java web过滤器在登录时的使用

来源：互联网发布：淘宝店中国制造编辑：程序博客网时间：2024/05/22 16:46

我们经常在各种网站登录账户，有的网站只有登录账户后才能访问到网页内容。

如果我们直接键入登陆成功后的页面网址能不能访问呢?不能访问的原因是什么呢？

我写了一个登录页面希望在登录成功的时候进入访问成功页面失败的时候进入访问失败页面

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%><%String path = request.getContextPath();String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";%><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html>  <head>    <base href="<%=basePath%>">        <title>My JSP 'index.jsp' starting page</title><meta http-equiv="pragma" content="no-cache"><meta http-equiv="cache-control" content="no-cache"><meta http-equiv="expires" content="0">    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3"><meta http-equiv="description" content="This is my page"><!--<link rel="stylesheet" type="text/css" href="styles.css">-->  </head>    <body>    <form action="servlet/LoginServlet" method="post">    <table>    <tr>    <td>用户名：</td>    <td><input type="text" name="username"></td>    </tr>    <tr>    <td>密码：</td>    <td><input type="password" name=password></td>    </tr>    <tr>    <td><input type="submit" value="登录"> </td>    <td><input type="reset" value="重置"> </td>    </tr>    </table>        </form>  </body></html>

登录成功

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%><%String path = request.getContextPath();String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";%><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html>  <head>    <base href="<%=basePath%>">        <title>My JSP 'success.jsp' starting page</title>    <meta http-equiv="pragma" content="no-cache"><meta http-equiv="cache-control" content="no-cache"><meta http-equiv="expires" content="0">    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3"><meta http-equiv="description" content="This is my page"><!--<link rel="stylesheet" type="text/css" href="styles.css">-->  </head>    <body>   欢迎你，${username}  </body></html>

登录失败

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%><%String path = request.getContextPath();String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";%><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html>  <head>    <base href="<%=basePath%>">        <title>My JSP 'success.jsp' starting page</title>    <meta http-equiv="pragma" content="no-cache"><meta http-equiv="cache-control" content="no-cache"><meta http-equiv="expires" content="0">    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3"><meta http-equiv="description" content="This is my page"><!--<link rel="stylesheet" type="text/css" href="styles.css">-->  </head>    <body>    登陆失败！！  </body></html>

servlet处理登录界面的表单数据

        String username;String password;//获取表单的帐号  密码username=req.getParameter("username");password=req.getParameter("password");//如果帐号为admin  密码为123456  则登录成功if("admin".equals(username)&&"123456".equals(password)){//将用户保存的session中req.getSession().setAttribute("username", username);//跳转到成功界面resp.sendRedirect("../success.jsp");}else{//跳转到失败界面resp.sendRedirect("../fail.jsp");}

运行结果：

运行结果似乎很正确。帐号密码输入正确成功登录否则登录失败。

可是如果我们直接键入成功页面好像也登录成功了，但是与我们的设计是不一致的。

这时候就需要过滤器了

web.xml

<filter>  <filter-name>LoginFilter</filter-name>  <filter-class>Filter.LoginFilter</filter-class> </filter> <filter-mapping>  <filter-name>LoginFilter</filter-name>  <url-pattern>/*</url-pattern> </filter-mapping>

Filter类

package Filter;import java.io.IOException;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;public class LoginFilter implements Filter {public void destroy() {}public void doFilter(ServletRequest arg0, ServletResponse arg1,FilterChain chain) throws IOException, ServletException {HttpServletRequest request = (HttpServletRequest) arg0;HttpServletResponse responst = (HttpServletResponse) arg1;//如果是登录页面 或者servlet处理页面 直接放行if(request.getRequestURI().indexOf("/index.jsp")!=-1||request.getRequestURI().indexOf("/servlet/LoginServlet")!=-1||request.getRequestURI().indexOf("/fail.jsp")!=-1){chain.doFilter(arg0, arg1);return ;}if(request.getSession().getAttribute("username")!=null){chain.doFilter(arg0, arg1);}else{responst.sendRedirect("index.jsp");}}public void init(FilterConfig arg0) throws ServletException {}}

运行结果如下

使用过滤器后发现我们直接键入登录成功页面会自动跳转到登录界面不会存在未登录就进入成功访问页面的问题。

合理的使用过滤器能够避免用户未经登录就成功访问的页面的不安全。

0 0