对于web(jsp)的权限管理有2种方法,一种是使用过滤器filter,一种是用Spring的拦截器,基于AOP来实现颗粒度更细的权限管理,本文介绍第2种方法:
拦截器需要实现MethodIntercptor接口,该接口来自AOP联盟。
拦截器代码:
然后使用BeanNameAutoPoxy为需要进行权限控制的Action生成权限检查:
//拦截器bean
拦截器需要实现MethodIntercptor接口,该接口来自AOP联盟。
拦截器代码:
package com.cai.oa.tools;
import javax.servlet.http.HttpServletRequest;
import org.aopalliance.intercept.MethodInterceptor;
import org.aopalliance.intercept.MethodInvocation;
import org.apache.struts.action.ActionMapping;
import org.springframework.stereotype.Component;
@Component
public class PopedomManagerInterceptor implements MethodInterceptor{
public Object invoke(MethodInvocation invocation)
throws Throwable{
HttpServletRequest request = null;
ActionMapping mapping = null;
Object[] args = invocation.getArguments();
for(int i = 0 ; i < args.length; i++){
if(args[i] instanceof HttpServletRequest){
request = (HttpServletRequest)args[i];
continue;
}
if(args[i] instanceof ActionMapping){
mapping = (ActionMapping)args[i];
}
}
if(request.getSession().getAttribute("userInfo") != null){
return invocation.proceed();
}else{
return mapping.findForward("index");
}
}
}
然后使用BeanNameAutoPoxy为需要进行权限控制的Action生成权限检查:
//拦截器bean
<bean id="popedomManagerInterceptor" class="sharpyuce.PopedomManagerInterceptor" />
//生成自动代理bean
<bean class="org.springframework.aop.framework.autopoxy.BeanNameAutoPoxy">
<property name="beanNames">
<list>
<value>需要进行权限管理的action 例如:/manager</value>
.....................
.....................
</list>
</property>
<property name="interceptorNames">
<list>
<value>popedomManagerInterceptor</value>
</list>
</property>
</bean>