过滤器防止地址栏注入登录

继承的是OncePerRequestFilter，在spring中默认继承的也是OncePerRequestFilter，他能够确保在一次请求只通过一次filter，而不需要重复执行

package org.ems.filter;

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.web.filter.OncePerRequestFilter;

public class LoginFilter extends OncePerRequestFilter {

 @Override
 protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
   throws ServletException, IOException {

  //添加不过滤的URI
//  String[] notFilter = new String[]{"login.action","login2.jsp",".css",".js",".png",".json",".html",".jpg"};
//  String[] notFilter = new String[]{"login.action","employee/login2.jsp",".css",".js",".png",".jpg",".html",".ico"};
  String notFilter1 = "login.jsp";
  String notFilter2 = "login.action";
  
  //获得URI
  String url = request.getRequestURI();
  System.out.println(url);
  
  Boolean doFilter = true;
//  for(int i=0;i<notFilter.length;i++){
//   if(url.contains(notFilter[i])){
//    doFilter=false;
//   }
//  }
  if(url.contains(notFilter1)||url.contains(notFilter2)){
   doFilter = false;
  }
  
  if(doFilter){
   Object obj = request.getSession().getAttribute("employee");
   if(obj==null){
    response.sendRedirect(request.getContextPath()+"/employee/login.jsp");
    return;
   }else{
    chain.doFilter(request, response);
   }
  }else{
   chain.doFilter(request, response);
  }
  
 }

}

<filter>
  <filter-name>loginFilter</filter-name>
  <filter-class>org.ems.filter.LoginFilter</filter-class>
 </filter>
 <filter-mapping>
  <filter-name>loginFilter</filter-name>
  <url-pattern>/*</url-pattern>
 </filter-mapping>