RBAC ->基于角色的权限控制
- l tb_user
- l tb_role
- l tb_userrole
- l tb_menu(增、删、改、查)
- l tb_rolemenu
1 说明
我们给出三个页面:index.jsp、user.jsp、admin.jsp。
l index.jsp:谁都可以访问,没有限制;
l user.jsp:只有登录用户才能访问;
l admin.jsp:只有管理员才能访问。
2 分析
设计User类:username、password、grade,其中grade表示用户等级,1表示普通用户,2表示管理员用户。
当用户登录成功后,把user保存到session中。
创建LoginFilter,它有两种过滤方式:
l 如果访问的是user.jsp,查看session中是否存在user;
l 如果访问的是admin.jsp,查看session中是否存在user,并且user的grade等于2。
3 代码
User.java
public class User { private String username; private String password; private int grade[崔1] ; … } |
[崔1]用户等级
[崔2]所有用户
[崔3]在Map中保存两个用户,zhangSan的等级为1,liSi的等级为2
[崔4]登录方法
[崔5]通过用户名获取用户
[崔6]如果用户名不存在,返回null
[崔7]如果密码不对返回null,如果密码正确返回用户
为了方便,这里就不使用数据库了,所以我们需要在UserService中创建一个Map,用来保存所有用户。Map中的key中用户名,value为User对象。
UserService.java
public class UserService { private static Map<String,User> users [崔2] = new HashMap<String,User>(); static { users.put("zhangSan", new User("zhangSan", "123", 1)); users.put("liSi", new User("liSi", "123", 2)); [崔3] } public User login[崔4] (String username, String password) { User user = users.get(username);[崔5] if(user == null) return null;[崔6] return user.getPassword().equals(password) ? user : null;[崔7] } } |
login.jsp
<body> <h1>登录</h1> <p style="font-weight: 900; color: red">${msg }[崔8] </p> <form action="<c:url value='/LoginServlet'/>" method="post"> 用户名:<input type="text" name="username"/><br/> 密 码:<input type="password" name="password"/><br/> <input type="submit" value="登录"/> </form> </body> |
[崔8]当登录出错时返回到login.jsp页面,显示“用户名或密码错误”
index.jsp
<body> <h1>主页</h1> <h3>${user.username }</h3> <hr/> <a href="<c:url value='/login.jsp'/>">登录</a><br/> <a href="<c:url value='/user/user.jsp'/>">用户页面</a><br/> <a href="<c:url value='/admin/admin.jsp'/>">管理员页面</a> </body> |
/user/user.jsp
<body> <h1>用户页面</h1> <h3>${user.username }</h3> <hr/> </body> |
/admin/admin.jsp
<body> <h1>管理员页面</h1> <h3>${user.username }</h3> <hr/> </body> |
LoginServlet
public class LoginServlet extends HttpServlet { public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { request.setCharacterEncoding("utf-8"); response.setContentType("text/html;charset=utf-8"); String username = request.getParameter("username"); String password = request.getParameter("password"); [崔9] UserService userService = new UserService(); User user = userService.login(username, password);[崔10] if(user == null[崔11] ) { request.setAttribute("msg", "用户名或密码错误"); request.getRequestDispatcher("/login.jsp").forward(request, response); [崔12] } else { request.getSession().setAttribute("user", user); request.getRequestDispatcher("/index.jsp").forward(request, response); [崔13] } } } |
[崔9]获取表单数据
[崔10]调用userService的login()方法完成登录
[崔11]返回的user为null表示登录失败
[崔12]在request 中保存错误信息,转发到login.jsp页面显示错误信息
[崔13]如果登录成功,把user对象保存到session中,并转发到index.jsp页面
LoginUserFilter.java
<filter> <display-name>LoginUserFilter</display-name> <filter-name>LoginUserFilter</filter-name> <filter-class>cn.itcast.filter.LoginUserFilter</filter-class> </filter> <filter-mapping> <filter-name>LoginUserFilter</filter-name> <url-pattern>/user/*[崔14] </url-pattern> </filter-mapping> |
public class LoginUserFilter implements Filter { public void destroy() {} public void init(FilterConfig fConfig) throws ServletException {} public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { response.setContentType("text/html;charset=utf-8"); HttpServletRequest req = (HttpServletRequest) request; User user = (User) req.getSession().getAttribute("user");[崔15] if(user == null)[崔16] { response.getWriter().print("您还没有登录");[崔17] return;[崔18] } chain.doFilter(request, response);[崔19] } } |
[崔14]通过/user下的页面
[崔15]在session中获取当前user对象
[崔16]如果session中不存在user,说明当前用户还没有登录
[崔17]各客户端浏览器打印错误消息
[崔18]一定要返回,不然会向下执行“放行”的。
[崔19]如果在session中存在user,那么就放行
LoginAdminFilter.java
<filter> <display-name>LoginAdminFilter</display-name> <filter-name>LoginAdminFilter</filter-name> <filter-class>cn.itcast.filter.LoginAdminFilter</filter-class> </filter> <filter-mapping> <filter-name>LoginAdminFilter</filter-name> <url-pattern>/admin/*[崔20] </url-pattern> </filter-mapping> |
public class LoginAdminFilter implements Filter { public void destroy() {} public void init(FilterConfig fConfig) throws ServletException {} public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { response.setContentType("text/html;charset=utf-8"); HttpServletRequest req = (HttpServletRequest) request; User user = (User) req.getSession().getAttribute("user");[崔21] if(user == null) { response.getWriter().print("您还没有登录!"); return; if(user.getGrade() < 2) { response.getWriter().print("您的等级不够!"); return; chain.doFilter(request, response);[崔24] } } |
禁用资源缓存
浏览器只是要缓存页面,这对我们在开发时测试很不方便,所以我们可以过滤所有资源,然后添加去除所有缓存!
