如何禁止從jl頁面的url直接訪問頁面

Question

我創建了一個Web應用程序。 一切正常。但是，如果用戶還沒有登錄，他們可以通過URL訪問其他jsp頁面。 我想停止訪問網址。 我看到一些例子，它顯示了過濾器的用法。 我是過濾器的新手，我不知道如何實現它。 我正在使用servlets，dao和jsp頁面。

請建議我怎么做。 我想為所有jsp或servlets頁面制作一個過濾器。

web.xml中

<?xml version="1.0" encoding="UTF-8"?>

    <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
        <filter>
            <filter-name>MyFilter</filter-name>
            <filter-class>com.eis.servlet.MyFilter</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>MyFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
        <servlet>
            <servlet-name>login</servlet-name>
            <servlet-class>com.eis.servlet.LoginServlet</servlet-class>
        </servlet>
        <servlet>
            <servlet-name>DayWiseServlet</servlet-name>
            <servlet-class>com.eis.servlet.DayWiseServlet</servlet-class>
        </servlet>
        <servlet>
            <servlet-name>RegisterServlet</servlet-name>
            <servlet-class>com.eis.servlet.RegisterServlet</servlet-class>
        </servlet>
        <servlet-mapping>
            <servlet-name>login</servlet-name>
            <url-pattern>/LoginServlet</url-pattern>
        </servlet-mapping>
        <servlet>
            <servlet-name>RetrieveServlet</servlet-name>
            <servlet-class>com.eis.servlet.RetrieveServlet</servlet-class>
        </servlet>
        <servlet-mapping>
            <servlet-name>RetrieveServlet</servlet-name>
            <url-pattern>/RetrieveServlet</url-pattern>
        </servlet-mapping>
        <servlet>
            <servlet-name>TimeSheet</servlet-name>
            <servlet-class>com.eis.servlet.TimeSheet</servlet-class>
        </servlet>
        <servlet-mapping>
            <servlet-name>TimeSheet</servlet-name>
            <url-pattern>/TimeSheet</url-pattern>
        </servlet-mapping>
        <servlet-mapping>
            <servlet-name>DayWiseServlet</servlet-name>
            <url-pattern>/DayWiseServlet</url-pattern>
        </servlet-mapping>
        <servlet-mapping>
            <servlet-name>RegisterServlet</servlet-name>
            <url-pattern>/RegisterServlet</url-pattern>
        </servlet-mapping>
        <welcome-file-list>
            <welcome-file>/index.jsp</welcome-file>
        </welcome-file-list>
        <session-config>
            <session-timeout>15</session-timeout>
        </session-config>
    </web-app>

loginservlet.java

public class LoginServlet extends HttpServlet{  

    private static final long serialVersionUID = 1L;  

    @Override
    public void doGet(HttpServletRequest request, HttpServletResponse response)    
            throws ServletException, IOException {    


        response.setContentType("text/html");    
        PrintWriter out = response.getWriter();    

        String n=request.getParameter("Emp_id");    
        String p=request.getParameter("Pwd");   
        String Usertype=request.getParameter("usertype"); 


        HttpSession session = request.getSession(false);  
        if(session!=null){
        session.setAttribute("name", n);  
        session.setAttribute("usertype", Usertype);
        }
        if(LoginDao.validate(n,p)){    
            RequestDispatcher rd=request.getRequestDispatcher("/daywise.jsp");    
            rd.forward(request,response);    
        }    
        else{    
            out.print("<p style=\"color:red\">Sorry Employee ID or password error</p>");    
            RequestDispatcher rd=request.getRequestDispatcher("/index.jsp");    
            rd.include(request,response);  

        }    

        out.close();    
    }
     protected void doPost(HttpServletRequest request,
            HttpServletResponse response)
            throws ServletException, IOException {
        doGet(request, response);
    }


}   

myfilter：

public class MyFilter implements Filter{  

@Override
public void init(FilterConfig config) throws ServletException {}  

@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {  

    HttpServletRequest req = (HttpServletRequest)request;
    HttpServletResponse resp = (HttpServletResponse)response;

        if(null==((String) req.getSession().getAttribute("empid")) || ((String) req.getSession().getAttribute("empid")).equals("")){
            chain.doFilter(req, resp);
    } else {
      resp.sendRedirect("/WebTimeSheet/index.jsp");
  }
    }  
@Override
    public void destroy() {}  
}  

