转:spring aop 拦截业务方法，实现权限控制

难点：aop类是普通的java类，session是无法注入的，那么在有状态的系统中如何获取用户相关信息呢，session是必经之路啊，获取session就变的很重要。思索很久没有办法，后来在网上看到了解决办法。

思路是：

i. SysContext  成员变量 request,session,response 
    ii. Filter 目的是给 SysContext 中的成员赋值 
    iii.然后在AOP中使用这个SysContext的值

要用好，需要理解  ThreadLocal和  和Filter 执行顺序

1.aop获取request，response，session等

1. public class SysContext {
2. private static ThreadLocal<HttpServletRequest> requestLocal=new ThreadLocal<HttpServletRequest>();
3. private static ThreadLocal<HttpServletResponse> responseLocal=new ThreadLocal<HttpServletResponse>();
4. public static HttpServletRequest getRequest(){
5. return requestLocal.get();
6. }
7. public static void setRequest(HttpServletRequest request){
8. requestLocal.set(request);
9. }
10. public static HttpServletResponse getResponse(){
11. return responseLocal.get();
12. }
13. public static void setResponse(HttpServletResponse response){
14. responseLocal.set(response);
15. }
16. public static HttpSession getSession(){
17. return (HttpSession)(getRequest()).getSession();
18. }
19. }

2.添加过滤器

1. public class GetContextFilter implements Filter{
2. @Override
3. public void destroy() {
4. }
5. @Override
6. public void doFilter(ServletRequest request, ServletResponse response,
7. FilterChain chain) throws IOException, ServletException {
8. SysContext.setRequest((HttpServletRequest)request);
9. SysContext.setResponse((HttpServletResponse)response);
10. chain.doFilter(request, response);
11. }
12. @Override
13. public void init(FilterConfig config) throws ServletException {
14. }
15. }

3.配置web.xml

将这部分放置在最前面，这样可以过滤到所有的请求

1. <filter>
2. <filter-name>sessionFilter</filter-name>
3. <filter-class>com.unei.filter.GetContextFilter</filter-class>
4. </filter>
5. <filter-mapping>
6. <filter-name>sessionFilter</filter-name>
7. <url-pattern>*</url-pattern>
8. </filter-mapping>

4.spring aop before

从session中取出用户名，如果不存在，抛出异常跳转，将错误信息放到request中

1. @Aspect
2. public class AdminAspect {
3. ActionContext context = ActionContext.getContext();
4. HttpServletRequest request;
5. HttpServletResponse response;
6. @Before("execution(* com.unei.Action.AdminAction.getPrivileges(..))")
7. public void adminPrivilegeCheck()
8. throws Throwable {
9. HttpSession session = SysContext.getSession();
10. request = SysContext.getRequest();
11. response = SysContext.getResponse();
12. String userName = "";
13. try {
14. userName = session.getAttribute("userName").toString();
15. if(userName==null||userName.equals(""))
16. throw new Exception("no privilege");
17. } catch (Exception ex) {
18. request.setAttribute("msg", "{\"res\":\"" + "无权限" + "\"}");
19. try {
20. request.getRequestDispatcher("/jsp/json.jsp").forward(
21. request, response);
22. } catch (ServletException e) {
23. e.printStackTrace();
24. } catch (IOException e) {
25. e.printStackTrace();
26. }
27. }
28. }
29. }

5.applicationContext.xml

1. <bean id="adminAspect" class="com.unei.aop.AdminAspect"></bean>