拦截器原理
在 Spring MVC 中，拦截器（Interceptor）是一种机制，用于拦截请求并在处理程序（Controller）执行之前或之后执行一些操作。拦截器允许您在请求的不同阶段（如处理程序执行前、处理程序执行后、视图渲染前、视图渲染后等）添加自定义逻辑。
其中问号就是拦截器处理的范围。
实现自定义拦截器
@Component
public class SampleInterceptor implements HandlerInterceptor {
// 在controller执行前的逻辑
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler)
throws Exception {
// 在controller执行之前执行的逻辑
System.out.println("Pre-handle logic");
return true; // 返回 true，将允许请求继续传递到处理程序；
//返回 false，将阻止请求传递给处理程序
}
// 在controller执行后、并在视图渲染前执行的逻辑
@Override
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
ModelAndView modelAndView) throws Exception {
System.out.println("Post-handle logic");
}
//在服务器响应结束后执行的逻辑
@Override
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
throws Exception {
System.out.println("After-completion logic");
}
}将自定义拦截器添加到SpringMvc中
@Configuration
public class InterceptorRoll implements WebMvcConfigurer {
@Autowired
LoginTicketInterceptor loginTicketInterceptor;
@Override
public void addInterceptors(InterceptorRegistry registry) {
//registry.addInterceptor() 方法可以向注册表中添加拦截器。
InterceptorRegistration interceptorRegistration = registry.addInterceptor(loginTicketInterceptor);
//添加拦截器生效路径，以及拦截器忽略的路径
...
}
}使用拦截器实现权限验证逻辑
关键鉴权逻辑图解：
1.在请求controller之前先经过拦截器，从cookie中获取用户标识，根据用户标识，从redis中取出登录凭证
2.如果登录凭证有效，则设置一个线程与用户信息进行绑定，并将用户信息存入到视图模型中
3.如果凭证无效则跳转到登录页面
4.在用户请求完之后，销毁线程与用户名的绑定
实现:
1.创建工具类ThreadHolder
package com.duhong.util;
import com.duhong.entity.User;
import org.springframework.data.redis.core.StringRedisTemplate;
public class ThreadHolder {
static ThreadLocal<User> users=new ThreadLocal<>();
/**
* 设置线程信息
* @param user
*/
public static void setHolder(User user){
users.set(user);
}
/**
* 获取当前线程的信息
* @return
*/
public static User getHolder(){
return users.get();
}
/**
* 解除线程与当前用户的绑定
*/
public static void remove(){
users.remove();
}
}2.创建自定义拦截器
@Component
public class LoginTicketInterceptor implements HandlerInterceptor {
@Autowired
StringRedisTemplate redisTemplate;//redis客户端
@Autowired
UserMapper userMapper;//根据用户id查询用户所有信息
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
//获取用户的cookie
Cookie[] cookies = request.getCookies();
String loginOwner=null;
System.out.println("开始鉴权");
for(Cookie cookie:cookies){
if(cookie.getName().equals("loginOwner")){
loginOwner=cookie.getValue();
break;
};
}
LoginTicket ticket=new LoginTicket();
//如果loginOwner不等于null,从redis中获取登录签证
if(loginOwner!=null) {
String s = redisTemplate.opsForValue().get(RedisUtil.getTicket(loginOwner));
ticket = RedisUtil.getObject(s);
//用户已被授权
if (ticket != null && ticket.getStatus() == 1) {
User user = userMapper.selectById(ticket.getUserId());
//将用户信息与当前线程绑定
ThreadHolder.setHolder(user);
return true;
}
}
//如果签证不等于null,而且签证的状态无效则跳转到登录页面
response.sendRedirect("/site/login");
return false;
}
/**
* 在视图层渲染之前将用户信息存入模型
* @param request
* @param response
* @param handler
* @param modelAndView
* @throws Exception
*/
public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable ModelAndView modelAndView) throws Exception {
if(ThreadHolder.getHolder()!=null&&modelAndView!=null){
//从当前线程中获取用用户信息
modelAndView.addObject("loginUser",ThreadHolder.getHolder());
}
}
/**
* 在服务器响应完本次信息之后,解除当前线程与用户信息的绑定
* @param request
* @param response
* @param handler
* @param ex
* @throws Exception
*/
public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, @Nullable Exception ex) throws Exception {
ThreadHolder.remove();
}
}3.将拦截器加入到SpringMvc中并设置拦截规则
package com.duhong.config;
import com.duhong.filter.LoginTicketInterceptor;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import java.util.Arrays;
import java.util.List;
@Configuration
public class InterceptorRoll implements WebMvcConfigurer {
@Autowired
LoginTicketInterceptor loginTicketInterceptor;
//配置文件中配置配置需要过滤的路径形式为:路径，路径，...
@Value("${allow.pages}")
String allowPages;
@Override
public void addInterceptors(InterceptorRegistry registry) {
InterceptorRegistration interceptorRegistration = registry.addInterceptor(loginTicketInterceptor);
interceptorRegistration.addPathPatterns("/**");
String[] split = allowPages.split(",");
for (String allowpage : split) {
System.out.println(allowpage);
//忽略指定页面
interceptorRegistration.excludePathPatterns(allowpage);
}
//忽略静态资源
interceptorRegistration.excludePathPatterns("/css/**","/img/**","/js/**");
}
}如有收获，就点个赞吧！
