我想为我的网络应用程序创建一个授权过滤器(以便能够限制对某些页面的访问).
我创建了一个简单的.xml文件,其中包含允许每个用户访问的页面：
<access>
<buyer>
<page>buyoffer.xhtml</page>
<page>faq.xhtml</page>
<page>index.jsp</page>
<page>login.xhtml</page>
<page>main.xhtml</page>
<page>registrationSucceded.xhtml</page>
</buyer>
<seller>
<page>sellerpanel.xhtml</page>
<page>faq.xhtml</page>
<page>index.jsp</page>
<page>login.xhtml</page>
<page>main.xhtml</page>
<page>registrationSucceded.xhtml</page>
</seller>
<administrator>
<page>sellerpanel.xhtml</page>
<page>faq.xhtml</page>
<page>index.jsp</page>
<page>login.xhtml</page>
<page>main.xhtml</page>
<page>registrationSucceded.xhtml</page>
</administrator>
</access>
然后我需要进行解析以提取页面的值,以便能够创建允许或重定向的条件(依赖).我只需要告诉某人如何从xml中提取这些页面的值.这就是我现在所做的：
public class RestrictPageFilter implements Filter {
private FilterConfig fc;
private DocumentBuilder builder;
private Document document;
public void init(FilterConfig filterConfig) throws ServletException {
// The easiest way to initialize the filter
fc = filterConfig;
// Get the file that contains the allowed pages
File f = new File("/allowedpages.xml");
// Prepare the file parsing
try {
builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
document = builder.parse(f);
} catch (ParserConfigurationException e) {
e.printStackTrace();
} catch (SAXException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
}
public void doFilter(ServletRequest request,ServletResponse response,FilterChain chain) throws IOException,ServletException {
HttpServletRequest req = (HttpServletRequest) request;
HttpServletResponse resp = (HttpServletResponse) response;
HttpSession session = req.getSession(true);
String pageRequested = req.getRequestURL().toString();
// Get the value of the current logged user
Role currentUser = (Role) session.getAttribute("userRole");
if (currentUser != null) {
if(currentUser.getType().equals("BUYER")) {
//Loop BUYER Element of the .xml
//if pageRequested.contains(value of the page at buyer element)
// chain.doFilter(request,response);
// Else
// Redirect the user to the main page
}
else if(currentUser.getType().equals("SELLER")) {
//Same as above just for seller element
}
else if(currentUser.getType().equals("ADMINISTRATOR")) {
//Same as above just for administrator element
}
}
}
public void destroy() {
// Not needed
}
}
在doFilter方法内部的注释中解释了我需要做什么.有人可以给我一个提示,我应该如何遍历文件来查找每个用户类型的页面名称？我尝试从互联网上关注JAXP示例,但它们比我需要的更复杂.
更新
xml存储在WEB-INF / classes中
而是使用JAXB. JAXP是一个古老且非常详细的API. JAXB倾向于Javabeans,因此干净且相对容易.首先创建一个Javabean,它使用javax.xml.bind注释将1：1映射到XML文件.
@XmlRootElement
public class Access {
@XmlElement
private User buyer;
@XmlElement
private User seller;
@XmlElement
private User administrator;
public User getBuyer() {
return buyer;
}
public User getSeller() {
return seller;
}
public User getAdministrator() {
return administrator;
}
public static class User {
@XmlElement(name="page")
private List<String> pages;
public List<String> getPages() {
return pages;
}
}
}
然后执行以下部分来映射它(假设allowedpages.xml放在类路径的根目录中).
InputStream input = Thread.currentThread().getContextClassLoader().getResourceAsStream("allowedpages.xml");
Access access = (Access) JAXBContext.newInstance(Access.class).createUnmarshaller().unmarshal(input);
请注意,您不应该为此使用新的File().另见getResourceAsStream() vs FileInputStream.
最后,您可以访问所有买家页面,如下所示：
List<String> buyerPages = access.getBuyer().getPages(); // ...
毋庸置疑,养老保障并不总是最佳做法. Java EE 6附带容器管理的安全性.
