学习笔记_过滤器应用（粗粒度权限控制（拦截是否登录、拦截用户名admin权限））

RBAC ->基于角色的权限控制

l tb_user
l tb_role
l tb_userrole
l tb_menu(增、删、改、查)
l tb_rolemenu

1　说明

我们给出三个页面：index.jsp、user.jsp、admin.jsp。

l index.jsp：谁都可以访问，没有限制；

l user.jsp：只有登录用户才能访问；

l admin.jsp：只有管理员才能访问。

2　分析

设计User类：username、password、grade，其中grade表示用户等级，1表示普通用户，2表示管理员用户。

当用户登录成功后，把user保存到session中。

创建LoginFilter，它有两种过滤方式：

l 如果访问的是user.jsp，查看session中是否存在user；

l 如果访问的是admin.jsp，查看session中是否存在user，并且user的grade等于2。

3　代码

User.java

public class User {

private String username;

private String password;

private int grade[崔1] ;

…

}

[崔1]用户等级

[崔2]所有用户

[崔3]在Map中保存两个用户，zhangSan的等级为1，liSi的等级为2

[崔4]登录方法

[崔5]通过用户名获取用户

[崔6]如果用户名不存在，返回null

[崔7]如果密码不对返回null，如果密码正确返回用户

　　为了方便，这里就不使用数据库了，所以我们需要在UserService中创建一个Map，用来保存所有用户。Map中的key中用户名，value为User对象。

UserService.java

public class UserService {

private static Map<String,User> users [崔2] = new HashMap<String,User>();

static {

users.put("zhangSan", new User("zhangSan", "123", 1));

users.put("liSi", new User("liSi", "123", 2));

[崔3] }

public User login[崔4] (String username, String password) {

User user = users.get(username);[崔5]

if(user == null) return null;[崔6]

return user.getPassword().equals(password) ? user : null;[崔7]

}

<body>

<form action="<c:url value='/LoginServlet'/>" method="post">

用户名：<input type="text" name="username"/><br/>

密　码：<input type="password" name="password"/><br/>

</form>

</body>

[崔8]当登录出错时返回到login.jsp页面，显示“用户名或密码错误”

　　index.jsp

<body>

<h3>${user.username }</h3>

<hr/>

<a href="<c:url value='/admin/admin.jsp'/>">管理员页面</a>

</body>

　　/user/user.jsp

<body>

<h3>${user.username }</h3>

<hr/>

</body>

　　/admin/admin.jsp

<body>

<h1>管理员页面</h1>

<h3>${user.username }</h3>

<hr/>

</body>

　　LoginServlet

public class LoginServlet extends HttpServlet {

public void doPost(HttpServletRequest request, HttpServletResponse response)

throws ServletException, IOException {

request.setCharacterEncoding("utf-8");

response.setContentType("text/html;charset=utf-8");

String username = request.getParameter("username");

String password = request.getParameter("password");

[崔9] UserService userService = new UserService();

User user = userService.login(username, password);[崔10]

if(user == null[崔11] ) {

request.setAttribute("msg", "用户名或密码错误");

request.getRequestDispatcher("/login.jsp").forward(request, response);

[崔12] } else {

request.getSession().setAttribute("user", user);

request.getRequestDispatcher("/index.jsp").forward(request, response);

[崔13] }

}

[崔9]获取表单数据

[崔10]调用userService的login()方法完成登录

[崔11]返回的user为null表示登录失败

[崔12]在request 中保存错误信息，转发到login.jsp页面显示错误信息

[崔13]如果登录成功，把user对象保存到session中，并转发到index.jsp页面

　　LoginUserFilter.java

<display-name>LoginUserFilter</display-name>

<filter-name>LoginUserFilter</filter-name>

<filter-class>cn.itcast.filter.LoginUserFilter</filter-class>

</filter>

<filter-mapping>

<filter-name>LoginUserFilter</filter-name>

<url-pattern>/user/*[崔14] </url-pattern>

</filter-mapping>

public class LoginUserFilter implements Filter {

public void destroy() {}

public void init(FilterConfig fConfig) throws ServletException {}

public void doFilter(ServletRequest request, ServletResponse response,

FilterChain chain) throws IOException, ServletException {

response.setContentType("text/html;charset=utf-8");

HttpServletRequest req = (HttpServletRequest) request;

User user = (User) req.getSession().getAttribute("user");[崔15]

if(user == null)[崔16] {

response.getWriter().print("您还没有登录");[崔17]

return;[崔18]

}

chain.doFilter(request, response);[崔19]

}

[崔14]通过/user下的页面

[崔15]在session中获取当前user对象

[崔16]如果session中不存在user，说明当前用户还没有登录

[崔17]各客户端浏览器打印错误消息

[崔18]一定要返回，不然会向下执行“放行”的。

[崔19]如果在session中存在user，那么就放行

　　LoginAdminFilter.java

<display-name>LoginAdminFilter</display-name>

<filter-name>LoginAdminFilter</filter-name>

<filter-class>cn.itcast.filter.LoginAdminFilter</filter-class>

</filter>

<filter-mapping>

<filter-name>LoginAdminFilter</filter-name>

<url-pattern>/admin/*[崔20] </url-pattern>

</filter-mapping>

public class LoginAdminFilter implements Filter {

public void destroy() {}

public void init(FilterConfig fConfig) throws ServletException {}

public void doFilter(ServletRequest request, ServletResponse response,

FilterChain chain) throws IOException, ServletException {

response.setContentType("text/html;charset=utf-8");

HttpServletRequest req = (HttpServletRequest) request;

User user = (User) req.getSession().getAttribute("user");[崔21]

if(user == null) {

response.getWriter().print("您还没有登录!");

return;

