In Java Filter is used to control the specific instance of user login permission

Learn JSP so long, do the project also has seven or eight, but all of the project is the user login directly jump to the page that it has rights, or display the link to the page can access. Use this approach to control access in a naive way. It never occurred to me that if I didn't log in, I could enter the address directly to the user's page.

The control of permission in JSP is realized through Filter Filter, all the development framework are integrated with Filter, if not applicable to the development framework, there is the following implementation method:

LoginFilter. Java

public class LoginFilter implements Filter {  
    private String permitUrls[] = null;  
    private String gotoUrl = null;  
    public void destroy() {  
        // TODO Auto-generated method stub  
        permitUrls = null;  
        gotoUrl = null;  
    }  
    public void doFilter(ServletRequest request, ServletResponse response,  
            FilterChain chain) throws IOException, ServletException {  
        // TODO Auto-generated method stub  
        HttpServletRequest res=(HttpServletRequest) request;  
        HttpServletResponse resp=(HttpServletResponse)response;  
        if(!isPermitUrl(request)){  
            if(filterCurrUrl(request)){  
                System.out.println("---> Please log in ");  
                resp.sendRedirect(res.getContextPath()+gotoUrl);  
                return;  
            }  
        }  
        System.out.println("---> Allow access to ");  
        chain.doFilter(request, response);  
    }  
    public boolean filterCurrUrl(ServletRequest request){  
        boolean filter=false;  
        HttpServletRequest res=(HttpServletRequest) request;  
        User user =(User) res.getSession().getAttribute("user");  
        if(null==user)  
            filter=true;  
        return filter;  

    }        
    public boolean isPermitUrl(ServletRequest request) {  
        boolean isPermit = false;  
        String currentUrl = currentUrl(request);  
        if (permitUrls != null && permitUrls.length > 0) {  
            for (int i = 0; i < permitUrls.length; i++) {  
                if (permitUrls[i].equals(currentUrl)) {  
                    isPermit = true;  
                    break;  
                }  
            }  
        }  
        return isPermit;  
    }         
    //Request address & NBSP;
    public String currentUrl(ServletRequest request) {    
        HttpServletRequest res = (HttpServletRequest) request;  
        String task = request.getParameter("task");  
        String path = res.getContextPath();  
        String uri = res.getRequestURI();  
        if (task != null) {//Xx/ser  uri format;
            uri = uri.substring(path.length(), uri.length()) + "?" + "task=" 
                    + task;  
        } else {  
            uri = uri.substring(path.length(), uri.length());  
        }  
        System.out.println(" Current request address :" + uri);  
        return uri;  
    }  
    public void init(FilterConfig filterConfig) throws ServletException {  
        // TODO Auto-generated method stub  
        String permitUrls = filterConfig.getInitParameter("permitUrls");  
        String gotoUrl = filterConfig.getInitParameter("gotoUrl");  
   
        this.gotoUrl = gotoUrl;  
   
        if (permitUrls != null && permitUrls.length() > 0) {  
            this.permitUrls = permitUrls.split(",");  
        }  
    }  
} 

<filter>  
    <filter-name>loginFilter</filter-name>  
    <filter-class>filter.LoginFilter</filter-class>  
   
    <init-param>  
        <param-name>ignore</param-name>  
        <param-value>false</param-value>  
    </init-param>  
    <init-param>  
        <param-name>permitUrls</param-name>  
        <param-value>/,/servlet/Loginservlet?task=login,/public.jsp,/login.jsp</param-value>  
    </init-param>  
    <init-param>  
        <param-name>gotoUrl</param-name>  
        <param-value>/login.jsp</param-value>  
    </init-param>  
</filter>  
<filter-mapping>  
    <filter-name>loginFilter</filter-name>  
    <url-pattern>/*</url-pattern>  
</filter-mapping> 

This short code mainly realizes the user login filtering, the same principle of privilege filtering. Simply replace the ability to determine whether a user is logged in with whether they have permissions!