使用Filter实现登录权限验证

用户在访问任何界面时，会查询用户是否登录过，如果登录过则可以直接访问，没有登录的话跳到登录界面

web.xml配置过滤器

  <filter>
  <filter-name>myFilter</filter-name>
  <filter-class>com.zyk.ctrl.MyFilter</filter-class>
  <!-- 配置初始化参数，指明再没有登录的情况下放行的资源 -->
  <init-param>
  //初始化参数名
  		<param-name>letgo</param-name>
  		//初始化参数值
  		<param-value>/login.jsp;/loginServlet;/css;/images;/js</param-value>
  </init-param>
  </filter>
  <filter-mapping>
  //必须和上面的一样
  <filter-name>myFilter</filter-name>
  //过滤所有
  <url-pattern>/*</url-pattern>
  
  </filter-mapping>

MyFilter.java

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

/**
 * Servlet Filter implementation class MyFilter
 */

public class MyFilter implements Filter {
//定义一个存放放行资源路径的数组
	private static String[] paths;

	/**
	 * Default constructor.
	 */
	public MyFilter() {
		// TODO Auto-generated constructor stub
	}

	/**
	 * @see Filter#destroy()
	 */
	public void destroy() {
		// TODO Auto-generated method stub
	}

	/**
	 * @see Filter#doFilter(ServletRequest, ServletResponse, FilterChain)
	 */
	public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		HttpServletRequest request = (HttpServletRequest) req;
		HttpServletResponse response = (HttpServletResponse) res;
			//获取资源URI路径
			String path = request.getServletPath();
			
			for (int i = 0; i < paths.length; i++) {
				//如果当前请求的URI路径是要放行的资源中的一个，放行
				if (path.startsWith(paths[i])) {
					chain.doFilter(request, response);
					return;//放行之后返回，避免程序继续执行，往下面执行是拦截的代码
				}
				
			}
			//判断用户是否已经登录，如果登录则放行资源，否则重定向到登录界面
			String name = (String) request.getSession().getAttribute("name");
			//如果name为空，则证明用户没有登录过，跳转到登录界面
			if (name==null) {
				request.getSession().setAttribute("error", "尚未登录，请登录");
				response.sendRedirect("/BookManagerSystem/login.jsp");
				return;
				
			}
			//剩下的情况为已登录，放行
			chain.doFilter(request, response);
			
		
		
			
		
		

	}

	/**
	 * @see Filter#init(FilterConfig)
	 */
	public void init(FilterConfig fConfig) throws ServletException {
		//读取初始化参数，得到放行的资源
		String initParameter = fConfig.getInitParameter("letgo");
		paths =initParameter.split(";");
	}

}

Servlet.java部分代码

if ("login".equals(action)) {
			String name = request.getParameter("name");
			String pwd = request.getParameter("pwd");
			User user = new User(name, pwd);

			if (dao.ValidateLogin(user)) {
			//ValidateLogin为登录验证方法，如果验证成功，则设置一个属性名为“name”值为用户名的session，用于Myfilter验证是否登录过
				request.getSession().setAttribute("name", name);
				response.sendRedirect("admin/admin.jsp");

			} else {
				request.getSession().setAttribute("error", "账号或者密码错误");
				response.sendRedirect("login.jsp");
			}

		}