JavaEE中Filter实现用户登录拦截

　　实现思路是编写过滤器，如果用户登录之后session中会存一个user。如果未登录就为null，就可以通过过滤器将用户重定向到登陆页面，让用户进行登陆，当然过滤器得判断用户访问的如果是登陆请求需要放行，如果不是就需要进行拦截并进行验证。登陆成功再session存存入user，这样过滤器每次都会通过。

1.首先编写验证登陆的过滤器

package danger.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import danger.bean.sys.User;

/**
 * Servlet Filter implementation class LoginFilter
 */
public class LoginFilter implements Filter {

    /**
     * Default constructor.
     */
    public LoginFilter() {
        // TODO Auto-generated constructor stub
    }

    /**
     * @see Filter#destroy()
     */
    public void destroy() {
        // TODO Auto-generated method stub
    }

    /**
     * @see Filter#doFilter(ServletRequest, ServletResponse, FilterChain)
     */
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        String path = req.getRequestURI();
        System.out.println("reqURL----------" + path);
        // 如果包含login.jsp证明是登陆就放行
        if (path.contains("login") || path.contains("/js/") || path.contains("/image/") || path.contains("/css/")
                || path.contains("message.jsp")|| path.contains("404.jsp")|| path.contains("/images/")) {
            chain.doFilter(request, response); // 放行
            return;
        }
        HttpServletResponse res = (HttpServletResponse) response;
        HttpSession session = req.getSession();
        User user =  (User) session.getAttribute("user");
        // 如果session中存在user证明用户登录，可以放行。否则认为未登陆重定向到login.jsp
        if (user == null) {
            res.sendRedirect(req.getContextPath() + "/login/login.jsp");
        } else {
            System.out.println("user----------"+user);
            chain.doFilter(request, response);
        }

    }

    /**
     * @see Filter#init(FilterConfig)
     */
    public void init(FilterConfig fConfig) throws ServletException {
        // TODO Auto-generated method stub
    }

}

 

 

 　　if (path.contains("login") || path.contains("/js/") || path.contains("/image/") || path.contains("/css/") || path.contains("message.jsp")|| path.contains("404.jsp")|| path.contains("/images/")) { chain.doFilter(request, response); // 放行 return; }  　　　　相当于是对登陆请求以及一些静态资源放行。(可以将一些静态资源放到统一的文件夹下面)

 

 

 2.web.xml进行配置

    <filter>
        <filter-name>loginFilter</filter-name>
        <filter-class>danger.filter.LoginFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>loginFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

 

 3.进行测试:

项目名字为danger。再浏览器访问:http://localhost/danger/

 

控制台打印:

reqURL----------/danger/login/login.jsp
reqURL----------/danger/js/jquery-1.11.js
reqURL----------/danger/controls/login/js/gVerify.js
reqURL----------/danger/controls/login/css/login2.css
reqURL----------/danger/controls/login/js/login.js
reqURL----------/danger/image/logo.png
reqURL----------/danger/controls/login/images/1.jpg

 

 

 页面被送到登陆界面。

 

 

 

4.对登陆的处理:(判断用户名与密码，并在session中添加user属性)

登陆表单(用户名与密码的name与Action的属性名字一样)

                    <form action="<%=path %>/login.action" name="loginform" accept-charset="utf-8" id="login_form" class="loginForm"
                          method="post"><input type="hidden" name="did" value="0"/>
                        <input type="hidden" name="to" value="log"/>
                        <div class="uinArea" id="uinArea">
                            <label class="input-tips" for="u">帐 &nbsp;号：</label>
                            <div class="inputOuter" id="uArea">
                                <input type="text" id="u" name="username" class="inputstyle"/>
                            </div>
                        </div>
                        <!--密码-->
                        <div class="pwdArea" id="pwdArea">
                            <label class="input-tips" for="p">密 &nbsp;码：</label>
                            <div class="inputOuter" id="pArea">
                                <input type="password" id="p"  name="password" class="inputstyle"/>
                            </div>
                        </div>
                        <!--验证码-->
                        <div class="yzmArea" id="verifyArea">
                            <label class="input-tips" for="code_input">验证码：</label>
                            <div class="inputOuter" id="yArea">
                                <input type="text" id="code_input" name="y" class="inputstyle"/>
                                <div id="v_container"></div>
                            </div>
                        </div>
                        <!--登录按钮-->

