Filter的应用--权限过滤

因为项目比较长，需要一步步进行实现，所以分解成一个一个需求。

一：需求一

1.需求一

　　可以看某人的权限，同时，可以对这个用户进行权限的修改。

2.程序实现

3.程序目录

　　

4.User.java

 package com.web;

 import java.util.List;

 public class User {
     private String userName;
     private List<Authority> authorities;
     public void User(){

     }
     public User(String userName, List<Authority> authorities) {
         this.userName = userName;
         this.authorities = authorities;
     }
     public String getUserName() {
         return userName;
     }
     public void setUserName(String userName) {
         this.userName = userName;
     }
     public List<Authority> getAuthorities() {
         return authorities;
     }
     public void setAuthorities(List<Authority> authorities) {
         this.authorities = authorities;
     }

 }

5.Authority.java

 package com.web;

 public class Authority {
     private String displayName;
     private String url;
     public void Authority() {

     }
     public Authority(String displayName, String url) {
         this.displayName = displayName;
         this.url = url;
     }
     public String getDisplayName() {
         return displayName;
     }
     public void setDisplayName(String displayName) {
         this.displayName = displayName;
     }
     public String getUrl() {
         return url;
     }
     public void setUrl(String url) {
         this.url = url;
     }

 }

6.UserDao.java

 package com.dao;

 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;

 import com.web.Authority;
 import com.web.User;

 public class UserDao {
     //初始化
     private static Map<String,User> users;
     private static List<Authority> authorities=null;
     static {
         users=new HashMap<String,User>();
         authorities=new ArrayList<>();

         authorities.add(new Authority("Article-1", "/article-1.jsp"));
         authorities.add(new Authority("Article-2", "/article-2.jsp"));
         authorities.add(new Authority("Article-3", "/article-3.jsp"));
         authorities.add(new Authority("Article-4", "/article-4.jsp"));    

         User user1=new User("AAA", authorities.subList(0, 2));
         users.put("AAA", user1);

         User user2=new User("BBB", authorities.subList(2, 4));
         users.put("BBB", user2);
     }

     /**
      * 得到用戶User（String，List<Authority>）
      * @param userName
      * @return
      */
     public User get(String userName) {
         return users.get(userName);
     }

     /**
      * 进行更新用户权限
      * 方法是得到用户，然后对这个用户进行赋权限
      * @param userName
      * @param authorities
      */
     public void update(String userName,List<Authority> authorities) {
         users.get(userName).setAuthorities(authorities);
     }

     /**
      * 获取权限，这个是所有的权限
      */
     public List<Authority> getAuthorities(){
         return authorities;
     }

     /**
      *
      * @param authorities2
      * @return
      */
     public List<Authority> getAuthorities(String[] urls) {
         List<Authority> authorities2=new ArrayList<Authority>();
         for(Authority authority:authorities) {
             if(urls!=null) {
                 for(String url : urls) {
                     if(url.equals(authority.getUrl())) {
                         authorities2.add(authority);
                     }
                 }
             }
         }

         return authorities2;
     }

 }

7.AuthorityServlet.java

 package com.web;

 import java.io.IOException;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.util.ArrayList;
 import java.util.List;

 import javax.servlet.ServletException;
 import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import com.dao.UserDao;
 public class AuthorityServlet extends HttpServlet {
     private static final long serialVersionUID = 1L;

     public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
         String methodName=request.getParameter("method");
         try {
             Method method=getClass().getMethod(methodName, HttpServletRequest.class,HttpServletResponse.class);
             method.invoke(this, request,response);
         } catch (Exception e) {
             e.printStackTrace();
         }
     }

     private UserDao userDao=new UserDao();

     public void getAuthorities(HttpServletRequest request, HttpServletResponse response) throws Exception{
         String userName=request.getParameter("userName");
         User user=userDao.get(userName);
         request.setAttribute("user", user);
         request.setAttribute("authorities", userDao.getAuthorities());
         request.getRequestDispatcher("/authority-manager.jsp").forward(request, response);
     }
     public void updateAuthorities(HttpServletRequest request, HttpServletResponse response) throws IOException {
         String userName=request.getParameter("userName");
         String[] authorities=request.getParameterValues("authoritiy");
         List<Authority> authoritiesList=userDao.getAuthorities(authorities);
         userDao.update(userName, authoritiesList);
         response.sendRedirect(request.getContextPath()+"/authority-manager.jsp");
     }

