I have been learning JSP for so long, and I have worked on seven or eight projects, but in all the projects, when the user logs in, he or she will jump directly to the page to which he or she has permission, or display links to accessible pages. Use this approach to naively control access. I never thought that if I didn't log in, I could directly access the user's page by entering the address.
The control of permissions in jsp is achieved through Filter. All development frameworks have Filter integrated into them. If the development framework is not applicable, the following implementation methods are available:
LoginFilter.java
Copy the code code as follows:
public class LoginFilter implements Filter {
private String permitUrls[] = null;
private String gotoUrl = null;
public void destroy() {
// TODO Auto-generated method stub
permitUrls = null;
gotoUrl = null;
}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
// TODO Auto-generated method stub
HttpServletRequest res=(HttpServletRequest) request;
HttpServletResponse resp=(HttpServletResponse)response;
if(!isPermitUrl(request)){
if(filterCurrUrl(request)){
System.out.println("--->Please log in");
resp.sendRedirect(res.getContextPath()+gotoUrl);
return;
}
}
System.out.println("--->Allow access");
chain.doFilter(request, response);
}
public boolean filterCurrUrl(ServletRequest request){
boolean filter=false;
HttpServletRequest res=(HttpServletRequest) request;
User user =(User) res.getSession().getAttribute("user");
if(null==user)
filter=true;
return filter;
}
public boolean isPermitUrl(ServletRequest request) {
boolean isPermit = false;
String currentUrl = currentUrl(request);
if (permitUrls != null && permitUrls.length > 0) {
for (int i = 0; i < permitUrls.length; i++) {
if (permitUrls[i].equals(currentUrl)) {
isPermit = true;
break;
}
}
}
return isPermit;
}
//request address
public String currentUrl(ServletRequest request) {
HttpServletRequest res = (HttpServletRequest) request;
String task = request.getParameter("task");
String path = res.getContextPath();
String uri = res.getRequestURI();
if (task != null) {//uri format xx/ser
uri = uri.substring(path.length(), uri.length()) + "?" + "task="
+ task;
} else {
uri = uri.substring(path.length(), uri.length());
}
System.out.println("Current request address:" + uri);
return uri;
}
public void init(FilterConfig filterConfig) throws ServletException {
// TODO Auto-generated method stub
String permitUrls = filterConfig.getInitParameter("permitUrls");
String gotoUrl = filterConfig.getInitParameter("gotoUrl");
this.gotoUrl = gotoUrl;
if (permitUrls != null && permitUrls.length() > 0) {
this.permitUrls = permitUrls.split(",");
}
}
}
Web.xml
Copy the code code as follows:
<filter>
<filter-name>loginFilter</filter-name>
<filter-class>filter.LoginFilter</filter-class>
<init-param>
<param-name>ignore</param-name>
<param-value>false</param-value>
</init-param>
<init-param>
<param-name>permitUrls</param-name>
<param-value>/,/servlet/Loginservlet?task=login,/public.jsp,/login.jsp</param-value>
</init-param>
<init-param>
<param-name>gotoUrl</param-name>
<param-value>/login.jsp</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>loginFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
This short code mainly implements user login filtering, and the principle of permission filtering is the same. Just change the judgment of whether the user is logged in to whether he or she has permission!