spring aop intercepts the business method and implements the permission control example

Difficult points: aop class is a common java class, and session cannot be injected. Then how to get user information in a stateful system? session is the only way, so it becomes very important to get session. After thinking about it for a long time, I found the solution on the Internet.

Idea is:

i. SysContext member variables request,session,response

The purpose of ii. Filter is to assign values to members of SysContext

iii. Then use this SysContext value in AOP

To use it well, you need to understand the order in which ThreadLocal and Filter execute

1.aop gets request, response, session, etc

public class SysContext { 
  private static ThreadLocal<HttpServletRequest> requestLocal=new ThreadLocal<HttpServletRequest>(); 
  private static ThreadLocal<HttpServletResponse> responseLocal=new ThreadLocal<HttpServletResponse>(); 
  
  public static HttpServletRequest getRequest(){ 
   return requestLocalget(); 
  } 
  
  public static void setRequest(HttpServletRequest request){ 
   requestLocalset(request); 
  } 
  
  public static HttpServletResponse getResponse(){ 
   return responseLocalget(); 
  } 
  
  public static void setResponse(HttpServletResponse response){ 
   responseLocalset(response); 
  } 
  
  public static HttpSession getSession(){ 
   return (HttpSession)(getRequest())getSession(); 
  } 
 } 

2. Add a filter

public class GetContextFilter implements Filter{ 
 
  @Override 
  public void destroy() { 
   
  } 
 
  @Override 
  public void doFilter(ServletRequest request, ServletResponse response, 
    FilterChain chain) throws IOException, ServletException { 
   SysContextsetRequest((HttpServletRequest)request); 
   SysContextsetResponse((HttpServletResponse)response); 
   chaindoFilter(request, response); 
  } 
 
  @Override 
  public void init(FilterConfig config) throws ServletException { 
   
  } 
 
 } 
 

3. Configure web. xml

This section is placed first so that all requests can be filtered

<filter> 
  <filter-name>sessionFilter</filter-name> 
  <filter-class>comuneifilterGetContextFilter</filter-class> 
 </filter> 
 
 <filter-mapping> 
  <filter-name>sessionFilter</filter-name> 
  <url-pattern>*</url-pattern> 
 </filter-mapping> 

4.spring aop before

Take the user name from session, if it doesn't exist, throw an exception jump, and put the error message into request

@Aspect 
 public class AdminAspect { 
  ActionContext context = ActionContextgetContext(); 
  HttpServletRequest request; 
  HttpServletResponse response; 
 
  @Before("execution(* comuneiActionAdminActiongetPrivileges())") 
  public void adminPrivilegeCheck() 
    throws Throwable { 
   HttpSession session = SysContextgetSession(); 
   request = SysContextgetRequest(); 
   response = SysContextgetResponse(); 
   String userName = ""; 
   
   try { 
    userName = sessiongetAttribute("userName")toString(); 
    if(userName==null||userNameequals("")) 
     throw new Exception("no privilege"); 
   } catch (Exception ex) { 
    requestsetAttribute("msg", "{\"res\":\"" + " Without permission " + "\"}"); 
    try { 
     requestgetRequestDispatcher("/jsp/jsonjsp")forward( 
       request, response); 
    } catch (ServletException e) { 
     eprintStackTrace(); 
    } catch (IOException e) { 
     eprintStackTrace(); 
    } 
   } 
  } 
 } 

5.applicationContext.xml

<bean id="adminAspect" class="comuneiaopAdminAspect"></bean>