拦截器、过滤器及Spring-security权限管理
在com.zhongruan下创建Interceptor包并创建LoginInterceptor.java类
// 定义拦截器类
public class LoginInterceptor implements HandlerInterceptor {
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
// 在拦截点前拦截,如果返回true,则不执行拦截点后的操作
// 获取Session
HttpSession session = request.getSession();
// 获取访问路径
String uri = request.getRequestURI();
// indexOf:求出字符串内路径出现的下标
// ||uri.indexOf("user/doLogin.do") != -1
if(session.getAttribute("userInfo") != null ){
// 登录成功不拦截
return true;
}else{
// 拦截成功
response.sendRedirect(request.getContextPath() + "/user/doLogin.do");
return false;
}
}
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
// 处理过程中拦截
}
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
// 执行完毕后,返回前拦截
}
}
配置spring-mvc.xml
<!-- 4.配置拦截器-->
<mvc:interceptors>
<mvc:interceptor>
<!-- 1.拦截所以请求 -->
<mvc:mapping path="/**"/>
<!-- 2.mvc:exclude-mapping,是一种拦截,可以放行或对某个请求不拦截 -->
<mvc:exclude-mapping path="/user/doLogin.do"/>
<bean class="com.zhongruan.interceptor.LoginInterceptor"></bean>
</mvc:interceptor>
</mvc:interceptors>
同理创建Filter
public class loginFilter implements Filter {
@Override
public void init(FilterConfig filterConfig) throws ServletException {
// 过滤器出生
}
@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
// 区别:Interceptor进入了servlet,所以重写的参数是HttpServletRequest/Response
// Filter没有进入Servlet,ServletRequest
// ServletRequest是接口,HttpServletRequest是实现,这里有些方法是HttpServletRequest
// 1.强制转化
HttpServletRequest request = (HttpServletRequest)servletRequest;
HttpServletResponse response = (HttpServletResponse)servletResponse;
// 2/获取session
HttpSession session = request.getSession();
if(session.getAttribute("userInfo") == null && request.getRequestURI().indexOf("/user/doLogin.do") == -1){
// 没有登录
response.sendRedirect(request.getContextPath() + "/user/doLogin.do");
}else{
// 已经登录了,继续请求下一步操作
filterChain.doFilter(request,response);
}
}
@Override
public void destroy() {
// 过滤器死亡
}
}
配置web.xml
<!-- 配置过滤器 -->
<filter>
<filter-name>SessionFilter</filter-name>
<filter-class>com.zhongruan.filter.LoginFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>SessionFilter</filter-name>
<url-pattern>/pages/*</url-pattern>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
类似于User的创建过程,创建Role
即可完成拦截和过滤非法请求,并返回Login页面
Spring-security
配置spring-security.xml文件
在Impl中实现方法
@Override
public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
//1.查询当前登录的用户信息
UserInfo userInfo = userDao.doLogin(username);
System.out.println("获得的用户线信息为:"+ userInfo);
//2.查询当前用户有多少角色
List<Role> roleList = roleDao.findRoleByUserId(userInfo.getId());
//3.把角色放入用户中
userInfo.setRoleList(roleList);
//4.把查询到的数据user和role数据,给Spring-security中内置对象User管理
User user =new User(userInfo.getUsername(),"{noop}" + userInfo.getPassword(),getAuthority(userInfo.getRoleList()));
return user;
}
private Collection<? extends GrantedAuthority> getAuthority(List<Role> roleList) {
List<SimpleGrantedAuthority> list = new ArrayList<>();
for(Role role:roleList){
list.add(new SimpleGrantedAuthority("ROLE_"+role.getRoleName()));
}
return list;
}
效果图