java - 过滤器映射在 web.xml 中不起作用

Question

我在应用程序中创建了一个过滤器来处理登录/注销场景。过滤器映射不起作用。在我的web.xml ，如果我输入 <url-pattern>/LoginServlet/*</url-pattern> ，过滤器映射有效，但如果我输入jsp的名称，则它不起作用<url-pattern>/LoginServlet/list.jsp</url-pattern> 。我不想为所有jsp调用过滤器。

这是我的过滤器。

public class LoginFilter implements Filter{

    public void destroy() {
        // TODO Auto-generated method stub

    }

    public void doFilter(ServletRequest req, ServletResponse res,
            FilterChain chain) throws IOException, ServletException {
        System.out.println("LoginFilter : doFilter : Start");
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("Pragma", "no-cache");
        response.setHeader("Cache-Control", "no-cache");
        response.setDateHeader("Expires", 0);

        System.out.println("LoginFilter : doFilter : 111111");


        HttpSession session = request.getSession(false);

        if (session == null || session.getAttribute("user") == null) {
            System.out.println("LoginFilter : doFilter : 222222");
            response.sendRedirect("login.jsp");
            //response.sendRedirect(request.getContextPath() + "/login.jsp");
            //response.sendRedirect("login.jsp");
            //response.sendRedirect("http://localhost:8080/PROJECT_ELMS/login.jsp");
        }else {
            System.out.println("LoginFilter : doFilter : 33333333");
            chain.doFilter(request, response);
        }

    }

    public void init(FilterConfig arg0) throws ServletException {
        // TODO Auto-generated method stub

    }

}

这是我的web.xml .

<welcome-file-list>
    <welcome-file>login.jsp</welcome-file>
</welcome-file-list>
<listener>
    <listener-class>edu.umd.enpm613.helper.StartupListner</listener-class>
</listener>
<filter>
    <filter-name>loginFilter</filter-name>
    <filter-class>edu.umd.enpm613.servlet.LoginFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>loginFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
    <description></description>
    <display-name>LoginServlet</display-name>
    <servlet-name>LoginServlet</servlet-name>
    <servlet-class>edu.umd.enpm613.servlet.LoginServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>LoginServlet</servlet-name>
    <url-pattern>/LoginServlet/*</url-pattern>
</servlet-mapping>
<servlet>
    <description></description>
    <display-name>StudentServlet</display-name>
    <servlet-name>StudentServlet</servlet-name>
    <servlet-class>edu.umd.enpm613.servlet.StudentServlet</servlet-class>
</servlet>

LoginServlet 是:

public class LoginServlet extends HttpServlet  {
    private static final long serialVersionUID = 1L;

    /**
     * Default constructor. 
     */
    public LoginServlet() {
        // TODO Auto-generated constructor stub
    }

    /**
     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
     */
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // TODO Auto-generated method stub
    }

    /**
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
     */
    @SuppressWarnings("null")
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        System.out.println("LoginServlet : doPost : Start");
        LoginDTO returnedDTO = null;
        String userEmailId = request.getParameter("userid");
        try {
            request.getSession(true).setAttribute("user", userEmailId);
            String userPassword = request.getParameter("password");

            LoginDTO loginDto = new LoginDTO();
            loginDto.setUserEmailId(userEmailId);
            loginDto.setUserPassword(userPassword);

            returnedDTO = LoginImpl.getUserCategory(loginDto);

            String category = returnedDTO.getUserCategory();

            if (category.equals(ELMSConstants.CATEGORY_STUDENT)) {
                //request.getRequestDispatcher("student_home.jsp").forward(request,response);
                System.out.println("LoginServlet : doPost : Start" +request.getContextPath());
                System.out.println("LoginServlet : doPost : Start" +request.getRequestURI());
                System.out.println("LoginServlet : doPost : Start" + request.getRequestURL());
                request.getRequestDispatcher("list.jsp").forward(request,response);
            }
            if (category.equals(ELMSConstants.CATEGORY_TEACHER)) {
                System.out.println("LoginServlet : doPost : 22222222222");
                request.getRequestDispatcher("professor_home.jsp").forward(request,response);
            }


        }catch (ELMSException exp){
            exp.printStackTrace();
            System.out.println("LoginServlet : doPost : error message is" + exp.getMessage());

            if (exp.getMessage().equals(ELMSException.USER_NEED_TO_CHANGE_PASSWORD)) {
                System.out.println("LoginServlet : doPost : 1111111111");
                request.setAttribute("errorMessage", exp.getMessage());
                request.setAttribute("userName", userEmailId);
                request.getRequestDispatcher("changePassword.jsp").forward(request,response);
            }

            if (!exp.getMessage().equals(ELMSException.USER_NEED_TO_CHANGE_PASSWORD)) {
                request.setAttribute("errorMessage", exp.getMessage());
                request.getRequestDispatcher("login.jsp").forward(request,response);
            }

        }

    }
}

Answer 1

过滤器应该绕过登录页面，因为它没有安全限制，而且它还允许您映射所有 URL，而不会出现无限循环。

public void doFilter(ServletRequest req, ServletResponse res,
        FilterChain chain) throws IOException, ServletException {
    System.out.println("LoginFilter : doFilter : Start");
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    response.setHeader("Pragma", "no-cache");
    response.setHeader("Cache-Control", "no-cache");
    response.setDateHeader("Expires", 0);

    System.out.println("LoginFilter : doFilter : 111111");


    HttpSession session = request.getSession(false);

    //bypass the login page and login servlet

    if (request.getRequestURI().indexof("login.jsp") >= 0 ||
      request.getRequestURI().indexof("/LoginServlet") >= 0){
      System.out.println("LoginFilter : bypass the login");
      chain.doFilter(request, response);
    } else {
      if (session == null || session.getAttribute("user") == null) {
        System.out.println("LoginFilter : doFilter : 222222");
        response.sendRedirect("login.jsp");
        //response.sendRedirect(request.getContextPath() + "/login.jsp");
        //response.sendRedirect("login.jsp");
        //response.sendRedirect("http://localhost:8080/PROJECT_ELMS/login.jsp");
      } else {
        System.out.println("LoginFilter : doFilter : 33333333");
        chain.doFilter(request, response);
      }
    }
}