SpringBoot自定义拦截器

最新推荐文章于 2023-03-21 17:36:27 发布

w_t_y_y

最新推荐文章于 2023-03-21 17:36:27 发布

阅读量177

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/w_t_y_y/article/details/84103762

本文介绍了一种在前端和后端实现权限控制的方法，通过判断当前登录用户是否为数据创建者来决定是否显示编辑和删除按钮。同时，通过自定义拦截器在后端进行二次验证，确保操作安全性。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

现有页面

export function updateReport(report, emails, views) {
  const id = report.id
  const reportName = report.reportName
  const safeLevel = report.safeLevel
  const reportUrl = report.reportUrl
  const remark = report.remark
  const reportType = report.reportType
  return request({

    url: '/report/updateReport',
    method: 'post',
    data: {
      id,
      reportName,
      reportUrl,
      safeLevel,
      remark,
      reportType,
      emails,
      views
    }
  })


export function deleteReport(reportId) {
  return request({
    url: '/report/deleteReport',
    method: 'post',
    data: {
      reportId
    }
  })
}

列表有查看、编辑、删除功能，前端判断该条数据的creator与当前登录用户是不是同一个人，如果是则展示编辑和删除按钮。为防止恶意攻击，可以在后端再加个拦截器，双重控制。

先自定义拦截器：


@Component
public class ReportHandler implements HandlerInterceptor{
	
	@Autowired
	private ReportService reportService;

	@Override
	public void afterCompletion(HttpServletRequest arg0,
			HttpServletResponse arg1, Object arg2, Exception arg3)
			throws Exception {
		// TODO Auto-generated method stub
		
	}

	@Override
	public void postHandle(HttpServletRequest arg0, HttpServletResponse arg1,
			Object arg2, ModelAndView arg3) throws Exception {
		// TODO Auto-generated method stub
		
	}

	@Override
	public boolean preHandle(HttpServletRequest req, HttpServletResponse arg1,
			Object arg2) throws Exception {
		
		try{
			String requestURI = req.getRequestURI();
            //是删除或者编辑请求
			if(requestURI.indexOf("updateReport")!=-1 || requestURI.indexOf("deleteReport")!=-1){
				String reportId = null;
              //删除的参数为reportId
				if(req.getParameter("reportId") != null){
					reportId = req.getParameter("reportId");
				}
             //编辑的参数为id
				if(req.getParameter("id") != null){
					reportId = req.getParameter("id");
				}
				Report report = reportService.getById(reportId);
				User user = new SessionUtil().getCurrentUser();
				if(!report.getCreator().equals(user.getId())){
					return false;
				}
			}
			return true;
		}catch (Exception e) {
			return true;
		}
		
	}

}

再把拦截器添加到SpringBoot配置中：


@SpringBootConfiguration
public class MySpringMVCConfig extends WebMvcConfigurerAdapter{

	@Autowired
	private ReportHandler reportHandler;

	@Override
	public void addInterceptors(InterceptorRegistry registry) {
		registry.addInterceptor(reportHandler).addPathPatterns("/**");
	}
	
	
}

即可。