Java solves the problem of entering url access action in the browser address bar and the simple implementation of blocking method Filtering

 

For Struts2, Spring3, and Hibernate3 integrated projects, user request control is very important, and some operations need to be performed after the user logs on. If no restrictions are imposed, the action can be directly entered in the browser to execute the corresponding action.

① Question about directly entering url in the address bar of the browser to access the action

② Filter methods that do not want to be intercepted

For example, for the following link:

 

 
 

  
  
http://localhost:8080/absSys/delete.action?id=1 
 
 

Submit the above address directly in the browser, and the delete operation can still be executed! Therefore, requests submitted by users must be intercepted. If the user does not log on, the logon page is displayed.

I. Question about directly entering url in the address bar of the browser to access the action

Struts2 provides an interceptor. When writing our own interceptor, we only need to inherit the abstract class AbstractInterceptor and then override intercept.

 
 

  
  
Import java. util. Map;
  
  
Import com. opensymphony. xwork2.ActionContext;
  
  
Import com. opensymphony. xwork2.ActionInvocation;
  
  
Import com. opensymphony. xwork2.interceptor. AbstractInterceptor;
  
  
 
  
  
Public class LoginInterceptor extends actinterceptor {
  
  
 
  
  
Private static final long serialVersionUID = 1L;
  
  
 
  
  
Public void destroy (){
  
  
 
  
  
System. out. println ("Destory ");
  
  
}
  
  
 
  
  
Public void init (){
  
  
 
  
  
System. out. println ("Init ");
  
  
}
  
  
 
  
  
/**
  
  
* @ Return result
  
  
**/
  
  
Public String intercept (ActionInvocation invocation) throws Exception {
  
  
System. out. println ("before the action is executed ");
  
  
String name = invocation. getInvocationContext (). getName ();
  
  
System. out. println ("Request Method:" + name );
  
  
ActionContext ac = invocation. getInvocationContext ();
  
  
Map <String, Object> session = ac. getSession ();
  
  
Boolean allow = name. equals ("infolist") | name. equals ("xwgg ")
  
  
| Name. equals ("pxdt") | name. equals ("noticethrid ")
  
  
| Name. equals ("gqpx") | name. equals ("gp ")
  
  
| Name. equals ("np") | name. equals ("sp ")
  
  
| Name. equals ("wypx") | name. equals ("zgks ")
  
  
| Name. equals ("shpx") | name. equals ("fwxz ")
  
  
| Name. equals ("noticesec") | name. equals ("filedown ");
  
  
If (name. equals ("login") | allow ){
  
  
// If the user wants to log on or execute the allow method, the user will not intercept it so that it passes
  
  
// Invocation. invoke () continues to run the interceptor for subsequent processing
  
  
 
  
  
Return invocation. invoke ();
  
  
 
  
  
} Else {
  
  
If (session. isEmpty () | session = null ){
  
  
// If the session is empty, log on to the user.
  
  
Return "login ";
  
  
} Else {
  
  
String userId = session. get ("userId"). toString ();
  
  
If (userId = null ){
  
  
// The session is not empty, but there is no user information in the session.
  
  
// Let the user log on
  
  
Return "login ";
  
  
} Else {
  
  
// The user has logged on. login successful
  
  
Return invocation. invoke ();
  
  
}
  
  
}
  
  
}
  
  
}
  
  
}
 
 

 

2. filter methods that do not want to be intercepted

In the default configuration, all methods are intercepted. For some methods that do not need to be intercepted, special processing is required.

 

In the LoginInterceptor class:

 

 
 

  
  
String name = invocation.getInvocationContext().getName(); 
 
 

 

This name is the method for obtaining the request. Because we may not need to intercept some methods, let them directly continue the subsequent processing operations. In this common situation, we do not need to intercept the query action on the homepage of the front-end. We can define methods that do not need to be intercepted in allow or in the configuration file. This article defines a boolean variable allow for convenience.

 

 
 

  
  
if (name.equals("login") || allow) { 
  
  
            return invocation.invoke(); 
  
  
        } 
 
 

Invocation. invoke (); continues subsequent operations.

 

3. Modify the Struts. xml configuration file and add the interceptor Configuration

The Struts. xml configuration is as follows:

 

 
 

  
  
<package name="author" namespace="/author" extends="struts-default"> 
  
  
 
  
  
        <interceptors> 
  
  
            <interceptor name="login" class="com.xxx.util.LoginInterceptor"></interceptor> 
  
  
            <interceptor-stack name="loginCheck"> 
  
  
                <interceptor-ref name="login"></interceptor-ref> 
  
  
                <interceptor-ref name="defaultStack"></interceptor-ref> 
  
  
            </interceptor-stack> 
  
  
        </interceptors> 
  
  
        <default-interceptor-ref name="loginCheck"></default-interceptor-ref> 
  
  
 
  
  
        <global-results> 
  
  
            <result name="login" type="redirect">/login.jsp</result> 
  
  
            <result name="illegal" type="redirect">/illegal.jsp</result> 
  
  
        </global-results> 
  
  
         
  
  
    </package> 
 
 

The configuration of the interceptor can be added to the package to be intercepted or placed in a package, then other packages inherit our author package.

 

 
 

  
  
<package name="User" namespace="/user" extends="struts-default,author"> 
 
 

 

Ps: You can also configure it in the specified action.

 
 

  
  
<interceptor-ref name="loginCheck"></interceptor-ref>  
 
 

This interceptor, but this configuration is required for every action to be intercepted. It is complicated for a large number of configuration files, so we only need to define a package configuration.

In addition, the interceptor method filtering can also inheritMethodFilterInterceptor class to implement,

See method filtering of Struts2 interceptor

The method mentioned in this article is relatively simple.MethodFilterInterceptorThe method of this class is more complicated.

This article from the ghost Conan technology blog, please be sure to keep this source http://enetq.blog.51cto.com/479739/1179856