}[崔22]

if(user.getGrade() < 2) {

response.getWriter().print("您的等级不够！");

return;

}[崔23]

chain.doFilter(request, response);[崔24]

}

　　禁用资源缓存

　　浏览器只是要缓存页面，这对我们在开发时测试很不方便，所以我们可以过滤所有资源，然后添加去除所有缓存！

public class NoCacheFilter extends HttpFilter {

public void doFilter(HttpServletRequest request,

HttpServletResponse response, FilterChain chain)

throws IOException, ServletException {

response.setHeader("cache-control", "no-cache");

response.setHeader("pragma", "no-cache");

response.setHeader("expires", "0");

chain.doFilter(request, response);

}

　　但是要注意，有的浏览器可能不会理会你的设置，还是会缓存的！这时就要在页面中使用时间戳来处理了。

[崔20]过滤/admin目录下的页面

[崔21]获取session中的user

[崔22]如果user为null，说明用户没有登录

[崔23]如果用户等级小于2，说明是普通用户，而不是管理员用户

[崔24]放行

完整代码

1、index.jsp

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

<%

String path = request.getContextPath();

String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";

%>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

  <head>

    <base href="<%=basePath%>">

    <title>My JSP 'index.jsp' starting page</title>

    <meta http-equiv="pragma" content="no-cache">

    <meta http-equiv="cache-control" content="no-cache">

    <meta http-equiv="expires" content="0">

    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">

    <meta http-equiv="description" content="This is my page">

    <!--

    <link rel="stylesheet" type="text/css" href="styles.css">

    -->

  </head>

  <body>

<h1>你就是个游客而已</h1>

<a href="<c:url value='/index.jsp'/>">游客入口</a><br/>         /* 加这么几个超链接*/

<a href="<c:url value='/users/u.jsp'/>">会员入口</a><br/>

<a href="<c:url value='/admin/a.jsp'/>">管理员入口</a><br/>

  </body>

</html>

2、login.jsp

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

  <head>

    <title>My JSP 'login.jsp' starting page</title>

    <meta http-equiv="pragma" content="no-cache">

    <meta http-equiv="cache-control" content="no-cache">

    <meta http-equiv="expires" content="0">

    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">

    <meta http-equiv="description" content="This is my page">

    <!--

    <link rel="stylesheet" type="text/css" href="styles.css">

    -->

  </head>

  <body>

<h1>登录</h1>

${msg }

<form action="<c:url value='/LoginServlet'/>" method="post">   //获取表单数据，方法为post方法；

用户名：<input type="text" name="username"/>

<input type="submit" value="登录"/>

</form>

  </body>

</html>

3、LoginServlet.java

package cn.itcast.web.servlet;

import java.io.IOException;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

public class LoginServlet extends HttpServlet {

    public void doPost(HttpServletRequest request, HttpServletResponse response)

            throws ServletException, IOException {

        request.setCharacterEncoding("utf-8");

        response.setContentType("text/html;charset=utf-8");

        /*

         * 1. 获取用户名

         * 2. 判断用户名中是否包含itcast

         *   3. 如果包含，就是管理员

         *   4. 如果不包含，就是普通会员

         * 5. 要把登录的用户名称保存到session中，一定要保存在session空间

         * 6. 转发到index.jsp

         */

        String username = request.getParameter("username");  //得到用户名

        if(username.contains("itcast")) {                    //这里设置只要用户名包含idcast就是管理员；

            request.getSession().setAttribute("admin", username);     //登录数据一定要保存在session空间admin中；

        } else {

            request.getSession().setAttribute("username", username);  //键有区别；一个是admin，一个是

        }

        request.getRequestDispatcher("/index.jsp").forward(request, response);  //跳转下一个

    }

}

下面两个保安，两个Filter

4、AdminFilter.java

package cn.itcast.web.filter;

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

/**

 * Servlet Filter implementation class AdminFilter

 */

public class AdminFilter implements Filter {

    public void destroy() {

    }

    public void doFilter(ServletRequest request, ServletResponse response,

            FilterChain chain) throws IOException, ServletException {

        /*

         * 1. 得到session

         * 2. 判断session域中是否存在admin，如果存在，放行

         * 3. 判断session域中是否存在username，如果存在，放行，否则打回到login.jsp，并告诉它不要瞎留达

         */

        HttpServletRequest req = (HttpServletRequest) request;

        String name = (String)req.getSession().getAttribute("admin");

        if(name != null) {

            chain.doFilter(request, response);

        } else {

            req.setAttribute("msg", "您可能是个啥，但肯定不是管理员！");

            req.getRequestDispatcher("/login.jsp").forward(request, response);

        }

    }

    public void init(FilterConfig fConfig) throws ServletException {

    }

}

5、UserFilter.java

package cn.itcast.web.filter;

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

public class UserFilter implements Filter {

    public void destroy() {

    }

    public void doFilter(ServletRequest request, ServletResponse response,

            FilterChain chain) throws IOException, ServletException {

        /*

         * 1. 得到session

         * 2. 判断session域中是否存在admin，如果存在，放行

         * 3. 判断session域中是否存在username，如果存在，放行，否则打回到login.jsp，并告诉它不要瞎留达

         */

        HttpServletRequest req = (HttpServletRequest) request;

        String name = (String)req.getSession().getAttribute("admin");

        if(name != null) {

            chain.doFilter(request, response);

            return;

        }

        name = (String)req.getSession().getAttribute("username");

        if(name != null) {

            chain.doFilter(request, response);

        } else {

            req.setAttribute("msg", "您啥都不是，不要瞎溜达！");

            req.getRequestDispatcher("/login.jsp").forward(request, response);

        }

    }

    public void init(FilterConfig fConfig) throws ServletException {

    }

}