用Filter 写权限控制

在介绍Spring Security 3.0 之前让我们来复习一下Filter 的用法...

 

Filter 是什么这里就不做具体讲解了...

从功能上就是过滤的作用 因为在web 应用中对应的请求和一些操作都是一些请求 那么我们怎么来使用这一功能呢!

 

1.我们来做一个分析

 

  1) 我们的目标是什么? 在web.xml 中配置 权限参数,有配置的让访问没有的反回到登录页面

  2) 技术分析 用到Filter 类 和web.xml 初始参数的使用

  3) 技术复习 FilterConfig.getInitParameter("paramName")

      MyFilter implements Filter

      {}

 

2.技术实现

 

    1) web.xml 文件添加如下权限内容

 

<!-- addition LoginFilter -->
    <filter>
        <filter-name>loginFilter</filter-name>
        <filter-class>com.admin.rolemanager.LoginFilter</filter-class>
        <!-- addition initParameter -->
        <init-param>
            <param-name>allowParam</param-name>
            <param-value>/login.jsp,/js/us/*,/index.jsp</param-value>
        </init-param>
        <init-param>
            <param-name>loginPage</param-name>
            <param-value>/login.jsp</param-value>
        </init-param>
        <init-param>
            <param-name>serverIsMax</param-name>
            <param-value>/serverIsMax.jsp</param-value>
        </init-param>
    </filter>
    <!-- configuration LoginFilterMapping -->
    <filter-mapping>
        <filter-name>loginFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>

  

   2. 添加java 代码

 

  

package com.admin.rolemanager;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
 * 
 * @author liuqing 2010-10-9
 */
public class LoginFilter implements Filter {

	private String allowParam;

	private String loginPage;

	private String serverIsMax;

	public void init(FilterConfig filterConfig) throws ServletException {
		allowParam = filterConfig.getInitParameter("allowParam");
		serverIsMax = filterConfig.getInitParameter("serverIsMax");
		loginPage = filterConfig.getInitParameter("loginPage");
	}

	public void doFilter(ServletRequest request, ServletResponse response,
			FilterChain chain) throws IOException, ServletException {

		HttpServletRequest req = (HttpServletRequest) request;
		HttpServletResponse resp = (HttpServletResponse) response;
			//如果请求的是loginPage就直接反回
			if (req.getRequestURI().equals(
					req.getContextPath() + loginPage)) {
				chain.doFilter(request, response);
				return;
			}
			//根据web.xml 中添加的内容进行split
			String regStr[] = allowParam.split(",");
			int j = 0;
			for (int i = 0; i < regStr.length; i++) {

				System.out.println("log for");
				/**
				 * 注意:因为 getRequestURI() 获得的值是 /ProjectName/index.jsp
				 * 因为web.xml 中的初始参数 没有ProjectName
				 * 所以用到了substring String 进行处理
				 * 用到了startsWith进行匹配
				 */
				if ( (regStr[i] + "/").startsWith(req.getRequestURI()
						.substring(req.getContextPath().length())
						) ) {
					System.out.println("log for ==== end");
					chain.doFilter(request, response);
					return;
				}
			}
			if (!req.getRequestURI().equals(
					req.getContextPath() + loginPage)) {
				resp.sendRedirect(req.getContextPath() + loginPage);
				chain.doFilter(request, resp);
				return;
			}
	}

	public void destroy() {

	}

}

 

 

 

   你可以在web.xml 中配置对应的参数

  

    各位兄弟姐妹。。。你们也可以根据这个例子修改成为基于数据库的权限控制内容存到RDMB中