Java使用Filter用户权限控制

 package com.mvc.test;

 import javax.servlet.ServletException;
 import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.PrintWriter;
 import java.util.HashSet;
 import java.util.Set;

 /**
  * 用户是否登录，使用全局方法
  *
  * @author liuwenlong
  * @create 2020-09-09 09:23:23
  */
 @SuppressWarnings("all")
 @WebServlet(urlPatterns = "/login")
 public class Application_Test extends HttpServlet {

     @Override
     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
         resp.setContentType("text/html;charset=UTF-8");
         PrintWriter out = resp.getWriter();
         String user = req.getParameter("user");
         if (user == null) {
             req.getSession().removeAttribute("islogin");
             out.print("无效的用户或者密码！");
             return;
         }

         if ("zs".equals(user)) {
             UserInfo userInfo = new UserInfo(user, "1010", "1", req.getSession().getId());
             req.getSession().setAttribute("islogin", userInfo);
             out.print("成功");
         } else if ("ls".equals(user)) {
             UserInfo userInfo = new UserInfo(user, "0101", "1" , req.getSession().getId());
             req.getSession().setAttribute("islogin", userInfo);
             out.print("成功");
         } else {
             out.print("无效用户或者密码");
         }

     }

     //发心跳，接收新的心跳，如果关闭浏览器，就接收不到新的心跳，时间就会超时
     @Override
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
         resp.setContentType("text/html;charset=UTF-8");
         PrintWriter out = resp.getWriter();
         String user = req.getParameter("user");//取出用户
         String key = "islogin_" + user;//这个用户，然后设置这个用户的时间，重新刷新时间
         String id = (String) req.getServletContext().getAttribute(key + "id");
         String id2 = req.getSession().getId();

         req.getServletContext().setAttribute(key + "_t", System.currentTimeMillis());//记录时间
         if (id != id2) {
             req.getSession().setAttribute("islogin", "notlogin");
             out.print(user + "已经在设备" + id + "登录");
         } else {
             out.print("OK");
         }
     }
 }

定义一个Bean

 package com.mvc.test;

 /**
  * 访问控制 控制权限
  *
  * @author liuwenlong
  * @create 2020-09-09 13:37:37
  */
 @SuppressWarnings("all")
 public class UserInfo {
     private String userid;
     private String privi;
     private String heart;
     private String appid;

     public UserInfo() {
     }

     public UserInfo(String userid, String privi, String heart, String appid) {
         this.userid = userid;
         this.privi = privi;
         this.heart = heart;
         this.appid = appid;
     }

     public String getUserid() {
         return userid;
     }

     public void setUserid(String userid) {
         this.userid = userid;
     }

     public String getPrivi() {
         return privi;
     }

     public void setPrivi(String privi) {
         this.privi = privi;
     }

     public String getHeart() {
         return heart;
     }

     public void setHeart(String heart) {
         this.heart = heart;
     }

     public String getAppid() {
         return appid;
     }

     public void setAppid(String appid) {
         this.appid = appid;
     }

     @Override
     public String toString() {
         return "UserInfo{" +
                 "userid='" + userid + '\'' +
                 ", privi='" + privi + '\'' +
                 ", heart='" + heart + '\'' +
                 ", appid='" + appid + '\'' +
                 '}';
     }
 }

写一个JSP文件，显示

 <%@ page contentType="text/html;charset=UTF-8" language="java" %>
 <html>
 <head>
     <title>Title</title>
 </head>
 <body>
 <%--权限--%>
 ${sessionScope.logininfo}
 </body>
 </html>

写一个过滤器

 package com.mvc.test;

 import javax.servlet.*;
 import javax.servlet.annotation.WebFilter;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.util.logging.LogRecord;

 /**
  * @author liuwenlong
  * @create 2020-09-09 13:50:04
  */
 @SuppressWarnings("all")
 //向服务器发起的请求，都要在这里过滤
 @WebFilter(urlPatterns = "/*")
 public class MyFilter implements Filter {

     @Override
     public void init(FilterConfig filterConfig) throws ServletException {

     }

     @Override
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain Chain) throws IOException, ServletException {
         HttpServletRequest req = (HttpServletRequest) request;
         HttpServletResponse resp = (HttpServletResponse) response;

         req.setCharacterEncoding("utf-8");
         resp.setCharacterEncoding("utf-8");
         String sURI = req.getRequestURI();
         UserInfo userInfo = (UserInfo) req.getSession().getAttribute("islogin");
         System.out.println(sURI);

         if (!(sURI.endsWith("login")
                 || sURI.endsWith("login.jsp")
                 || sURI.endsWith(".js")
                 || sURI.endsWith(".css")
                 || sURI.endsWith(".png")
         )) {
             if (userInfo == null) {
                 req.getSession().setAttribute("error", "pls login");
                 resp.sendRedirect("login.jsp");
 //                resp.sendRedirect(req.getContextPath() + "/login.jsp"); //重新定向login.jsp
                 return;
             }
         }

         //控制器权限
         //0 [member]0[good]0[order]0[any]
         String action[] = {"member", "good", "order", "any"};

         int pos = sURI.lastIndexOf("/");
         sURI =sURI.substring(pos+1);
         System.out.println(sURI);

         if (userInfo != null) {
             String sPrive = userInfo.getPrivi();//取出权限
             int i = 0;
             for (; i < action.length; i++) {
                 if (sURI.endsWith(action[i])) {
                     break;
                 }
             }

             if (i < action.length) {
                 char ch = sPrive.charAt(i);
                 if (ch == '1') {
                     req.getSession().setAttribute("logininfo", userInfo.getUserid() + "有"+action[i]+"权限");
                     resp.sendRedirect("qx.jsp");
                     return;
                 } else {
                     req.getSession().setAttribute("logininfo", userInfo.getUserid() + "没有"+action[i]+"权限");
                     resp.sendRedirect( "qx.jsp");
                     return;
                 }
             }

         }

         Chain.doFilter(request, response);
     }

     @Override
     public void destroy() {

     }
 }

测试：先登录zs  ls

然后每个人访问：member   good  any等 ，出现下列效果