有的时候用户登陆网站后,长时间未操作或者其他原因导致,session会话失效,需要重新登陆。如果没有考虑这一点,对用户请求只拿ID作为验证的有求必应的话,情况就不太妙了。所以今天来谈谈用户登陆这个行为,为了安全考虑,从用户登陆的这一刻起,只要涉及个人信息的请求都需要验证会话的有效性。在Java中可以设计一个过滤器来过滤请求,只需要两步轻松解决,首写一个过滤器filter然后把它配置在filter的配置文件中,让服务器知道过滤器的存在。
1)编写filter 考虑请求资源地方式为http 请求和ajax请求
package com.sgcc.evoms.filter;
import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import com.sgcc.uap.utils.StringUtils;
/**
* <P>Description:(过滤器,限制未登录的用户访问页面资源)</P>
* @version 1.0
* @author:
* @CreateDate:2014-7-22
* */
public class AuthFilter implements Filter {
public void destroy() {
}
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)resp;
HttpSession session = request.getSession(false);
String requestType = request.getHeader("X-Requested-With");
if(!request.isRequestedSessionIdValid()){
//session过期,转向session过期提示页,最终跳转至登录页面
if(StringUtils.isNotBlank(requestType) && requestType.equalsIgnoreCase("XMLHttpRequest")){
//ajax请求
response.setHeader("sessionstatus", "timeout");
response.sendError(518, "session timeout."); //状态码,自定
return ;
}else{
String login = "/portal/csService/2_login.html";
PrintWriter out = response.getWriter();
out.write("<html><script type='text/javascript'>window.open('"+login+"','_top');</script></html>");
return;
}
}else{
//验证是否已经登录
if (session.getAttribute("mobile")==null){
//尚未登录,跳转至登录页面
//session过期,转向session过期提示页,最终跳转至登录页面
if(StringUtils.isNotBlank(requestType) && requestType.equalsIgnoreCase("XMLHttpRequest")){
//ajax请求
response.setHeader("sessionstatus", "timeout");
response.sendError(518, "session timeout."); //状态码,自定
return ;
}else{
String login = "/portal/csService/2_login.html";
PrintWriter out = response.getWriter();
out.write("<html><script type='text/javascript'>window.open('"+login+"','_top');</script></html>");
return;
}
}
}
//验证Session是否过期
chain.doFilter(request, response);
}
public void init(FilterConfig filterConfig) throws ServletException {
}
}
2)配置bean中添加 filter
<module:servletfilter id="AuthFilterId">
<module:filter-name>AuthFilter</module:filter-name>
<module:filter-class>com.sgcc.evoms.filter.AuthFilter</module:filter-class>
<module:url-pattern>/*/2_loginSucc_5.html</module:url-pattern>
<module:url-pattern>/*/pay_alipayapi.jsp</module:url-pattern>
<module:url-pattern>/*/save</module:url-pattern>
<module:url-pattern>/*/myPasswordMagAction</module:url-pattern>
<module:url-pattern>/*/queryChargeRecord</module:url-pattern>
<module:url-pattern>/*/codecharge</module:url-pattern>
<module:url-pattern>/*/query</module:url-pattern>
<module:url-pattern>/*/querydata</module:url-pattern>
<module:url-pattern>/*/personal.jsp</module:url-pattern>
</module:servletfilter>