java权限拦截器-CSDN博客

本文链接：https://blog.csdn.net/ardo_pass/article/details/78703195

本文介绍了一个基于Spring MVC的权限拦截器实现方式。该拦截器能够根据用户的会话信息及资源访问权限来决定是否允许访问特定资源。此外，还提供了如何在Spring配置文件中启用此拦截器的方法。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

SecurityInterceptor.java

package light.mvc.framework.interceptors;

import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import light.mvc.framework.constant.GlobalConstant;
import light.mvc.framework.tool.SessionInfo;

import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

/**
 * 权限拦截器
 * 
 */
public class SecurityInterceptor implements HandlerInterceptor {

	private List<String> excludeUrls;// 不需要拦截的资源

	public List<String> getExcludeUrls() {
		return excludeUrls;
	}

	public void setExcludeUrls(List<String> excludeUrls) {
		this.excludeUrls = excludeUrls;
	}

	/**
	 * 完成页面的render后调用
	 */
	@Override
	public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object object,
			Exception exception) throws Exception {

	}

	/**
	 * 在调用controller具体方法后拦截
	 */
	@Override
	public void postHandle(HttpServletRequest request, HttpServletResponse response, Object object,
			ModelAndView modelAndView) throws Exception {

	}

	/**
	 * 在调用controller具体方法前拦截
	 */
	@Override
	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object object) throws Exception {
		String requestUri = request.getRequestURI();
		String contextPath = request.getContextPath();
		String url = requestUri.substring(contextPath.length());
		SessionInfo sessionInfo = (SessionInfo) request.getSession().getAttribute(GlobalConstant.SESSION_INFO);
		//判断是否包含在菜单权限里

		if ((url.indexOf("/admin/") > -1) || excludeUrls.contains(url)) {// 如果要访问的资源是不需要验证的
			return true;
		}
		
		if ((sessionInfo == null) || (sessionInfo.getId() == null)) {// 如果没有登录或登录超时
			request.setAttribute("msg", "您还没有登录或登录已超时，请重新登录，然后再刷新本功能！");
			request.getRequestDispatcher("/error/noSession.jsp").forward(request, response);
			return false;
		}
		
		if(!sessionInfo.getAccessAllList().contains(url)){
			return true;
		}

		if (!sessionInfo.getAccessList().contains(url)) {// 如果当前用户没有访问此资源的权限
			request.setAttribute("msg", "您没有访问此资源的权限！<br/>请联系超管赋予您<br/>[" + url + "]<br/>的资源访问权限！");
			request.getRequestDispatcher("/error/noSecurity.jsp").forward(request, response);
			return false;
		}

		return true;
	}
}

spring-mvc.xml中增加配置

<!-- 拦截器 -->
	<mvc:interceptors>
		<mvc:interceptor>
			<mvc:mapping path="/**" />
			<bean class="light.mvc.framework.interceptors.SecurityInterceptor">
				<!-- 不需要权限验证的地址 -->
				<property name="excludeUrls">
					<list>
						<value>/access/tree</value><!-- 首页左侧功能菜单 -->
					</list>
				</property>
			</bean>
		</mvc:interceptor>
	</mvc:interceptors>