 }

8.authority-manager.jsp

 <%@ page language="java" contentType="text/html; charset=utf-8"
     pageEncoding="utf-8"%>
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Insert title here</title>
 </head>
 <body>
     <center>
         <br><br>
         <form action="AuthorityServlet?method=getAuthorities" method="post">
             name:<input type="text" name="userName"/>
             <input type="submit" value="Submit"/>
         </form>

         <br><br>

     <c:if test="${requestScope.user!=null}">
         ${requestScope.user.userName}的权限是：
         <br>
         <form action="AuthorityServlet?method=updateAuthorities" method="post">
             <input type="hidden" name="userName" value="${requestScope.user.userName}"/>
             <c:forEach items="${authorities}" var="auth">
                 <c:set var="flag" value="false"></c:set>
                 <c:forEach items="${user.authorities}" var="ua">
                     <c:if test="${ua.url== auth.url}">
                         <c:set var="flag" value="true"></c:set>
                     </c:if>
                 </c:forEach>
                 <c:if test="${flag}">
                     <input type="checkbox" name="authoritiy" value="${auth.url}" checked="checked">${auth.displayName}<br>
                 </c:if>
                 <c:if test="${!flag}">
                     <input type="checkbox" name="authoritiy" value="${auth.url}" >${auth.displayName}<br>
                 </c:if>
             </c:forEach>
             <input type="submit" value="Update"/>
         </form>
     </c:if>

     </center>
 </body>
 </html>

9.效果

　　

二：需求二

1.需求二

　　对访问权限的控制

　　使用Filter进行权限的过滤，检验用户是否有权限，有，则直接响应目标页面，若没有则重定向到403.jsp

2.程序目录（添加主要修改的程序）

　　

3.Authority.java

 package com.web;

 public class Authority {
     private String displayName;
     private String url;
     public void Authority() {

     }
     public Authority(String displayName, String url) {
         this.displayName = displayName;
         this.url = url;
     }
     public String getDisplayName() {
         return displayName;
     }
     public void setDisplayName(String displayName) {
         this.displayName = displayName;
     }
     public String getUrl() {
         return url;
     }
     public void setUrl(String url) {
         this.url = url;
     }
     //用于判断两个权限是否相等
     @Override
     public int hashCode() {
         final int prime = 31;
         int result = 1;
         result = prime * result + ((url == null) ? 0 : url.hashCode());
         return result;
     }
     @Override
     public boolean equals(Object obj) {
         if (this == obj)
             return true;
         if (obj == null)
             return false;
         if (getClass() != obj.getClass())
             return false;
         Authority other = (Authority) obj;
         if (url == null) {
             if (other.url != null)
                 return false;
         } else if (!url.equals(other.url))
             return false;
         return true;
     }

 }

4.AuthorityFilter.java

 package com.web;

 import java.io.IOException;
 import java.util.Arrays;
 import java.util.List;

 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.FilterConfig;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.annotation.WebFilter;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 /**
  * Servlet Filter implementation class AuthorityFilter
  */
 @WebFilter("*.jsp")
 public class AuthorityFilter extends HttpFilter {

     @Override
     public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
             throws IOException, ServletException {
         String servletPath=request.getServletPath();
         List<String> uncheckedUrls=Arrays.asList("/403.jsp","/article.jsp",
                 "/authority-manager.jsp","/login.jsp","/logout.jsp");
         if(uncheckedUrls.contains(servletPath)) {
             filterChain.doFilter(request, response);
             return;
         }
         User user=(User) request.getSession().getAttribute("user");
         System.out.println("============="+user.getUserName());
         if(user==null) {
             response.sendRedirect(request.getContextPath()+"/login.jsp");
             return;
         }
         List<Authority> authorities=user.getAuthorities();
         Authority authority=new Authority(null, servletPath);
         if(authorities.contains(authority)) {
             filterChain.doFilter(request, response);
             return;
         }
         response.sendRedirect(request.getContextPath()+"/403.jsp");
     }

 }

5.HttpFilter.java

 package com.web;

 import java.io.IOException;

 import javax.servlet.Filter;
 import javax.servlet.FilterChain;
 import javax.servlet.FilterConfig;
 import javax.servlet.ServletException;
 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 /**
  * 自定义的 HttpFilter, 实现自 Filter 接口
  *
  */
 public abstract class HttpFilter implements Filter {

     /**
      * 用于保存 FilterConfig 对象.
      */
     private FilterConfig filterConfig;

     /**
      * 不建议子类直接覆盖. 若直接覆盖, 将可能会导致 filterConfig 成员变量初始化失败
      */
     @Override
     public void init(FilterConfig filterConfig) throws ServletException {
         this.filterConfig = filterConfig;
         init();
     }

