实用jstl实现未登录时不能绕过登录界面的效果

package com.filter;

import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class StateFilter implements Filter {
    private ArrayList<String> list = new ArrayList();
    @Override
    public void destroy() {
        // TODO 自动生成的方法存根

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest)request;
        HttpServletResponse rep=(HttpServletResponse)response;
        HttpSession session = req.getSession();

        String path1=req.getRequestURI();
        String path2=req.getContextPath();
        String target =path1.substring(path2.length());
        if(list.contains(target)==false){
            if(session.getAttribute("user")==null){
                rep.sendRedirect("login.jsp");
            }
            else{
                chain.doFilter(req, rep);
            }
        }
        else{
            chain.doFilter(req, rep);
        }

    }

    @Override
    public void init(FilterConfig cfg) throws ServletException {
        String val=cfg.getInitParameter("allowpage");
        String[] arr=val.split(",");
        list.addAll(Arrays.asList(arr));
    }

}

package com.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class TestFilter implements Filter{

    @Override
    public void destroy() {
        // TODO 自动生成的方法存根

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        // TODO 自动生成的方法存根
        //HttpServletRequest req=(HttpServletRequest)request;
        //HttpServletResponse rep = (HttpServletResponse)response;
        request.setCharacterEncoding("utf-8");
        response.setCharacterEncoding("utf-8");
        //response.getWriter().write("kaishi");
        chain.doFilter(request, response);
        //response.getWriter().write("jieshu");
    }

    @Override
    public void init(FilterConfig arg0) throws ServletException {
        // TODO 自动生成的方法存根

    }

}

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1">

     <filter>
        <filter-name>testfilter</filter-name>
        <filter-class>com.filter.TestFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>testfilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter>
        <filter-name>loginfilter</filter-name>
        <filter-class>com.filter.StateFilter</filter-class>
        <init-param>
            <param-name>allowpage</param-name>
            <param-value>/login.jsp,/login</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>loginfilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

  <display-name>Test0213am</display-name>
  <welcome-file-list>
    <welcome-file>index.html</welcome-file>
    <welcome-file>index.htm</welcome-file>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>default.html</welcome-file>
    <welcome-file>default.htm</welcome-file>
    <welcome-file>default.jsp</welcome-file>
  </welcome-file-list>
</web-app>

login.jsp界面：

<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
    pageEncoding="ISO-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
</head>
<body>
<h1>1aasdasd</h1>
</body>
</html>

NewFile.jsp界面：

<%@ page language="java" contentType="text/html; charset=utf-8"
    pageEncoding="utf-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Insert title here</title>
</head>
<body>
<h2>JSP文件</h2>
</body>
</html>

地址栏输入任何地址都跳转到login.jsp界面（除了login这个界面是白名单）