[英]Java servlet filter not working on login
我編寫了一個過濾器類來為每個頁面添加一個P3P標頭。 我把它添加到我的web.xml:
<filter>
<filter-name>AddP3pHeaderFilter</filter-name>
<filter-class>com.mycompany.AddP3pHeaderFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>AddP3pHeaderFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
它會為每個頁面請求添加標頭,但在用戶首次登錄時不起作用。用戶將表單提交給j_security_check
,但響應不包含標頭。 如何使我的過濾器適用於登錄請求?
登錄請求轉發到適當的頁面。 默認情況下,過濾器僅適用於REQUEST調度。 您需要修改web.xml,如下所示:
<filter>
<filter-name>AddP3pHeaderFilter</filter-name>
<filter-class>com.mycompany.AddP3pHeaderFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>AddP3pHeaderFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
編輯:我認為這已經解決了,但我錯了。
我最終不得不使用Tomcat閥門。
不知道tomcat,但它在jetty中適用於我,只需將您的過濾器放在spring過濾器之前:
<filter>
<filter-name>AddP3pHeaderFilter</filter-name>
<filter-class>com.mycompany.AddP3pHeaderFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>AddP3pHeaderFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
我的web.xml
<filter>
<description>
FBIS Filter</description>
<display-name>Fbisfilter</display-name>
<filter-name>Fbisfilter</filter-name>
<filter-class>fbis.filter.Fbisfilter</filter-class>
</filter>
<filter-mapping>
<filter-name>Fbisfilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
和myfilter是
package fbis.filter;
import java.io.IOException;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import com.sqlconnection.SQLConnect;
import com.sun.security.auth.UserPrincipal;
import fbis.interfaces.abstractclasses.Connections;
/**
* Servlet Filter implementation class Fbisfilter
*/
public class Fbisfilter extends Object implements Filter,Connections {
public void destroy() {
// System.out.println("Filter Service finished");
}
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpresponse = (HttpServletResponse) response;
System.out.println("FILTER INSIDE");
// place your code here
HttpSession session = httpRequest.getSession(true);
String usrid = httpRequest.getParameter("txtuname");
String pwd = httpRequest.getParameter("txtpassword");
PreparedStatement pstmt;
try {
pstmt = con
.prepareStatement("SELECT l.Userid,n.First_name from Login_details_dtls l join New_Registration_dtls n on l.Userid=n.Userid where n.Userid=? AND l.pwd=?");
pstmt.setString(1, usrid);
pstmt.setString(2, pwd);
ResultSet rs = pstmt.executeQuery();
if (rs.next()) {
session.setAttribute("usr", rs.getString("Userid"));
session.setAttribute("usrname", rs.getString("First_name"));
}
} catch (SQLException e) {
e.printStackTrace();
}
chain.doFilter(httpRequest, httpresponse);
}
/**
* @see Filter#init(FilterConfig)
*/
public void init(FilterConfig fConfig) throws ServletException {
System.out.println("Filter Service has started");
}
}
由於安全原因,大多數servletcontainer確實不允許掛鈎/j_security_check
請求。 一些舊版本可以,但應該在較新版本中修復。
無論如何,最好的方法是檢查HttpSession
中是否存在用戶主體,如果不存在,你手動放在那里。
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
HttpServletRequest httpRequest = (HttpServletRequest) request;
UserPrincipal user = httpRequest.getUserPrincipal();
HttpSession session = httpRequest.getSession();
if (user != null && session.getAttribute("user") == null) {
session.setAttribute("user", user);
// First-time login. You can do your intercepting thing here.
}
chain.doFilter(request, response);
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.