Java 中使用 Filter 實現權限與 Session 控制

使用 Filter 防止用戶訪問未授權資源，例如用戶未登錄不允許訪問某些頁面，重定向到登錄頁。相關示例：

package com.drp.util.filter;
import java.io.IOException;
import javax.servlet.*;
import javax.servlet.http.*;
public class AuthFilter implements Filter {
    public void destroy() {}
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
                         FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        String currentURL = request.getRequestURI();
        String targetURL = currentURL.substring(currentURL.indexOf("/", 1), currentURL.length());
        HttpSession session = request.getSession(false);
        if (!"/login.jsp".equals(targetURL)) {
            if (session == null || session.getAttribute("user") == null) {
                System.out.println("request.getContextPath()=" + request.getContextPath());
                response.sendRedirect(request.getContextPath() + "/login.jsp");
                return;
            }
        }
        filterChain.doFilter(request, response);
    }
    public void init(FilterConfig filterConfig) throws ServletException {}
}

在 web.xml 中添加配置（注意：Filter 在 Servlet 2.3 規範引入，web.xml 必須使用 DTD 2.3 以上版本）：

<filter>
  <filter-name>AuthFilter</filter-name>
  <filter-class>com.drp.util.filter.AuthFilter</filter-class>
</filter>
<filter-mapping>
  <filter-name>AuthFilter</filter-name>
  <url-pattern>*.jsp</url-pattern>
</filter-mapping>

這樣用戶未登錄情況下會自動轉向登錄頁。