public class NoCacheFilter extends HttpFilter { public void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws IOException, ServletException { response.setHeader("cache-control", "no-cache"); response.setHeader("pragma", "no-cache"); response.setHeader("expires", "0"); chain.doFilter(request, response); } } |
但是要注意,有的浏览器可能不会理会你的设置,还是会缓存的!这时就要在页面中使用时间戳来处理了。
[崔20]过滤/admin目录下的页面
[崔21]获取session中的user
[崔22]如果user为null,说明用户没有登录
[崔23]如果用户等级小于2,说明是普通用户,而不是管理员用户
[崔24]放行
完整代码
1、index.jsp
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<base href="<%=basePath%>"> <title>My JSP 'index.jsp' starting page</title>
<meta http-equiv="pragma" content="no-cache">
<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="expires" content="0">
<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
<meta http-equiv="description" content="This is my page">
<!--
<link rel="stylesheet" type="text/css" href="styles.css">
-->
</head> <body>
<h1>你就是个游客而已</h1>
<a href="<c:url value='/index.jsp'/>">游客入口</a><br/> /* 加这么几个超链接*/
<a href="<c:url value='/users/u.jsp'/>">会员入口</a><br/>
<a href="<c:url value='/admin/a.jsp'/>">管理员入口</a><br/>
</body>
</html>
2、login.jsp
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>My JSP 'login.jsp' starting page</title> <meta http-equiv="pragma" content="no-cache">
<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="expires" content="0">
<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
<meta http-equiv="description" content="This is my page">
<!--
<link rel="stylesheet" type="text/css" href="styles.css">
--> </head> <body>
<h1>登录</h1>
${msg }
<form action="<c:url value='/LoginServlet'/>" method="post"> //获取表单数据,方法为post方法;
用户名:<input type="text" name="username"/>
<input type="submit" value="登录"/>
</form>
</body>
</html>
3、LoginServlet.java
package cn.itcast.web.servlet; import java.io.IOException; import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse; public class LoginServlet extends HttpServlet { public void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
request.setCharacterEncoding("utf-8");
response.setContentType("text/html;charset=utf-8"); /*
* 1. 获取用户名
* 2. 判断用户名中是否包含itcast
* 3. 如果包含,就是管理员
* 4. 如果不包含,就是普通会员
* 5. 要把登录的用户名称保存到session中,一定要保存在session空间
* 6. 转发到index.jsp
*/
String username = request.getParameter("username"); //得到用户名
if(username.contains("itcast")) { //这里设置只要用户名包含idcast就是管理员;
request.getSession().setAttribute("admin", username); //登录数据一定要保存在session空间admin中;
} else {
request.getSession().setAttribute("username", username); //键有区别;一个是admin,一个是
}
request.getRequestDispatcher("/index.jsp").forward(request, response); //跳转下一个
}
}
下面两个保安,两个Filter
4、AdminFilter.java
package cn.itcast.web.filter; import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest; /**
* Servlet Filter implementation class AdminFilter
*/
public class AdminFilter implements Filter { public void destroy() {
} public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
/*
* 1. 得到session
* 2. 判断session域中是否存在admin,如果存在,放行
* 3. 判断session域中是否存在username,如果存在,放行,否则打回到login.jsp,并告诉它不要瞎留达
*/
HttpServletRequest req = (HttpServletRequest) request;
String name = (String)req.getSession().getAttribute("admin");
if(name != null) {
chain.doFilter(request, response);
} else {
req.setAttribute("msg", "您可能是个啥,但肯定不是管理员!");
req.getRequestDispatcher("/login.jsp").forward(request, response);
}
} public void init(FilterConfig fConfig) throws ServletException { }
}
5、UserFilter.java
package cn.itcast.web.filter; import java.io.IOException; import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest; public class UserFilter implements Filter {
public void destroy() {
} public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
/*
* 1. 得到session
* 2. 判断session域中是否存在admin,如果存在,放行
* 3. 判断session域中是否存在username,如果存在,放行,否则打回到login.jsp,并告诉它不要瞎留达
*/
HttpServletRequest req = (HttpServletRequest) request;
String name = (String)req.getSession().getAttribute("admin");
if(name != null) {
chain.doFilter(request, response);
return;
} name = (String)req.getSession().getAttribute("username");
if(name != null) {
chain.doFilter(request, response);
} else {
req.setAttribute("msg", "您啥都不是,不要瞎溜达!");
req.getRequestDispatcher("/login.jsp").forward(request, response);
}
} public void init(FilterConfig fConfig) throws ServletException { }
}