过滤器Filter、小型用户管理系统权限管理

过滤器Filter

自己手写代码实现

在com.zhongruan下面新建一个Filter的包，新建一个LoginFilter的类实现Filter接口，代码如下图所示：

实现Filter接口的三个方法，其中主要的代码实在doFilter中编写。

在web.xml中的filter部分添加我们自己编写的过滤器，相关代码如下图所示：

在controller层修改之前的login.do如下图所示：

之后运行项目，在浏览器网址中输入http://localhost:8080/findAll.do，发现网址变成了http://localhost:8080/login.jsp，页面还是停留在了登录页面：

好啦，自己手写的代码部分就到此为止啦！

Springsecurity框架

面向切面(AOP)编程：把与业务逻辑无关的公共代码抽取出来，减少代码的重复度。

准备工作：

删除之前写的代码，将代码恢复至原来的样子。

springsecurity：
1.认证：判断用户名密码是否正确
2.权限：看某个角色是否有权限实行某些操作

导jar包：
版本号放入pom.xml的properties中

        <spring.security.version>5.0.1.RELEASE</spring.security.version>

dependency:

<dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>${spring.security.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>${spring.security.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-core</artifactId>
            <version>${spring.security.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-taglibs</artifactId>
            <version>${spring.security.version}</version>
        </dependency>

在web.xml中填写有关filter的代码：

  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

拷贝springSecurity的配置文件至resource包下：

在web.xml文件中修改下述部分：

  <!-- 配置加载类路径的配置文件 -->
  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath*:applicationContext.xml,classpath*:spring-security.xml</param-value>
  </context-param>

springsecurity的xml文件就相当于之前的controller文件，通过下面的代码来制定在不同情况改跳转的页面：

    <security:http auto-config="true" use-expressions="true">
        <!-- 配置具体的拦截的规则 pattern="请求路径的规则" access="访问系统的人，必须有ROLE_USER的角色" -->
        <security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')"/>

        <security:form-login login-page="/login.jsp"
                             login-processing-url="/login.do"
                            default-target-url="/index.jsp"
                            authentication-failure-url="/failer.jsp"
                            authentication-success-forward-url="/pages/main.jsp"/>

        <!-- 关闭跨域请求 -->
        <security:csrf disabled="true"/>

这个报红的地方修改为我们的userInfoService，修改完之后还是红色的，不用管它。
IUserInfoService：

package com.zhongruan.service;

import com.zhongruan.bean.UserInfo;
import org.springframework.security.core.userdetails.UserDetailsService;

import java.util.List;

public interface IUserInfoService extends UserDetailsService {
    public List<UserInfo> findAll(int page,int size);
    public boolean login(UserInfo userInfo);
    public void add(UserInfo userInfo);
    public UserInfo selectById(int id);
    public void update(UserInfo userInfo);
    public void delete(int id);
}

IUserInfoServiceImpl:

package com.zhongruan.service.Impl;

import com.github.pagehelper.PageHelper;
import com.zhongruan.bean.Role;
import com.zhongruan.bean.UserInfo;
import com.zhongruan.dao.IRoleDao;
import com.zhongruan.dao.IUserInfoDao;
import com.zhongruan.service.IUserInfoService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

@Service("userInfoService")
public class UserInfoServiceImpl implements IUserInfoService {
    @Autowired
    private IUserInfoDao userInfoDao;
    @Autowired
    private IRoleDao roleDao;
    @Override
    public List<UserInfo> findAll(int page,int size) {
        PageHelper.startPage(page,size);
        return userInfoDao.findAll();
    }
    public boolean login(UserInfo userInfo){
        UserInfo user = userInfoDao.login(userInfo);
        if(user!=null)
        {
            return true;
        }
        else
            return false;
    }

    @Override
    public void add(UserInfo userInfo) {
        userInfoDao.add(userInfo);
    }

    @Override
    public UserInfo selectById(int id) {
        return userInfoDao.selectById(id);
    }

    @Override
    public void update(UserInfo userInfo) {
        userInfoDao.update(userInfo);
    }

    @Override
    public void delete(int id) {
        userInfoDao.delete(id);
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        UserInfo userInfo=userInfoDao.findUserByUserName(username);
        List<Role> roles=roleDao.findRoleByUserId(userInfo.getId());
        User user=new User(userInfo.getUsername(),"{noop}"+userInfo.getPassword(),getAuthority(roles));
        return user;
    }

    private Collection<? extends GrantedAuthority> getAuthority(List<Role> roles) {
        List<SimpleGrantedAuthority> list=new ArrayList<>();
        for(Role role:roles){
            list.add(new SimpleGrantedAuthority("ROLE_"+role.getRolename()));
        }
        return list;
    }
}

Role类：

package com.zhongruan.bean;

public class Role {
    private int id;
    private String rolename;
    private String roleDesc;

    public int getId() {
        return id;
    }

    public void setId(int id) {
        this.id = id;
    }

    public String getRolename() {
        return rolename;
    }

    public void setRolename(String rolename) {
        this.rolename = rolename;
    }

    public String getRoleDesc() {
        return roleDesc;
    }

    public void setRoleDesc(String roleDesc) {
        this.roleDesc = roleDesc;
    }

    @Override
    public String toString() {
        return "Role{" +
                "id=" + id +
                ", rolename='" + rolename + '\'' +
                ", roleDesc='" + roleDesc + '\'' +
                '}';
    }
}

IRoleDao:

package com.zhongruan.dao;

import com.zhongruan.bean.Role;

import java.util.List;

public interface IRoleDao {
    List<Role> findRoleByUserId(int id);
}

RoleMapper.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
<mapper namespace="com.zhongruan.dao.IRoleDao" >
 <select id="findRoleByUserId" parameterType="int" resultType="com.zhongruan.bean.Role" >
     select * from role where id in (select roleid from user_role where userid=#{id})
 </select>

</mapper>

UserInfoMapper.xml

 <select id="findUserByUserName" parameterType="String" resultType="com.zhongruan.bean.UserInfo">
        select * from userinfo where username=#{username}
    </select>

注释掉controller里面的login函数，在login.jsp中去掉之前写的user路径，修改之后如下图所示：

此外还需新建role、user_role的数据库
运行结果如下图所示：