过滤器映射在 web.xml 中不起作用

Question

我在我的应用程序中创建了一个过滤器来处理登录/注销场景。过滤器映射不起作用。在我的web.xml 中，如果我输入<url-pattern>/LoginServlet/*</url-pattern>，过滤器映射有效，但如果我输入jsp 的名称，则它不起作用<url-pattern>/LoginServlet/list.jsp</url-pattern>。我不想为所有 jsps 调用过滤器。

这是我的过滤器。

public class LoginFilter implements Filter{

    public void destroy() {
        // TODO Auto-generated method stub

    }

    public void doFilter(ServletRequest req, ServletResponse res,
            FilterChain chain) throws IOException, ServletException {
        System.out.println("LoginFilter : doFilter : Start");
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("Pragma", "no-cache");
        response.setHeader("Cache-Control", "no-cache");
        response.setDateHeader("Expires", 0);

        System.out.println("LoginFilter : doFilter : 111111");


        HttpSession session = request.getSession(false);

        if (session == null || session.getAttribute("user") == null) {
            System.out.println("LoginFilter : doFilter : 222222");
            response.sendRedirect("login.jsp");
            //response.sendRedirect(request.getContextPath() + "/login.jsp");
            //response.sendRedirect("login.jsp");
            //response.sendRedirect("http://localhost:8080/PROJECT_ELMS/login.jsp");
        }else {
            System.out.println("LoginFilter : doFilter : 33333333");
            chain.doFilter(request, response);
        }

    }

    public void init(FilterConfig arg0) throws ServletException {
        // TODO Auto-generated method stub

    }

}

这是我的web.xml。

<welcome-file-list>
    <welcome-file>login.jsp</welcome-file>
</welcome-file-list>
<listener>
    <listener-class>edu.umd.enpm613.helper.StartupListner</listener-class>
</listener>
<filter>
    <filter-name>loginFilter</filter-name>
    <filter-class>edu.umd.enpm613.servlet.LoginFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>loginFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
    <description></description>
    <display-name>LoginServlet</display-name>
    <servlet-name>LoginServlet</servlet-name>
    <servlet-class>edu.umd.enpm613.servlet.LoginServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>LoginServlet</servlet-name>
    <url-pattern>/LoginServlet/*</url-pattern>
</servlet-mapping>
<servlet>
    <description></description>
    <display-name>StudentServlet</display-name>
    <servlet-name>StudentServlet</servlet-name>
    <servlet-class>edu.umd.enpm613.servlet.StudentServlet</servlet-class>
</servlet>

LoginServlet 是：

public class LoginServlet extends HttpServlet  {
    private static final long serialVersionUID = 1L;

    /**
     * Default constructor. 
     */
    public LoginServlet() {
        // TODO Auto-generated constructor stub
    }

    /**
     * @see HttpServlet#doGet(HttpServletRequest request, HttpServletResponse response)
     */
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // TODO Auto-generated method stub
    }

    /**
     * @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
     */
    @SuppressWarnings("null")
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        System.out.println("LoginServlet : doPost : Start");
        LoginDTO returnedDTO = null;
        String userEmailId = request.getParameter("userid");
        try {
            request.getSession(true).setAttribute("user", userEmailId);
            String userPassword = request.getParameter("password");

            LoginDTO loginDto = new LoginDTO();
            loginDto.setUserEmailId(userEmailId);
            loginDto.setUserPassword(userPassword);

            returnedDTO = LoginImpl.getUserCategory(loginDto);

            String category = returnedDTO.getUserCategory();

            if (category.equals(ELMSConstants.CATEGORY_STUDENT)) {
                //request.getRequestDispatcher("student_home.jsp").forward(request,response);
                System.out.println("LoginServlet : doPost : Start" +request.getContextPath());
                System.out.println("LoginServlet : doPost : Start" +request.getRequestURI());
                System.out.println("LoginServlet : doPost : Start" + request.getRequestURL());
                request.getRequestDispatcher("list.jsp").forward(request,response);
            }
            if (category.equals(ELMSConstants.CATEGORY_TEACHER)) {
                System.out.println("LoginServlet : doPost : 22222222222");
                request.getRequestDispatcher("professor_home.jsp").forward(request,response);
            }


        }catch (ELMSException exp){
            exp.printStackTrace();
            System.out.println("LoginServlet : doPost : error message is" + exp.getMessage());

            if (exp.getMessage().equals(ELMSException.USER_NEED_TO_CHANGE_PASSWORD)) {
                System.out.println("LoginServlet : doPost : 1111111111");
                request.setAttribute("errorMessage", exp.getMessage());
                request.setAttribute("userName", userEmailId);
                request.getRequestDispatcher("changePassword.jsp").forward(request,response);
            }

            if (!exp.getMessage().equals(ELMSException.USER_NEED_TO_CHANGE_PASSWORD)) {
                request.setAttribute("errorMessage", exp.getMessage());
                request.getRequestDispatcher("login.jsp").forward(request,response);
            }

        }

    }
}

Answer 1

过滤器应该绕过登录页面，因为它没有安全限制，而且它允许您映射所有 URL 而没有无限循环。

public void doFilter(ServletRequest req, ServletResponse res,
        FilterChain chain) throws IOException, ServletException {
    System.out.println("LoginFilter : doFilter : Start");
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;
    response.setHeader("Pragma", "no-cache");
    response.setHeader("Cache-Control", "no-cache");
    response.setDateHeader("Expires", 0);

    System.out.println("LoginFilter : doFilter : 111111");


    HttpSession session = request.getSession(false);

    //bypass the login page and login servlet

    if (request.getRequestURI().indexof("login.jsp") >= 0 ||
      request.getRequestURI().indexof("/LoginServlet") >= 0){
      System.out.println("LoginFilter : bypass the login");
      chain.doFilter(request, response);
    } else {
      if (session == null || session.getAttribute("user") == null) {
        System.out.println("LoginFilter : doFilter : 222222");
        response.sendRedirect("login.jsp");
        //response.sendRedirect(request.getContextPath() + "/login.jsp");
        //response.sendRedirect("login.jsp");
        //response.sendRedirect("http://localhost:8080/PROJECT_ELMS/login.jsp");
      } else {
        System.out.println("LoginFilter : doFilter : 33333333");
        chain.doFilter(request, response);
      }
    }
}

Answer 2

根据JavaServlet Specification

在 Web 应用程序部署描述符中，以下语法是 用于定义映射：

• 以“/”字符开头并以“/*”结尾的字符串 后缀用于路径映射。

• 以“*.”前缀开头的字符串用作扩展名 映射。

• 仅包含“/”字符的字符串表示“默认” 应用程序的 servlet。在这种情况下，servlet 路径是 请求 URI 减去上下文路径，路径信息为空。

• 所有其他字符串仅用于完全匹配。

因此，您不能直接映射 servlet 或使用以下文件过滤： /LoginServlet/list.jsp 。可能的解决方案是将您的 list.jsp 文件放到单独的文件夹中，例如 /LoginServlet/Security/list.jsp 并映射它：

<url-pattern>/LoginServlet/Security/*</url-pattern>