Loginpage：

<form action="LoginServlet" method="post">  
    <fieldset style="width: 300px">  
        <legend> Login to App </legend>   
        <table>  
            <tr>  
                <td>User ID</td>  
                <td><input type="text" name="Emp_id" required="required" /></td>  
            </tr>  
            <tr>  
                <td>Password</td>  
                <td><input type="password" name="Pwd" required="required" /></td>  
            </tr> 
           <tr>  
                <td>User Type</td>  
                <td> <select name="usertype">
                <option>Employee</option>
                <option>Manager</option>
                <option>Admin</option>
            </select></td>   
            </tr>
            <tr>  
                <td><input type="submit" value="Login" /></td>  
            </tr>  
        </table>  
    </fieldset>  
</form>  
</body>  
<%@include file="/footer.jsp" %>
</html>  

我所有的jsp頁面都在Web-inf文件夾之外的網頁文件夾中。 Web-inf文件夾只有web.xml init

header.jsp中

 <c:choose>
             <c:when test="${usertype eq 'Employee'}">
        <div class="nav">      
            <ul><li class="container"><img src="${pageContext.request.contextPath}/images/enabling.jpg" /></li>
            <li class="current"><a href="WEB-INF/daywise.jsp">DayWise TimeSheet</a></li>
            <li><a href="WEB-INF/timesheet.jsp">Weekly TimeSheet</a></li>
            </ul>
        </div>
     </c:when>
     <c:when test="${usertype eq 'Manager'}">
        <div class="nav">      
            <ul><li class="container"><img src="${pageContext.request.contextPath}/images/enabling.jpg" /></li>
            <li class="current"><a href="/WEB-INF/daywise.jsp">DayWise TimeSheet</a></li>
            <li><a href="WEB-INF/timesheet.jsp">Weekly TimeSheet</a></li>
            <li><a href="WEB-INF/newemployee.jsp">Add New Employeer</a></li>
            <li><a href="WEB-INF/retrieve.jsp">Retrieve TimeSheet</a></li>
            </ul>
        </div>
     </c:when>

Answer 1

首先，JSP不應該用於提供請求，它們應該用於呈現視圖。 Servlet應該用於提供請求，然后轉發到JSP。

這是一個例子：

public class HelloWorld extends HttpServlet {

  public void doGet(HttpServletRequest request,
                HttpServletResponse response)
        throws ServletException, IOException
  {
     //do some stuff

     //forward to JSP to show result
     String nextJSP = "/WEB_INF/result.jsp";
     RequestDispatcher dispatcher = getServletContext().getRequestDispatcher(nextJSP);
     dispatcher.forward(request,response);
  }
}

在web.xml中：

<servlet>
  <servlet-name>HelloWorldServlet</servlet-name>
  <servlet-class>your.package.HelloWorld</servlet-class>
</servlet>

<servlet-mapping>
  <servlet-name>HelloWorldServlet</servlet-name>
  <url-pattern>/someurl</url-pattern>
</servlet-mapping>

在此示例中，servlet轉發到WEB-INF目錄中的JSP。 通過將所有JSP放在WEB-INF目錄中，這意味着無法直接請求它們。

現在你有一個Servlet，你可以設置一個Servlet過濾器：

public class MyFilter implements Filter {

  public void doFilter(ServletRequest req, ServletResponse res,
        FilterChain chain) throws IOException, ServletException {

    if (isLoggedIn) {
      //if user is logged in, complete request
      chain.doFilter(req, res);
    } else {
      //not logged in, go to login page
      res.sendRedirect("/login");
  }
}

在web.xml中：

<filter>
  <filter-name>MyFilter</filter-name>
  <filter-class>your.package.MyFilter</filter-class>
</filter>
<filter-mapping>
  <filter-name>MyFilter</filter-name>
  <url-pattern>/secret/*</url-pattern>
</filter-mapping>

這樣，任何符合模式/secret/* URL都將被過濾，以便需要登錄。

Answer 2

您需要使用servlet過濾器並匹配所有請求。

在該過濾器中，您需要檢查授權。

這是官方文檔的例子

Answer 3

您可以在響應標頭中設置身份驗證cookie

Cookie someCookie = new Cookie("cookie_name","some_value" );

和， response.addCookie(someCookie)

然后，在您的過濾器內，您可以決定根據cookie值調用chain.doFilter(req, res) 。

你可以通過cookie.setMaxAge();來控制cookie的年齡cookie.setMaxAge(); 即。 注銷時將最大年齡設置為“0”。