用户未登录情况下,也可以访问setting界面。修改头像信息。这显然是不合理的。
应该在服务端有个判断,登录可以访问,未登录拒绝。多请求相同逻辑,使用拦截器Interceptor。
拦截器需要做配置,配置类实现WebMvcConfig接口。 现在通过另一种方式实现————注解的方式。
/** * 注解作用判断是否已经登录 */ @Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) public @interface LoginRequired { }
作用于方法,在运行时起作用。
@LoginRequired @RequestMapping(path = "/setting", method = RequestMethod.GET) public String getSettingPage(){ return "/site/setting"; } /** * 处理上传文件的请求 */ @LoginRequired @RequestMapping(path = "/upload", method = RequestMethod.POST) public String uploadHeader (MultipartFile headerImg, Model model){....}
@Component public class LoginRequiredIntercepter implements HandlerInterceptor { @Autowired HostHolder hostHolder; @Override public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception { //object 是我们拦截的目标 if (handler instanceof HandlerMethod){ HandlerMethod handlerMethod = (HandlerMethod) handler; Method method = handlerMethod.getMethod(); LoginRequired loginRequired = method.getAnnotation(LoginRequired.class); if(loginRequired != null && hostHolder.getUser()==null){ response.sendRedirect(request.getContextPath()+"/login"); return false; } } return true; } }
@Configuration public class WebMvcConfig implements WebMvcConfigurer { @Autowired private AlphaInterceptor alphaInterceptor; @Autowired private LoginTicketIntercepter loginTicketIntercepter; @Autowired private LoginRequiredIntercepter loginRequiredIntercepter; @Override public void addInterceptors(InterceptorRegistry registry) { registry.addInterceptor(alphaInterceptor) //拦截一切请求 .excludePathPatterns("/*/*.css","/*/*.js","/*/*.png","/*/*.jpg","/*/*.jpeg") //排除访问静态资源,所有目录下的cs文件 .addPathPatterns("/register","/login"); //拦截指定路径及其下的页面 registry.addInterceptor(loginTicketIntercepter) .excludePathPatterns("/*/*.css","/*/*.js","/*/*.png","/*/*.jpg","/*/*.jpeg"); registry.addInterceptor(loginRequiredIntercepter) .excludePathPatterns("/*/*.css","/*/*.js","/*/*.png","/*/*.jpg","/*/*.jpeg"); } }
完成这些之后,未登录状态下直接访问setting时,就会自动跳转到login界面。安全!