使用Spring的AOP进行权限管理

对于web（jsp）的权限管理有2种方法，一种是使用过滤器filter，一种是用Spring的拦截器，基于AOP来实现颗粒度更细的权限管理，本文介绍第2种方法：
拦截器需要实现MethodIntercptor接口，该接口来自AOP联盟。
拦截器代码：

package com.cai.oa.tools;

import javax.servlet.http.HttpServletRequest;

import org.aopalliance.intercept.MethodInterceptor;
import org.aopalliance.intercept.MethodInvocation;
import org.apache.struts.action.ActionMapping;
import org.springframework.stereotype.Component;

@Component
public class PopedomManagerInterceptor implements MethodInterceptor{

    public Object invoke(MethodInvocation invocation)
          throws Throwable{
         HttpServletRequest request = null;
         ActionMapping mapping = null;

         Object[] args = invocation.getArguments();

         for(int i = 0 ; i < args.length; i++){
             if(args[i] instanceof HttpServletRequest){
                   request = (HttpServletRequest)args[i];
 continue;
             }
             if(args[i] instanceof ActionMapping){
                   mapping = (ActionMapping)args[i];
             }
         }

         if(request.getSession().getAttribute("userInfo") != null){
              return  invocation.proceed();
         }else{
              return mapping.findForward("index");
         }      

    }
}

然后使用BeanNameAutoPoxy为需要进行权限控制的Action生成权限检查：
//拦截器bean

<bean id="popedomManagerInterceptor" class="sharpyuce.PopedomManagerInterceptor" />
//生成自动代理bean
<bean class="org.springframework.aop.framework.autopoxy.BeanNameAutoPoxy">
    <property name="beanNames">
        <list>
             <value>需要进行权限管理的action 例如：/manager</value>
                                       .....................
                                       .....................
       </list>
    </property>
    <property name="interceptorNames">
       <list>
              <value>popedomManagerInterceptor</value>
       </list>
     </property>
</bean>