我们经常在各种网站登录账户，有的网站只有登录账户后才能访问到网页内容。
如果我们直接键入登陆成功后的页面网址 能不能访问呢?不能访问的原因是什么呢？
我写了一个登录页面 希望在登录成功的时候进入访问成功页面 失败的时候进入访问失败页面
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<base href="<%=basePath%>">
<title>My JSP 'index.jsp' starting page</title>
<meta http-equiv="pragma" content="no-cache">
<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="expires" content="0">
<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
<meta http-equiv="description" content="This is my page">
<!--
<link rel="stylesheet" type="text/css" href="styles.css">
-->
</head>
<body>
<form action="servlet/LoginServlet" method="post">
<table>
<tr>
<td>用户名：</td>
<td><input type="text" name="username"></td>
</tr>
<tr>
<td>密码：</td>
<td><input type="password" name=password></td>
</tr>
<tr>
<td><input type="submit" value="登录"> </td>
<td><input type="reset" value="重置"> </td>
</tr>
</table>
</form>
</body>
</html>
登录成功
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<base href="<%=basePath%>">
<title>My JSP 'success.jsp' starting page</title>
<meta http-equiv="pragma" content="no-cache">
<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="expires" content="0">
<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
<meta http-equiv="description" content="This is my page">
<!--
<link rel="stylesheet" type="text/css" href="styles.css">
-->
</head>
<body>
欢迎你，${username}
</body>
</html>
登录失败
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<base href="<%=basePath%>">
<title>My JSP 'success.jsp' starting page</title>
<meta http-equiv="pragma" content="no-cache">
<meta http-equiv="cache-control" content="no-cache">
<meta http-equiv="expires" content="0">
<meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
<meta http-equiv="description" content="This is my page">
<!--
<link rel="stylesheet" type="text/css" href="styles.css">
-->
</head>
<body>
登陆失败！！
</body>
</html>
servlet处理登录界面的表单数据
String username;
String password;
//获取表单的帐号 密码
username=req.getParameter("username");
password=req.getParameter("password");
//如果帐号为admin 密码为123456 则登录成功
if("admin".equals(username)&&"123456".equals(password)){
//将用户保存的session中
req.getSession().setAttribute("username", username);
//跳转到成功界面
resp.sendRedirect("../success.jsp");
}else{
//跳转到失败界面
resp.sendRedirect("../fail.jsp");
}
运行结果：
运行结果似乎很正确。帐号密码输入正确成功登录 否则登录失败。
可是如果我们直接键入成功页面好像也登录成功了 ，但是与我们的设计是不一致的。
这时候就需要过滤器了
web.xml
<filter>
<filter-name>LoginFilter</filter-name>
<filter-class>Filter.LoginFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>LoginFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Filter类
package Filter;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
public class LoginFilter implements Filter {
public void destroy() {
}
public void doFilter(ServletRequest arg0, ServletResponse arg1,
FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) arg0;
HttpServletResponse responst = (HttpServletResponse) arg1;
//如果是登录页面 或者servlet处理页面 直接放行
if(request.getRequestURI().indexOf("/index.jsp")!=-1||
request.getRequestURI().indexOf("/servlet/LoginServlet")!=-1||
request.getRequestURI().indexOf("/fail.jsp")!=-1){
chain.doFilter(arg0, arg1);
return ;
}
if(request.getSession().getAttribute("username")!=null){
chain.doFilter(arg0, arg1);
}else{
responst.sendRedirect("index.jsp");
}
}
public void init(FilterConfig arg0) throws ServletException {
}
}
运行结果如下
使用过滤器后发现 我们直接键入登录成功页面 会自动跳转到登录界面 不会存在未登录就进入成功访问页面的问题。
合理的使用过滤器 能够避免用户未经登录就成功访问的页面的不安全。
