spring如何做登录检测以及权限处理？

1.我们在Eclipse中建立一个类

SecurityInterceptor.java

package com.zcl.blog.framework.interceptors;

import java.util.List;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import com.zcl.blog.constants.GlobalConstants;
import com.zcl.blog.domain.po.SessionInfo;

/**
 * 
 * 登录检测及权限拦截器
 * 
 * @author Administrator
 *
 */
public class SecurityInterceptor implements HandlerInterceptor {
    
    private Log log = LogFactory.getLog(getClass());
    
    private List<String> ignoreUrls;// 不需要拦截的资源
    
    public List<String> getIgnoreUrls() {
        return ignoreUrls;
    }

    public void setIgnoreUrls(List<String> ignoreUrls) {
        this.ignoreUrls = ignoreUrls;
    }

    /**
     * 调用Controller具体方法前拦截
     */
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        boolean flag = false;
        String reqUri = request.getRequestURI();
        String ctxPath = request.getContextPath();
        String url = reqUri.substring(ctxPath.length());
        SessionInfo sessionInfo = (SessionInfo) request.getSession().getAttribute(GlobalConstants.SESSSION_INFO);
        System.out.println("SessionInfo:======" + sessionInfo);
        log.info("访问URL地址:======" + url);
        if(url.indexOf("/admin/login") > -1 || ignoreUrls.contains(url)) {// 不需要验证的访问资源
            flag = true;
        } else {
            if ((sessionInfo == null) || (sessionInfo.getId() == null)) {// 如果没有登录或超时
                flag = false;
                response.sendRedirect("/admin/login");
            } else {
                return true;
            }
        }
        return flag;
    }

    
    /**
     * 调用Controller具体方法后拦截
     */
    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
    }

    /**
     * 页面完成后调用该方法
     */
    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
    }

}

2.我们在Spring配置文件中添加如下代码

spring-config.xml

<!-- 拦截器配置 -->
    <mvc:interceptors>
        <mvc:interceptor>
            <mvc:mapping path="/**"/>
            <bean class="com.zcl.blog.framework.interceptors.SecurityInterceptor">
                <property name="ignoreUrls">
                    <list>
                        <value>/admin/adminlogin</value>
                        <value>/admin/logout</value>
                        <value>/error</value>
                        <value>/success</value>
                    </list>
                </property>
            </bean>
        </mvc:interceptor>
    </mvc:interceptors>

3.由于这个拦截器会拦截所有静态资源，我们在web.xml配置某些静态资源不经过Spring。

web.xml

<!-- 以下后缀名的文件不经过Spring -->
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.css</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.js</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.ico</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.html</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.jpg</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.png</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.jpeg</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.woff2</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.woff</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.ttf</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.eot</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>default</servlet-name>
        <url-pattern>*.map</url-pattern>
    </servlet-mapping>