Struts2使用过滤器和拦截器进行简单权限校验

在一些用到用户登录的目录应该进行权限判断，以防非法登录，我在这里进行一个简单的权限校验。

1.使用过滤器进行/admin 目录下jsp页面的过滤，首先在web.xml进行过滤器配置:

1.     <filter>
2.         <filter-name>access filter</filter-name>
3.         <filter-class>
4.              com.test.news.util.AccessFilter
5.         </filter-class>
6.     </filter>
7.     <filter-mapping>
8.         <filter-name>access filter</filter-name>
9.         <url-pattern>/admin/*</url-pattern>
10.     </filter-mapping>

下面是过滤的实现类:

1. package com.test.news.util;
3. import java.io.IOException;
5. import javax.servlet.Filter;
6. import javax.servlet.FilterChain;
7. import javax.servlet.FilterConfig;
8. import javax.servlet.ServletException;
9. import javax.servlet.ServletRequest;
10. import javax.servlet.ServletResponse;
11. import javax.servlet.http.HttpServletRequest;
12. import javax.servlet.http.HttpServletResponse;
13. import javax.servlet.http.HttpSession;
16. public class AccessFilter implements Filter {
18. /**
19. * @author chaoyin
20. */
21.     
22.     public void destroy() {
24.      }
26.     public void doFilter(ServletRequest arg0, ServletResponse arg1,
27.              FilterChain filterChain) throws IOException, ServletException {
28.          HttpServletRequest request = (HttpServletRequest)arg0;
29.          HttpServletResponse response = (HttpServletResponse)arg1;
30.          HttpSession session = request.getSession();
31.         if(session.getAttribute("user")== null && request.getRequestURI().indexOf("login.jsp")==-1 ){
32.              response.sendRedirect("login.jsp");
33.             return ;
34.          }
35.          filterChain.doFilter(arg0, arg1);
37.      }
39.     public void init(FilterConfig arg0) throws ServletException {
41.      }
43. }

这样/admin 目录下需经过login.jsp这个页面才能正常访问。

2.使用Struts2的拦截器功能进行.action的过滤，主要是校验那些与后台管理相关的action,首先在struts.xml中进行拦截器的配置:

1. <package name="newsDemo" extends="struts-default"
2.         namespace="/admin">
3.         <interceptors>
4.             <interceptor name="auth" class="com.test.news.util.AccessInterceptor" />
5.             <interceptor-stack name="authStack">
6.                 <interceptor-ref name="auth" />
7.             </interceptor-stack>
8.         </interceptors>
9.         <!-- action -->
10.         <action name="newsAdminView!*" class="newsAction"
11.             method="{1}">
12.             <interceptor-ref name="defaultStack"/>
13.             <interceptor-ref name="authStack">
14.             </interceptor-ref>

下面是我实现的Interceptor class:

2. package com.test.news.util;
4. import java.util.Map;
6. import com.opensymphony.xwork2.ActionContext;
7. import com.opensymphony.xwork2.ActionInvocation;
8. import com.opensymphony.xwork2.interceptor.AbstractInterceptor;
9. import com.test.news.action.AdminLoginAction;
11. /**
12. * @author chaoyin
13. */
15. public class AccessInterceptor extends AbstractInterceptor {
17.     private static final long serialVersionUID = -4291195782860785705L;
19.     @Override
20.     public String intercept(ActionInvocation actionInvocation) throws Exception {
21.          ActionContext actionContext = actionInvocation.getInvocationContext();
22.          Map session = actionContext.getSession();
23.         
24.         //except login action
25.          Object action = actionInvocation.getAction();
26.         if (action instanceof AdminLoginAction) {
27.             return actionInvocation.invoke();
28.          }
29.         //check session
30.         if(session.get("user")==null ){
31.             return "logout";
32.          }
33.         return actionInvocation.invoke();//go on
34.      }
36. }