     /**
      * 供子类继承的初始化方法. 可以通过 getFilterConfig() 获取 FilterConfig 对象.
      */
     protected void init() {}

     /**
      * 直接返回 init(ServletConfig) 的 FilterConfig 对象
      */
     public FilterConfig getFilterConfig() {
         return filterConfig;
     }

     /**
      * 原生的 doFilter 方法, 在方法内部把 ServletRequest 和 ServletResponse
      * 转为了 HttpServletRequest 和 HttpServletResponse, 并调用了
      * doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
      *
      * 若编写 Filter 的过滤方法不建议直接继承该方法. 而建议继承
      * doFilter(HttpServletRequest request, HttpServletResponse response,
      *        FilterChain filterChain) 方法
      */
     @Override
     public void doFilter(ServletRequest req, ServletResponse resp,
             FilterChain chain) throws IOException, ServletException {
         HttpServletRequest request = (HttpServletRequest) req;
         HttpServletResponse response = (HttpServletResponse) resp;

         doFilter(request, response, chain);
     }

     /**
      * 抽象方法, 为 Http 请求定制. 必须实现的方法.
      * @param request
      * @param response
      * @param filterChain
      * @throws IOException
      * @throws ServletException
      */
     public abstract void doFilter(HttpServletRequest request, HttpServletResponse response,
             FilterChain filterChain) throws IOException, ServletException;

     /**
      * 空的 destroy 方法。
      */
     @Override
     public void destroy() {}

 }

6.LoginServlet.java

 package com.web;

 import java.io.IOException;
 import java.lang.reflect.Method;

 import javax.servlet.ServletException;
 import javax.servlet.annotation.WebServlet;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import com.dao.UserDao;

 /**
  * Servlet implementation class LoginServlet
  */
 @WebServlet("/loginServlet")
 public class LoginServlet extends HttpServlet {
     private static final long serialVersionUID = 1L;

     protected void doGet(HttpServletRequest request, HttpServletResponse response)
             throws ServletException, IOException {
         doPost(request,response);
     }

     protected void doPost(HttpServletRequest request, HttpServletResponse response)
             throws ServletException, IOException {
         String methodName=request.getParameter("method");
         try {
             Method method=getClass().getMethod(methodName, HttpServletRequest.class,HttpServletResponse.class);
             method.invoke(this, request,response);
         } catch (Exception e) {
             e.printStackTrace();
         }
     }

     UserDao userDao=new UserDao();

     public void login(HttpServletRequest request, HttpServletResponse response) throws Exception {
         String name=request.getParameter("name");
         User user=userDao.get(name);
         request.getSession().setAttribute("user", user);
         //重定向到article.jsp
         response.sendRedirect(request.getContextPath()+"/article.jsp");
     }
     public void logout(HttpServletRequest request, HttpServletResponse response) throws Exception {
         request.getSession().invalidate();
         response.sendRedirect(request.getContextPath()+"/login.jsp");
     }

 }

7.403.jsp

 <%@ page language="java" contentType="text/html; charset=utf-8"
     pageEncoding="utf-8"%>
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
 <title>Insert title here</title>
 </head>
 <body>
     <h2>没有权限</h2>
     <a href="${pageContext.request.contextPath}/article.jsp">返回</a>
 </body>
 </html>

8.article-1.jsp

 <%@ page language="java" contentType="text/html; charset=ISO-8859-1"
     pageEncoding="ISO-8859-1"%>
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Insert title here</title>
 </head>
 <body>
     <h1>1</h1>
 </body>
 </html>

9.article.jsp

 <%@ page language="java" contentType="text/html; charset=ISO-8859-1"
     pageEncoding="ISO-8859-1"%>
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Insert title here</title>
 </head>
 <body>

     <a href="article-1.jsp"> Article1 page</a><br><br>
     <a href="article-2.jsp"> Article2 page</a><br><br>
     <a href="article-3.jsp"> Article3 page</a><br><br>
     <a href="article-4.jsp"> Article4 page</a><br><br>
     <a href="loginServlet?method=logout">Logout</a>

 </body>
 </html>

10.login.jsp\

 <%@ page language="java" contentType="text/html; charset=ISO-8859-1"
     pageEncoding="ISO-8859-1"%>
 <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
 <title>Insert title here</title>
 </head>
 <body>
     <form action="loginServlet?method=login" method="post">
         name:<input type="text" name="name">
         <input type="submit" value="Submit">
     </form>
 </body>
 </html>