自定义拦截器
SpringMVC的拦截器HandlerInterceptorAdapter对应提供了三个preHandle,postHandle,afterCompletion方法。preHandle在业务处理器处理请求之前被调用,
postHandle在业务处理器处理请求执行完成后,生成视图之前执行,afterCompletion在DispatcherServlet完全处理完请求后被调用,可用于清理资源等 。所以要想实现自己的权限管理逻辑,需要继承HandlerInterceptorAdapter并重写其三个方法
1.在servlet-context.xml中定义拦截器
<interceptors> <interceptor> <!-- 对所有的请求拦截使用/** ,对某个模块下的请求拦截使用:/myPath/* --> <mapping path="/**" /> <beans:bean class="com.pccw.mobile.fixipapi.IPWhiteListApiInterceptor" /> </interceptor> <interceptor> <mapping path="/**"/> <beans:bean class="com.pccw.mobile.fixipapi.BasicAuthorizationInterceptor"/> </interceptor> </interceptors>
拦截器是上一层true通过再进入下一层拦截器
3.添加拦截器代码,例如拦截IP进行验证
public class IPWhiteListApiInterceptor extends HandlerInterceptorAdapter {
private static final Logger logger = LoggerFactory.getLogger(IPWhiteListApiInterceptor.class);
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
throws Exception {
String ip = request.getRemoteHost().equals("0:0:0:0:0:0:0:1")?"127.0.0.1":request.getRemoteHost();
logger.info("Request From [{}]",ip);
if(SystemConfig.getIp_white_list().contains(ip)){
//judge uri
String requestURI = request.getRequestURI();
logger.info("access url : " + requestURI);
String get_apn_link = requestURI.substring(0,requestURI.indexOf("mobilefixip")+11);
logger.info("get_apn_link : " + get_apn_link);
if(get_apn_link.equals("/MobileFixIPAPI/api/mobilefixip")){
return true;
}
response.setStatus(403);
response.getWriter().print("Forbidden for resource access, please check username, password, source I.P. address and URL requested");
return false;
}else{
response.setStatus(403);
response.getWriter().print("Forbidden for resource access, please check username, password, source I.P. address and URL requested");
return false;
}
}
}
参考:
http://blog.youkuaiyun.com/tonytfjing/article/details/39207551