springmvc的拦截器实现基于url的拦截（权限管理）

使用基于url拦截的权限管理方式，实现起来比较简单，不依赖框架，使用web提供filter就可以实现。

问题：

需要将所有的url全部配置起来，有些繁琐，不易维护，url(资源)和权限表示方式不规范。

所以才有了shirohttps://blog.csdn.net/qq_38704184/article/details/83902113

1.web.xml

<servlet>
  	<servlet-name>springmvc</servlet-name>
  	<servlet-class>
org.springframework.web.servlet.DispatcherServlet
  	</servlet-class>
  	<init-param>
  		<param-name>contextConfigLocation</param-name>
  		<param-value>classpath:conf/spring-*.xml</param-value>
  	</init-param>
  	<load-on-startup>1</load-on-startup>
  </servlet>
  <servlet-mapping>
  	<servlet-name>springmvc</servlet-name>
  	<url-pattern>*.action</url-pattern>
  </servlet-mapping>
  <!-- post乱码处理 -->
	<filter>
		<filter-name>CharacterEncodingFilter</filter-name>
		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
		<init-param>
			<param-name>encoding</param-name>
			<param-value>utf-8</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>CharacterEncodingFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

2.spring-mvc.xml

<!-- handlermapping等组件 -->
<mvc:annotation-driven/>
<!-- 开启组件扫描,扫描Controller,Service -->
<context:component-scan base-package=""/>
<!-- 配置视图解析器 要求将jstl的包加到classpath -->
	<!-- ViewResolver -->
	<bean
		class="org.springframework.web.servlet.view.InternalResourceViewResolver">
		<property name="prefix" value="/WEB-INF/jsp/" />
		<property name="suffix" value=".jsp" />
	</bean>

	<!-- 配置拦截器 -->
	<mvc:interceptors>
		<!-- 用户认证拦截 -->
		<mvc:interceptor>
		<!-- 拦截所有 -->
		<mvc:mapping path="/**"/>
		<bean class="com.xx.interceptor.LoginInterceptor"></bean>
		</mvc:interceptor>
	
	
	</mvc:interceptors>

3.spring-mybatis.xml

<!-- 定义DataSource -->
<bean id="dbcp" 
class="org.apache.tomcat.dbcp.dbcp.BasicDataSource">
	<property name="username" value="root">
	</property>
	<property name="password" value="123456">
	</property>
	<property name="driverClassName" 
		value="com.mysql.jdbc.Driver">
	</property>
	<property name="url" 
	  value="jdbc:mysql:///shiro?useUnicode=true&amp;characterEncoding=utf8">
	</property>
</bean>
<!-- 定义SqlSessionFactoryBean -->
<bean id="ssf" 
class="org.mybatis.spring.SqlSessionFactoryBean">
	<!-- 指定dataSource -->
	<property name="dataSource" ref="dbcp">
	</property>
	<!-- 指定SQL定义文件 -->
	<property name="mapperLocations" 
	  value="com.xx.mapper.*.xml"/>
</bean>
<!-- 定义MapperScanner -->
<bean id="mapperScanner" 
class="org.mybatis.spring.mapper.MapperScannerConfigurer">
	<!-- 指定Mapper接口 -->
	<property name="basePackage" 
		value="com.xx.mapper">
	</property>
	<!-- 指定SqlSessionFactory,省略 -->
</bean>

4.核心操作

public class LoginInterceptor implements HandlerInterceptor{

	public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
			throws Exception {
		//在执行handler之前执行，用于用户认证、用户授权校验
		//得到请求的URL
		String url = request.getRequestURI();
		//判断是否是公开地址
		//实际开发的时候公开访问地址放在配置文件中
		//读取配置文件中的公开URL
		List<String> list = ResourcesUtil.gekeyList("commonURL");
		//遍历公开地址，如果是公开地址就放行
		for (String open_url : list) {
			if(url.indexOf(open_url)>=0) {
				return true;
			}
		}
		//从配置文件中获取公用的访问地址
		List<String> public_urls = ResourcesUtil.gekeyList("publicURL");
		//遍历公开地址，如果是公开地址就放行
		for (String public_url : public_urls) {
			if(url.indexOf(public_url)>=0) {
				//若果是公用地址就放行
				return true;
			}
		}
		//判断用户身份是否在Session中
		HttpSession session = request.getSession();
		ActiveUser activeUser = (ActiveUser) session.getAttribute("activeUser");
		//如果用户存在就放行
		if(activeUser != null) {
			//从Session中取出权限范围的URL
			List<SysPermission> permissions = activeUser.getPermissions();
			for (SysPermission sysPermission : permissions) {
				String url2 = sysPermission.getUrl();
				if(url.indexOf(url2)>=0) {
					//如果是权限允许的范围的地址就放行
					return true;
				}
			}
		}
		//执行到这里，跳转到登录界面，用户进行认证
		request.getRequestDispatcher("/WEB-INF/jsp/refuse.jsp").forward(request, response);
		return false;
	}

	public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
			ModelAndView modelAndView) throws Exception {
		// TODO Auto-generated method stub
		
	}

	public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
			throws Exception {
		// TODO Auto-generated method stub
		
	}

}

要知道当发出请求的一瞬间，请求首先进入的是拦截器，之后再进入所谓的方法体中

5.处理请求

@RequestMapping("/login")
	public String login(HttpSession session,String usercode,String password,String randomcode) throws Exception {
		//获取验证码
		String validateCode = 
				(String) session.getAttribute("validateCode");
		if(!randomcode.equals(validateCode)) {
			return "redirect:/loginPage.action";
		}
		//调用Service方法执行登录认证
		ActiveUser user = sysService.authenticat(usercode, password);
		session.setAttribute("activeUser", user);
		return "redirect:/first.action";
	}

不在多解释，不在多书写，看的人没几个（行内人一看代码就明白意思）