Struts recommendations on user permission Restriction

There may be many ways to limit the permissions of the web system. Here I will talk about some of my tips to help you better understand them:
A role in the system contains multiple users. It is recommended that one-to-many roles be used between roles and users to avoid confusion;
Since the beginning of the system, the system has only one Super User (such as root) and has two default roles, namely the tourist role and the registered user role;
A super user can add a role in subsequent management. By default, a role cannot be deleted. If another role has a user, after deletion or deletion is not allowed, the roles of these users can be automatically converted to registered user roles;
Each Role user has the right to access certain functional modules of the system. Whether a role can access a function module can be modified by the super user. The permission module corresponding to the default role is also included;
There is a many-to-many relationship between roles and system modules, that is, a role can access multiple modules, and a module may have multiple roles;

Here we mainly talk about struts. A module contains multiple actions. The relationship between actions and modules is many-to-one;
In this way, when a user accesses an action, it maps to a module of the system. this is the system that retrieves the role of the current user and checks whether the role has the permission to access this module, you can set permissions in struts;
This process mainly includes the following parts:
1. Each module of the system is formed after the system is developed. The module information is stored in persistent media;
2. In the struts-config.xml, each action configuration has a role attribute, which is filled with a module name, so that the relationship between action and the module is established;
3. mappings between users, roles, and modules are mapped between database tables;
4. extends the requestprocessor class in struts (Note that if you use the tiles framework, You Need To Inherit another tiles-specific class) and rewrite the processorrole method in it (other methods are also useful, such as the preprocess method, you can set the submitted strings to both UTF-8 and system access logs.) In this method, you can retrieve the module name of the current action and the role of the current user, in this way, user permissions can be limited.

In this way, you can implement permission limitation. The advantage of this method is that even links to download or access some important functions from some places can still be intercepted. The disadvantage is that each access needs to be determined, however, when appropriate caching is done, the caching may vary from system to system. If there are special requirements, you can also limit the IP address or even a session corresponds to an ID, if the IP address is changed, the session will be destroyed immediately to prevent users from posting the user with the account ID.

Today, I am dizzy and seldom write such a long article. Let's take a look at it first. If you have any questions, please note that I will fix them as soon as possible.