                        <div id="loginbuttondiv" class="inputOuter">
                            <input type="submit" value="登 录" class="button_blue" id="my_button"/>
                        </div>
                    </form>

 

处理登陆的action

静态模拟两个用户，并未用户分配不同的权限。(2代表是超级用户，可以进行系统管理)

package danger.action.queryView;

/**
 * 登陆Action
 */
import java.util.HashMap;
import java.util.Map;

import javax.servlet.http.HttpSession;

import org.apache.struts2.ServletActionContext;
import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Controller;

import com.opensymphony.xwork2.ActionSupport;

import danger.bean.sys.User;
import danger.utils.ValidateCheck;

@Controller
@Scope("prototype")
public class LoginAction extends ActionSupport {
    private Map<String, Object> result;
    private String username;
    private String password;
    private User user;

    @Override
    public String execute() throws Exception {
        result = new HashMap();
        // 获取session
        HttpSession session = ServletActionContext.getRequest().getSession();
        // 用户名与密码不为空进行登陆验证
        if (ValidateCheck.isNotNull(username) && ValidateCheck.isNotNull(password)) {
            // 模拟登陆成功后session中添加user
            if ("root".equals(username) && "123456".equals(password)) {
                user = new User();
                user.setUsername(username);
                user.setRole(2);
                session.setAttribute("user", user);
                return SUCCESS;
            }
            if ("信息录入人员".equals(username) && "123456".equals(password)) {
                user = new User();
                user.setRole(1);
                user.setUsername(username);
                session.setAttribute("user", user);
                return SUCCESS;
            }
        }
        // 来到这里证明登陆未成功
        result.put("msg", "账户或者密码错误");
        return ERROR;
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public Map getResult() {
        return result;
    }

    public void setResult(Map result) {
        this.result = result;
    }

    public User getUser() {
        return user;
    }

    public void setUser(User user) {
        this.user = user;
    }
}

 

struts.xml   配置(登陆成功后进入主页，失败后到message.jsp显示错误信息)

        <!-- 登陆 -->
        <action name="login" class="loginAction">
            <result name="success" type="redirect">/index.jsp</result>
            <result name="error">/message.jsp</result>
        </action>

 

5.退出系统的处理(删除session中的user，并将用户重定向到一个页面)

处理退出的Action(清除session)

package danger.action.queryView;

import javax.servlet.http.HttpSession;

import org.apache.struts2.ServletActionContext;
import org.springframework.context.annotation.Scope;
import org.springframework.stereotype.Controller;

import com.opensymphony.xwork2.ActionSupport;
@Controller
@Scope("prototype")
public class LogoutAction extends ActionSupport {

    @Override
    public String execute() throws Exception {
        // 获取session
        HttpSession session = ServletActionContext.getRequest().getSession();
        // 清空session中的用户
        session.removeAttribute("user");
        return super.execute();
    }
}

 

struts.xml配置Action

        <!-- 退出 -->
        <action name="logout" class="logoutAction">
            <!-- 成功后送到登陆页面 -->
            <result name="success" type="redirect">/login/login.jsp</result>
        </action>

 

 

退出系统按钮

<a href=javascript:void(0)
                        style="text-decoration: none; color: white;" onclick="logout()"><span>退出系统</span></a>

 

处理退出系统的JS函数

 

    <script type="text/javascript">
        function logout() {
            if (confirm("确定退出系统？")) {
                window.location.href = "${baseurl}/logout.action"
            }
        }
    </script>