; 
9. import org.apache.log4j.Logger; 
10. import org.apache.struts.action.ActionMapping; 
11.  
12. public class SpringLoginInterceptor implements MethodInterceptor { 
13.     private static final Logger log = Logger 
14.     .getLogger(SpringLoginInterceptor .class); 
15.  
16.     @Override 
17.     public Object invoke(MethodInvocation invocation) throws Throwable { 
18.         log.info("拦截开始！"); 
19.         Object[] args = invocation.getArguments();   
20.         HttpServletRequest request = null; 
21.         HttpServletResponse response = null; 
22.         ActionMapping  mapping = null; 
23.         for (int i = 0 ; i < args.length ; i++ )    { 
24.           if (args[i] instanceof HttpServletRequest) request = (HttpServletRequest)args[i];    
25.           if (args[i] instanceof HttpServletResponse) response = (HttpServletResponse)args[i];    
26.           if (args[i] instanceof ActionMapping) mapping = (ActionMapping)args[i];    
27.         } 
28.         if (request != null && mapping != null) { 
29.             String url=request.getRequestURI();    
30.             HttpSession session = request.getSession(true);      
31.             String usercode = (String) request.getRemoteUser();// 登录人 
32.             String user_role = (String)session.getAttribute("user_role");//登录人角色 
33.              
34.             if (usercode == null || usercode.equals("")) { 
35.                 if ( url.indexOf("Login")<0 && url.indexOf("login")<0 ) { 
36.                      
37.                     return mapping.findForward("loginInterceptor"); 
38.                 }   
39.                 return invocation.proceed();  
40.             } 
41.             else { 
42.                 return invocation.proceed(); 
43.             } 
44.         } 
45.         else { 
46.             return invocation.proceed(); 
47.         } 
48.     } 
49. } 

 

http://pouyang.iteye.com/blog/695429