shiro权限管理的一个interceptor

import java.util.List;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import org.apache.commons.logging.Log;import org.apache.commons.logging.LogFactory;import org.apache.shiro.SecurityUtils;import org.apache.shiro.subject.Subject;import org.springframework.core.NamedThreadLocal;import org.springframework.web.servlet.HandlerInterceptor;import org.springframework.web.servlet.ModelAndView;public class SsoInterceptor implements HandlerInterceptor { protected Log log = LogFactory.getLog(this.getClass()); private NamedThreadLocal<Long> startTimeThreadLocal = new NamedThreadLocal<Long>(   "StopWatch-StartTime"); private List<String> noFilterUrls; public List<String> getNoFilterUrls() {  return noFilterUrls; } public void setNoFilterUrls(List<String> noFilterUrls) {  this.noFilterUrls = noFilterUrls; } @Override public void afterCompletion(HttpServletRequest request,   HttpServletResponse response, Object handler, Exception exception)   throws Exception {  long endTime = System.currentTimeMillis();// 结束时间  long beginTime = startTimeThreadLocal.get();// 得到线程绑定的局部变量（开始时间）  long consumeTime = endTime - beginTime;// 消耗的时间      if (consumeTime > 500) {// 此处认为处理时间超过500毫秒的请求为慢请求   // 记录到日志文件   log.info(String.format("%s consume %d ms",request.getRequestURI(), consumeTime));  } } @Override public void postHandle(HttpServletRequest request,   HttpServletResponse response, Object handler,   ModelAndView modelAndView) throws Exception { } @Override public boolean preHandle(HttpServletRequest request,   HttpServletResponse response, Object handler) throws Exception {  String url = request.getRequestURI();  String requestUrl=url.substring(4);  System.out.println(requestUrl);  //放行页验证  boolean flag=noFilterUrls.contains(requestUrl);  //开始时间  long beginTime = System.currentTimeMillis();  //线程绑定变量（该数据只有当前请求的线程可见）  startTimeThreadLocal.set(beginTime);  if(flag){   return true;  }    Subject currentUser=SecurityUtils.getSubject();    if(currentUser.isAuthenticated()){//登陆认证   if(currentUser.hasRole("系统管理员")){//超级管理员认证    return true;   }      if(currentUser.isPermitted(requestUrl)){//权限认证    return true;   }   //授权不通过跳转   request.setAttribute("url", requestUrl);   request.getRequestDispatcher("/login/noAuthentication.do").forward(request, response);  }else{   request.getRequestDispatcher("/login/noSession.do").forward(request, response);  }  return false; }}