SPRINGMVC interceptors, do not block JSP files

Spring MVC interceptors only block controllers from intercepting JSP files, and if they do not intercept JSP files, they will also bring security issues to the system.

There are two types of solutions:

1, put all the JSP files into the Web-inf folder, so that users are directly unable to access the JSP file under the Web-inf file. The idea of spring MVC is also to request the relevant JSP page through the @requestmapping of the controller, rather than the user's direct access to the JSP page.

Then write the relevant configuration

Join in the Springmvc.xml

    <mvc:interceptors>        <Mvc:interceptor>            <mvc:mappingPath="/**"/>
            <mvc:exclude-mappingPath= "/admin/login.do"/><!--Exclude blocked pages --            <Beanclass= "Com.ms.controller.LoginInterceptor"></Bean>        </Mvc:interceptor>    </mvc:interceptors>

 Public classLogininterceptorImplementsHandlerinterceptor { Public voidaftercompletion (httpservletrequest arg0, HttpServletResponse arg1, Object arg2, Exception arg3) throwsException {//TODO auto-generated Method Stub    }     Public voidPosthandle (httpservletrequest arg0, HttpServletResponse arg1, Object arg2, Modelandview arg3)throwsException {//TODO auto-generated Method Stub    }     Public BooleanPrehandle (httpservletrequest req, httpservletresponse res, Object handler)throwsException {HttpSession session=req.getsession (); Object obj=session.getattribute ("UserId"); if(obj==NULL|| Obj.tostring (). Equals ("") {req.getrequestdispatcher ("/admin/login.do"). Forward (req, res); return false; }        return true; }}

On the Contoller floor

@Controller @requestmapping ("/admin")  Public class Admincontroller {            @RequestMapping ("/login")      public  String login () {         return "/web-inf/jsp/admin/login.jsp";    }}

The above can solve the Spring MVC interception jsp page problem

2, there is a solution: JSP if not placed under the Web-inf file, Spring MVC is unable to intercept, this situation requires the most primitive servlet filter interface, in particular, you can refer to

The following blog will not repeat.

http://blog.csdn.net/lsx991947534/article/details/45499205

SPRINGMVC interceptors, do not block JSP files