Web許可權驗證過濾器

本文只是描述了一個比較簡單的入門級的許可權過濾器

實際上更好的參考實現有兩款產品：Apache的Shiro(其前身是JSecurity)和SpringSecurity

下面是Web工程中的web.xml

<?xml version="1.0" encoding="UTF-8"?><web-app version="2.5"xmlns="http://java.sun.com/xml/ns/javaee"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"><filter><filter-name>AuthenticationFilter</filter-name><filter-class>com.jadyer.Filter.AuthenticationFilter</filter-class><init-param><param-name>url</param-name><param-value>/admin/login.jsp</param-value></init-param></filter><filter-mapping><filter-name>AuthenticationFilter</filter-name><url-pattern>/admin/secure/*</url-pattern></filter-mapping>    <error-page>    <error-code>404</error-code>    <location>/WEB-INF/404.html</location>    </error-page>    <error-page>    <error-code>500</error-code>    <location>/WEB-INF/500.html</location>    </error-page>    <error-page>    <exception-type>javax.servle.ServletException</exception-type>    <location>/WEB-INF/error.html</location>    </error-page>    <error-page>    <exception-type>java.lang.NullPointerException</exception-type>    <location>/WEB-INF/error.html</location>    </error-page></web-app>

下面是用於許可權驗證的過濾器AuthenticationFilter.java

package com.jadyer.Filter;import java.io.IOException;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;/** * 許可權驗證 */public class AuthenticationFilter implements Filter {private String url = "/"; //代表根目錄public void destroy() {}/** * 擷取web.xml中設定的參數url的值 * @see 即讀取web.xml中的<param-name>url</param-name> */public void init(FilterConfig config) throws ServletException {url = config.getInitParameter("url");}public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {//這兩行的強制類型轉換是必不可少的HttpServletRequest req = (HttpServletRequest) request;HttpServletResponse res = (HttpServletResponse) response;//如果是普通使用者或者管理員session已到期，則轉到指定頁面並返回，而不再執行下一個過濾鏈if (null == req.getSession().getAttribute("guesbook.admin.username")) {res.sendRedirect(req.getContextPath() + url);} else {chain.doFilter(request, response);}}}