中软国际day7

拦截器、过滤器及Spring-security权限管理

在com.zhongruan下创建Interceptor包并创建LoginInterceptor.java类

// 定义拦截器类
public class LoginInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
//       在拦截点前拦截，如果返回true,则不执行拦截点后的操作
//        获取Session
        HttpSession session = request.getSession();
//        获取访问路径
        String uri = request.getRequestURI();
//        indexOf：求出字符串内路径出现的下标
//        ||uri.indexOf("user/doLogin.do") != -1
        if(session.getAttribute("userInfo") != null ){
//        登录成功不拦截
            return true;
        }else{
//            拦截成功
            response.sendRedirect(request.getContextPath() + "/user/doLogin.do");
            return false;
        }

    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
//       处理过程中拦截
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
//       执行完毕后，返回前拦截
    }
}

配置spring-mvc.xml

<!-- 4.配置拦截器-->
<mvc:interceptors>
    <mvc:interceptor>
        <!-- 1.拦截所以请求 -->
        <mvc:mapping path="/**"/>
        <!-- 2.mvc:exclude-mapping,是一种拦截，可以放行或对某个请求不拦截 -->
        <mvc:exclude-mapping path="/user/doLogin.do"/>
        <bean class="com.zhongruan.interceptor.LoginInterceptor"></bean>
    </mvc:interceptor>
</mvc:interceptors>

同理创建Filter

public class loginFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
//        过滤器出生
    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {

//        区别：Interceptor进入了servlet，所以重写的参数是HttpServletRequest/Response
//        Filter没有进入Servlet,ServletRequest
//        ServletRequest是接口，HttpServletRequest是实现，这里有些方法是HttpServletRequest

//        1.强制转化
        HttpServletRequest request = (HttpServletRequest)servletRequest;
        HttpServletResponse response = (HttpServletResponse)servletResponse;
//        2/获取session
        HttpSession session = request.getSession();
        if(session.getAttribute("userInfo") == null && request.getRequestURI().indexOf("/user/doLogin.do") == -1){
//            没有登录
            response.sendRedirect(request.getContextPath() + "/user/doLogin.do");

        }else{
//            已经登录了，继续请求下一步操作
            filterChain.doFilter(request,response);
        }



    }

    @Override
    public void destroy() {
//        过滤器死亡
    }
}

配置web.xml

<!-- 配置过滤器 -->
<filter>
  <filter-name>SessionFilter</filter-name>
  <filter-class>com.zhongruan.filter.LoginFilter</filter-class>
</filter>
<filter-mapping>
  <filter-name>SessionFilter</filter-name>
  <url-pattern>/pages/*</url-pattern>
  <url-pattern>*.jsp</url-pattern>
</filter-mapping>

类似于User的创建过程，创建Role

即可完成拦截和过滤非法请求，并返回Login页面

Spring-security

配置spring-security.xml文件

在Impl中实现方法

@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    //1.查询当前登录的用户信息
    UserInfo userInfo = userDao.doLogin(username);
    System.out.println("获得的用户线信息为："+ userInfo);
    //2.查询当前用户有多少角色
    List<Role> roleList = roleDao.findRoleByUserId(userInfo.getId());
    //3.把角色放入用户中
    userInfo.setRoleList(roleList);
    //4.把查询到的数据user和role数据，给Spring-security中内置对象User管理
    User user =new User(userInfo.getUsername(),"{noop}" + userInfo.getPassword(),getAuthority(userInfo.getRoleList()));

    return user;
}

private Collection<? extends GrantedAuthority> getAuthority(List<Role> roleList) {
    List<SimpleGrantedAuthority> list = new ArrayList<>();
    for(Role role:roleList){
        list.add(new SimpleGrantedAuthority("ROLE_"+role.getRoleName()));
    }
    return list;
}

效果图