JSP登录前后改变JSESSIONID

最新推荐文章于 2024-09-20 19:50:03 发布

原创最新推荐文章于 2024-09-20 19:50:03 发布 · 4.8k 阅读

3 ·

CC 4.0 BY-SA版权

Java 专栏收录该内容

20 篇文章

订阅专栏

本文探讨了在JSP登录过程中JSESSIONID如何发生变化，并重点讲解了如何通过配置web.xml的filter来确保登录状态的正确跟踪。特别是强调了filter的顺序，需要置于Struts2插件过滤器之前。

配置web.xml的filter(需要配置在Struts2插件过滤器前)

 <filter>
 <filter-name>filter1</filter-name>
 <filter-class>filter.LoginFilter1</filter-class>
 </filter>
 <filter-mapping>
 <filter-name>filter1</filter-name>
 <url-pattern>/*</url-pattern>
 </filter-mapping>

增加Filter

package filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;


public class LoginFilter1 implements Filter {//尝试改变JSESSIONID

	@Override
	public void destroy() {
		// TODO Auto-generated method stub
		System.out.println("LoginFilter1 destroy");
	}

	@Override
	public void doFilter(ServletRequest arg0, ServletResponse arg1,
			FilterChain arg2) throws IOException, ServletException {
		// TODO Auto-generated method stub
		HttpServletRequest httpRequest = (HttpServletRequest)arg0;  
		StringBuffer ul = httpRequest.getRequestURL();		
		
		if(ul.toString().contains("login!getintoindex.do")){
			HttpSession session = httpRequest.getSession(false);
			
			if ( session != null && !session.isNew() ) {//isNew() Returns true if the client does not yet know about the session or if the client chooses not to join the session.
				HttpSession sessionOld = session; 
				User user = (User)sessionOld.getAttribute("user");

				sessionOld.invalidate();
				
				session = httpRequest.getSession(true);
				session.setAttribute("user", user);

				System.out.println("LoginFilter1 doFilter,url: " + httpRequest.getRequestURL()+" , session id: " + httpRequest.getSession().getId());
			}			
		}
		
		if(ul.toString().contains("top!logout.do")){//
			HttpSession session = httpRequest.getSession(false);
			if ( session != null && !session.isNew() ) {
				HttpSession sessionOld = session; 
				sessionOld.invalidate();
				session = httpRequest.getSession(true);
				
				System.out.println("LoginFilter1 doFilter,logout. ");
			}
			
		}
		
			
		
		arg2.doFilter(arg0, arg1);
		
		
		
		
	}

	@Override
	public void init(FilterConfig arg0) throws ServletException {
		// TODO Auto-generated method stub
		System.out.println("LoginFilter1 init");
	}

}