MyTlias-员工信息管理系统(七)-登录认证2

@Override
public void doFilter(ServletRequest req, ServletResponse res, FilterChain c)
throws IOException, ServletException {
    // 1. 放行前逻辑
    // some code
    // 2. 放行
    c.doFilter(req, res);
    // 3. 放行后逻辑
    // some code
}

@Slf4j
@WebFilter("/*")
public class LoginFilter implements Filter {
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        // 1. 获取请求的资源路径(url)
        HttpServletRequest req = (HttpServletRequest) servletRequest;
        HttpServletResponse res = (HttpServletResponse) servletResponse;
        String url = req.getRequestURL().toString();
        // 1-1. 提前准备失败时需要写入的信息, 注意必须是 json 格式的字符串
        //      这里引入了 alibaba 的依赖: fastjson, 同时返回信息由接口文档确定
        String failure = JSONObject.toJSONString(Result.error("NOT_LOGIN"));
        // 2. 如果包含 login, 则直接放行
        if(url.contains("login")){
            log.info("login operation, access allowed");
            filterChain.doFilter(servletRequest, servletResponse);  // 此即为放行操作
            return;
        }else{
            // 3. 否则尝试获取 token
            String jwt = req.getHeader("token");
            if (StringUtils.isEmpty(jwt)){
                // 4. 没有 token, 说明还未登录, 不予放行
                log.info("no token in request header, access not allowed");
                res.getWriter().write(failure);     // 向响应数据写入失败信息
                return;
            }else{
                // 5. 有token字段, 则尝试解析 token
                try{
                    Claims body = JwtUtils.jwtParse(jwt);
                }catch (Exception e){
                    log.error("exception: "+e.getClass().getSimpleName());
                    log.info("token invalid, you may login again");
                    res.getWriter().write(failure);
                    return;
                }
            }
        }
        // 6. 请求携带了有效token, 则放行
        filterChain.doFilter(servletRequest, servletResponse);
        log.info("The token from this request is valid, access allowed");
    }
}

package com.example.mytlias.interceptor;
@Slf4j
@Component
public class LoginCheckInterceptor implements HandlerInterceptor {
    @Override   // 目标资源方法执行前执行, 返回true表示放行, 否则不放行
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        // 在 WebMvcConfigurer 中添加了这一 interceptor 并配置了拦截路径后, 那些需要拦截的请求会来到这里
        String url = request.getRequestURL().toString();
        String failure = JSONObject.toJSONString(Result.error("NOT_LOGIN"));
        if(url.contains("login")){
            log.info("login operation, access allowed");
            return true;
        }else{
            String jwt = request.getHeader("token");
            if (StringUtils.isEmpty(jwt)){
                log.info("no token in request header, access not allowed");
                response.getWriter().write(failure);     // 向响应数据写入失败信息
                return false;
            }else{
                try{
                    Claims body = JwtUtils.jwtParse(jwt);
                }catch (Exception e){
                    log.error("exception: "+e.getClass().getSimpleName());
                    log.info("token invalid, you may login again");
                    response.getWriter().write(failure);
                    return false;
                }
            }
        }
        log.info("The token from this request is valid, access allowed");
        return true;
    }

    @Override   // 目标资源方法执行后执行
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        HandlerInterceptor.super.postHandle(request, response, handler, modelAndView);
    }

    @Override   // 视图渲染完毕后执行, 最后执行
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        HandlerInterceptor.super.afterCompletion(request, response, handler, ex);
    }
}

package com.example.mytlias.config;
@Configuration
public class LoginCheckConfig implements WebMvcConfigurer {
    @Autowired
    private LoginCheckInterceptor interceptor;
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        // 拦截除了 login 以外的所有请求
        registry.addInterceptor(interceptor).addPathPatterns("/**").excludePathPatterns("/login");
    }
}