用struts2拦截器实现权限检查

login.jsp

<%...@ page contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%...@ taglib prefix="s" uri="/struts-tags"%>
<%...
    String path = request.getContextPath();
    String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + path + "/";
%>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
    <head>
        <s:head />
        <base href="<%=basePath%>">

        <title>My JSP 'login.jsp' starting page</title>

        <meta http-equiv="pragma" content="no-cache">
        <meta http-equiv="cache-control" content="no-cache">
        <meta http-equiv="expires" content="0">
        <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
        <meta http-equiv="description" content="This is my page">
        <!--
    <link rel="stylesheet" type="text/css" href="styles.css">
    -->

    </head>

    <body>
        <div style="color:red">
            <s:fielderror/>
        </div>
        
        <s:form action="login" theme="simple">
            <table align="center" width="60%">
                <tr>
                    <td align="right">
                        Name:
                    </td>
                    <td>
                        <s:textfield name="name" />
                    </td>
                    <td>
                        <s:submit value="Submit" />
                    </td>
                </tr>
                <tr>
                    <td align="right" colspan="3">
                        <a href="welcome.action">Go to welcome page directly.</a>
                    </td>
                </tr>
            </table>
        </s:form>
    </body>
</html>

welcome.jsp

<%...@ page contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%...@ taglib prefix="s" uri="/struts-tags"%>
<%...
    String path = request.getContextPath();
    String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + path + "/";
%>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
    <head>
        <s:head />
        <base href="<%=basePath%>">

        <title>My JSP 'login.jsp' starting page</title>

        <meta http-equiv="pragma" content="no-cache">
        <meta http-equiv="cache-control" content="no-cache">
        <meta http-equiv="expires" content="0">
        <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
        <meta http-equiv="description" content="This is my page">
        <!--
    <link rel="stylesheet" type="text/css" href="styles.css">
    -->

    </head>

    <body>
        <s:form action="logout" theme="simple">
            <h2>
                Welcome!
            </h2>
            <table align="center" width="60%">
                <tr>
                    <td>
                        Name:
                    </td>
                    <td>
                        <s:property value="#session['USER_INFO'].name" />
                    </td>
                </tr>

                <tr>
                    <td>
                        Login Time:
                    </td>
                    <td>
                        <s:property value="#session['USER_INFO'].loginTime" />
                    </td>
                </tr>

                <tr>
                    <td>
                        <s:submit value="Logout" />
                    </td>
                    <td>
                        <a href="login.action">Back to login.</a>
                    </td>
                </tr>
            </table>
        </s:form>
    </body>
</html>

struts.xml

<!DOCTYPE struts PUBLIC 
"-//Apache Software Foundation//DTD Struts Configuration 2.0//EN" 
"http://struts.apache.org/dtds/struts-2.0.dtd">
<struts>
    <include file="struts-default.xml" />

    <!-- 定义含“权限检查拦截器”的包，供其他模块引用 -->
    <package name="struts-default-with-auth-check" extends="struts-default">
        <interceptors>
            
            <!-- 定义“权限检查拦截器” -->
            <interceptor name="authCheck"
                class="interceptor.AuthCheckInterceptor">
            </interceptor>
            
            <!-- 定义含“权限检查拦截器”的拦截器栈，注意缺省的拦截器栈“defaultStack”要放在前面 -->
            <interceptor-stack name="myStack">
                <interceptor-ref name="defaultStack" />
                <interceptor-ref name="authCheck"></interceptor-ref>
            </interceptor-stack>
        </interceptors>
        
        <!-- 正式应用可能含很多package，为了能从其他package中跳转到登录页面，把登录页面定义成全局result -->
        <default-interceptor-ref name="myStack"></default-interceptor-ref>

        <global-results>
            <result name="globalLogin">login.jsp</result>
        </global-results>
    </package>


    <!-- >>>>>>>>>>>>>>>>>>>>>> p1模块 <<<<<<<<<<<<<<<<<<<<<<<<<<<< -->
    
    <!-- 注意package的extends属性，系统中只有“登录/注销”操作不需要检查权限 -->
    <package name="p1" extends="struts-default">
        <!-- 登录 -->
        <action name="login" class="action.LoginAction">
            <result>welcome.jsp</result>
            <result name="input">login.jsp</result>
        </action>

        <!-- 注销 -->
        <action name="logout" class="action.LogoutAction">
            <result>login.jsp</result>
        </action>
    </package>
     
    <!-- >>>>>>>>>>>>>>>>>>>>>> p2模块 <<<<<<<<<<<<<<<<<<<<<<<<<<<< -->
    
    <package name="p2" extends="struts-default-with-auth-check">
        <!-- 试图未经过登录，直接访问welcome页面，测试用 -->
        <action name="welcome" class="action.WelcomeAction">
            <result>welcome.jsp</result>
        </action>
    </package>

</struts>

LoginAction.java

package action;

import java.util.Date;
import java.util.Map;

import bean.LoginedUser;

import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionSupport;

@ SuppressWarnings ( "unchecked" )
public class LoginAction extends ActionSupport ...{

    private String name;

    private static final long serialVersionUID = -2907891170345505600L;

    @ Override
    public String execute() throws Exception ...{
        Map session = ActionContext.getContext().getSession();
        LoginedUser user = new LoginedUser();

        user.setName(name);
        user.setLoginTime(new Date());

        if (name.startsWith("U_")) ...{//假设用户名以"U_"开头才是合法的
            session.put("USER_INFO", user);//只有此处会向session里面加入key=“USER_INFO”的对象
            return SUCCESS;
        } else ...{
            addFieldError("name", "name is invalid.");
            return INPUT;
        }
    }

    public void validate() ...{
        if (null == name || name.trim().length() < 1) ...{
            addFieldError("name", "name is required.");
        }
    }

    public String getName() ...{
        return name;
    }

    public void setName(String name) ...{
        this.name = name;
    }

}

LogoutAction.java

package action;

import java.util.Map;

import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionSupport;

@ SuppressWarnings ( "unchecked" )
public class LogoutAction extends ActionSupport ...{

    private static final long serialVersionUID = -2907891170345505600L;

    @ Override
    public String execute() throws Exception ...{
        Map session = ActionContext.getContext().getSession();

        if (null != session.get("USER_INFO")) ...{// 刪除session中key="USER_INFO"的對象
            session.remove("USER_INFO");
        }

        return SUCCESS;//注销完毕，回到登录页面
    }

}

WelcomeAction.java

package action;

import com.opensymphony.xwork2.ActionSupport;

@ SuppressWarnings ( "unchecked" )
public class WelcomeAction extends ActionSupport ...{

    private static final long serialVersionUID = -2907891170345505600L;

    @ Override
    public String execute() throws Exception ...{
        return SUCCESS;
    }
}

AuthCheckInterceptor.java

package interceptor;

import java.util.Map;

import bean.LoginedUser;

import com.opensymphony.xwork2.ActionContext;
import com.opensymphony.xwork2.ActionInvocation;
import com.opensymphony.xwork2.interceptor.AbstractInterceptor;

@ SuppressWarnings ( "unchecked" )
public class AuthCheckInterceptor extends AbstractInterceptor ...{

    private static final long serialVersionUID = -4535462154177128320L;

    @ Override
    public String intercept(ActionInvocation ai) throws Exception ...{
        
        Map session  = ActionContext.getContext().getSession();
        LoginedUser user = (LoginedUser)session.get("USER_INFO");
        
        if(null==user)...{// 判断session里是否有key="USER_INFO"的对象
            return "globalLogin";// 转发到登录页面
        }
        return ai.invoke();
    }

}