Question

我当前正在使用Page Controller 映射页面。

每个页面都需要检查Session，这是重复的代码。

如何避免重复此代码？

@Controller
public class PageController {
...
    @RequestMapping("/view/List")
    public String list(Map<String, Object> model) {
        String session_chk = Utils.SessionCheck(); 
        if(session_chk.equals("none")){
            return "/view/manager/Login";
        }

        return "/view/member/List";
    }

    @RequestMapping("/view/Detail")
    public String detail(Map<String, Object> model) {
        String session_chk = Utils.SessionCheck();
        if(session_chk.equals("none")){
            return "/view/manager/Login";
        }

        return "/view/member/Detail";
    }
...

Answer 1

您可以使用Spring Security避免与保护Web应用程序相关的所有重复代码，它还提供了内置保护，可防止诸如 session fixation ， clickjacking ，< em>跨站点请求伪造及其他。这是用于保护基于Spring的应用程序的实际标准。

Here，您可以找到一系列不错的教程来学习 Spring Security 。

Here，您可以找到一个小示例，在其中您将看到我如何仅使用 Spring Security 配置来处理与您类似的情况。

这是我的 Spring Security 配置类

@Configuration
@EnableWebSecurity
public class SecSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(final AuthenticationManagerBuilder auth) throws Exception {    
        auth.inMemoryAuthentication()
                .withUser("user1").password(passwordEncoder().encode("user1Pass")).roles("USER")
                .and()
                .withUser("user2").password(passwordEncoder().encode("user2Pass")).roles("USER")
                .and()
                .withUser("admin").password(passwordEncoder().encode("adminPass")).roles("ADMIN");      
    }

    @Override
    protected void configure(final HttpSecurity http) throws Exception {     
        http
                .csrf().disable()
                .authorizeRequests()
                // Only users with admin role will access views starting with /admin
                .antMatchers("/admin/**").hasRole("ADMIN")
               //  Anonymous users (users without sessions) will access this URL
                .antMatchers("/anonymous*").anonymous()
               // Allowing all users to access login page
                .antMatchers("/login*").permitAll()
                .anyRequest().authenticated()
                .and()
                .formLogin()
                .loginPage("/login.html")
                .loginProcessingUrl("/perform_login")
                .defaultSuccessUrl("/homepage.html", true)              
                .failureHandler(authenticationFailureHandler())
                .and()
                .logout()
                .logoutUrl("/perform_logout")
                .deleteCookies("JSESSIONID")
                .logoutSuccessHandler(logoutSuccessHandler())
                .and()
                .exceptionHandling().accessDeniedPage("/accessDenied");     
    }

    @Bean
    public LogoutSuccessHandler logoutSuccessHandler() {
        return new CustomLogoutSuccessHandler();
    }

    @Bean
    public AuthenticationFailureHandler authenticationFailureHandler() {
        return new CustomAuthenticationFailureHandler();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Answer 2

添加一个将重定向的过滤器，并添加检查

@Component
public class SessionFilter extends OncePerRequestFilter {
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
    if (!request.getRequestURI().contains("view/manager/Login") && "none".equals(Utils.SessionCheck())) {
      httpResponse.sendRedirect("view/manager/Login.jsp");
      //....
    } else {
      doFilterInternal(request, response, filterChain);
    }
}

您可以将其添加到所有网址：

FilterRegistration sessionFilter = servletContext.addFilter("SessionFilter", SessionFilter.class);
sessionFilter.addMappingForUrlPatterns(null, false, "/*");

如何避免Spring项目中重复的映射代码？

2 个答案: