<!-- 拦截器 --><mvc:interceptors><mvc:interceptor><!-- 用户认证拦截 --><mvc:mapping path="/**"/><bean class="liuxun.ssm.controller.interceptor.LoginInterceptor"></bean></mvc:interceptor></mvc:interceptors>

//根据用户id查询权限URLpublic List<SysPermission> findPermissionListByUserId(String userid) throws Exception;

SysServiceImpl.java中添加如下内容

@Overridepublic List<SysPermission> findPermissionListByUserId(String userid) throws Exception {return sysPermissionMapperCustom.findPermissionListByUserId(userid);}

用户认证通过后取出菜单和URL放入Session

修改权限SysServiceImpl中用户认证方法的代码

//得到用户idString userid = sysUser.getId();//根据用户id查询菜单List<SysPermission> menus = this.findMenuListByUserId(userid);//根据用户id查询权限urlList<SysPermission> permissions = this.findPermissionListByUserId(userid);//认证通过，返回用户身份信息ActiveUser activeUser = new ActiveUser();activeUser.setUserid(userid);activeUser.setUsercode(usercode);activeUser.setUsername(sysUser.getUsername());//放入权限范围的菜单和urlactiveUser.setMenus(menus);activeUser.setPermissions(permissions);

菜单动态显示

<c:if test="${activeUser.menus!=null }"><ul><c:forEach items="${activeUser.menus }" var="menu"><li><div><a title="${menu.name }" ref="1_1" href="#"rel="${baseurl }/${menu.url }" icon="icon-log"><spanclass="icon icon-log"> </span><span class="nav"><a href=javascript:addTab('${menu.name }','${baseurl }/${menu.url }')>${menu.name }</a></span></a></div></li></c:forEach></ul></c:if>

授权拦截器

public class PermissionInterceptor implements HandlerInterceptor{//在执行handler之前执行的//用于用户认证校验、用户权限校验@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {//得到请求的urlString url = request.getRequestURI();//判断是否是公开地址//实际开发中需要将公开地址配置在配置文件中//从配置文件中取出可以匿名访问的URLList<String> open_urls = ResourcesUtil.getKeyList("anonymousURL");for (String open_url : open_urls) {if (url.indexOf(open_url)>=0) {//如果是公开地址 则放行return true;}}//从配置文件中获取公用访问urlList<String> common_urls = ResourcesUtil.getKeyList("commonURL");//遍历公用地址 如果是公开地址则放行for (String common_url : common_urls) {if (url.indexOf(common_url)>0) {//如果是公开，则放行return true;}}//判断用户身份在Session中是否存在HttpSession session = request.getSession();ActiveUser activeUser = (ActiveUser) session.getAttribute("activeUser");//从Session中取出权限范围的URLList<SysPermission> permissions = activeUser.getPermissions();for (SysPermission sysPermission : permissions) {//权限urlString permission_url = sysPermission.getUrl();if (url.indexOf(permission_url)>0) {return true;}}//执行到这里拦截，跳转到无权访问的提示页面request.getRequestDispatcher("/WEB-INF/jsp/refuse.jsp").forward(request, response);//如果返回false表示拦截器不继续执行handler，如果返回true表示放行return false;}......
}

配置授权拦截器

注意：要将授权拦截器配置在用户认证拦截器的下边，这是因为SpringMVC拦截器的放行方法是顺序执行的，如果是Struts的话则正好相反。

<!-- 拦截器 --><mvc:interceptors><mvc:interceptor><!-- 用户认证拦截 --><mvc:mapping path="/**"/><bean class="liuxun.ssm.controller.interceptor.LoginInterceptor"></bean></mvc:interceptor><mvc:interceptor><!-- 资源拦截 --><mvc:mapping path="/**"/><bean class="liuxun.ssm.controller.interceptor.PermissionInterceptor"></bean></mvc:interceptor></mvc:interceptors>

运行测试：

package liuxun.ssm.po;import java.io.Serializable;
import java.util.List;/*** 用户身份信息，存入Session  由于Tomcat正常关闭时会将Session序列化的本地硬盘上，所以实现Serializable接口* @author liuxun**/
public class ActiveUser implements Serializable {private static final long serialVersionUID = 1L;private String userid; //用户id(主键)private String usercode; // 用户账号private String username; // 用户姓名private List<SysPermission> menus; //菜单private List<SysPermission> permissions; //权限// 提供对应setter和getter方法......
}

自定义权限的Mapper

package liuxun.ssm.mapper;import java.util.List;
import liuxun.ssm.po.SysPermission;
import liuxun.ssm.po.SysPermissionExample;
import org.apache.ibatis.annotations.Param;
/*** 权限mapper* @author liuxun**/
public interface SysPermissionMapperCustom {//根据用户id查询菜单public List<SysPermission> findMenuListByUserId(String userid) throws Exception;//根据用户id查询权限URLpublic List<SysPermission> findPermissionListByUserId(String userid) throws Exception;
}

SysPermissionMapperCustom.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
<mapper namespace="liuxun.ssm.mapper.SysPermissionMapperCustom"><!-- 根据用户id查询菜单 -->
<select id="findMenuListByUserId" parameterType="string" resultType="liuxun.ssm.po.SysPermission">SELECT * FROMsys_permission WHERE TYPE = 'menu' AND id IN (SELECT sys_permission_id FROMsys_role_permission WHERE sys_role_id IN (SELECT sys_role_id FROMsys_user_role WHERE sys_user_id = #{userid}))
</select>
<!-- 根据用户id查询URL -->
<select id="findPermissionListByUserId" parameterType="string" resultType="liuxun.ssm.po.SysPermission">SELECT * FROMsys_permission WHERE TYPE = 'permission' AND id IN (SELECT sys_permission_id FROMsys_role_permission WHERE sys_role_id IN (SELECT sys_role_id FROMsys_user_role WHERE sys_user_id = #{userid}))
</select>
</mapper>

自定义权限的Service接口以及实现类

package liuxun.ssm.service;import java.util.List;import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.po.SysPermission;
import liuxun.ssm.po.SysUser;/*** 认证授权服务接口* @author liuxun**/
public interface SysService {//根据用户的身份和密码进行认证，如果认证通过，返回用户身份信息public ActiveUser authenticat(String usercode,String password) throws Exception;//根据用户账号查询用户信息public SysUser findSysUserByUserCode(String userCode) throws Exception;//根据用户id查询权限范围内的菜单public List<SysPermission> findMenuListByUserId(String userid) throws Exception;//根据用户id查询权限范围内的urlpublic List<SysPermission> findPermissionListByUserId(String userid) throws Exception;
}

SysServiceImpl.java

package liuxun.ssm.service.impl;import java.util.List;import org.springframework.beans.factory.annotation.Autowired;import liuxun.ssm.exception.CustomException;
import liuxun.ssm.mapper.SysPermissionMapperCustom;
import liuxun.ssm.mapper.SysUserMapper;
import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.po.SysPermission;
import liuxun.ssm.po.SysUser;
import liuxun.ssm.po.SysUserExample;
import liuxun.ssm.service.SysService;
import liuxun.ssm.util.MD5;public class SysServiceImpl implements SysService {@Autowiredprivate SysUserMapper sysUserMapper;@Autowiredprivate SysPermissionMapperCustom sysPermissionMapperCustom;public ActiveUser authenticat(String usercode, String password) throws Exception {/*** 认证过程： 根据用户身份(账号)查询数据库，如果查询不到则用户不存在 * 对输入的密码和数据库密码进行比对，如果一致则认证通过*/// 根据用户账号查询数据库SysUser sysUser = this.findSysUserByUserCode(usercode);if (sysUser == null) {// 抛出异常throw new CustomException("用户账号不存在");}// 数据库密码（MD5加密后的密码）String password_db = sysUser.getPassword();// 对输入的密码和数据库密码进行比对，如果一致，认证通过// 对页面输入的密码进行MD5加密String password_input_md5 = new MD5().getMD5ofStr(password);if (!password_db.equalsIgnoreCase(password_input_md5)) {//抛出异常throw new CustomException("用户名或密码错误");}//得到用户idString userid = sysUser.getId();//根据用户id查询菜单List<SysPermission> menus = this.findMenuListByUserId(userid);//根据用户id查询权限urlList<SysPermission> permissions = this.findPermissionListByUserId(userid);//认证通过，返回用户身份信息ActiveUser activeUser = new ActiveUser();activeUser.setUserid(userid);activeUser.setUsercode(usercode);activeUser.setUsername(sysUser.getUsername());//放入权限范围的菜单和urlactiveUser.setMenus(menus);activeUser.setPermissions(permissions);return activeUser;}public SysUser findSysUserByUserCode(String userCode) throws Exception {SysUserExample sysUserExample = new SysUserExample();SysUserExample.Criteria criteria = sysUserExample.createCriteria();criteria.andUsercodeEqualTo(userCode);List<SysUser> list = sysUserMapper.selectByExample(sysUserExample);if (list != null && list.size() > 0) {return list.get(0);}return null;}@Overridepublic List<SysPermission> findMenuListByUserId(String userid) throws Exception {return sysPermissionMapperCustom.findMenuListByUserId(userid);}@Overridepublic List<SysPermission> findPermissionListByUserId(String userid) throws Exception {return sysPermissionMapperCustom.findPermissionListByUserId(userid);}
}

登录控制器

package liuxun.ssm.controller;import javax.servlet.http.HttpSession;import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;import liuxun.ssm.exception.CustomException;
import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.service.SysService;/*** 登录和退出* @author liuxun**/
@Controller
public class LoginController {@Autowiredprivate SysService sysService;//用户登录提交方法@RequestMapping("/login")public String login(HttpSession session,String randomcode,String usercode,String password) throws Exception{// 校验验证码，防止恶性攻击// 从Session中获取正确的验证码String validateCode = (String) session.getAttribute("validateCode");//输入的验证码和Session中的验证码进行对比if (!randomcode.equalsIgnoreCase(validateCode)) {//抛出异常throw new CustomException("验证码输入错误");}//调用Service校验用户账号和密码的正确性ActiveUser activeUser = sysService.authenticat(usercode, password);//如果Service校验通过，将用户身份记录到Sessionsession.setAttribute("activeUser", activeUser);//重定向到商品查询页面return "redirect:/first.action";}//用户退出@RequestMapping("/logout")public String logout(HttpSession session) throws Exception{//session失效session.invalidate();//重定向到商品查询页面return "redirect:/first.action";}
}

身份认证拦截器LoginInterceptor.java

package liuxun.ssm.controller.interceptor;import java.util.List;import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.util.ResourcesUtil;/*** 测试拦截器1* @author liuxun**/
public class LoginInterceptor implements HandlerInterceptor{//在执行handler之前执行的//用于用户认证校验、用户权限校验@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {//得到请求的urlString url = request.getRequestURI();//判断是否是公开地址//实际开发中需要将公开地址配置在配置文件中//从配置文件中取出可以匿名访问的URLList<String> open_urls = ResourcesUtil.getKeyList("anonymousURL");for (String open_url : open_urls) {if (url.indexOf(open_url)>=0) {//如果是公开地址 则放行return true;}}//判断用户身份在Session中是否存在HttpSession session = request.getSession();ActiveUser activeUser = (ActiveUser) session.getAttribute("activeUser");//如果用户身份在session中存在则放行if (activeUser!=null) {return true;}//执行到这里拦截，跳转到登录页面，用户进行身份认证request.getRequestDispatcher("/WEB-INF/jsp/login.jsp").forward(request, response);//如果返回false表示拦截器不继续执行handler，如果返回true表示放行return false;}//在执行handler返回modelAndView之前执行//如果需要向页面提供一些公用的数据或配置一些视图信息，使用此方法实现 从modelAndView入手@Overridepublic void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView)throws Exception {System.out.println("HandlerInterceptor2...postHandle");}//执行handler之后执行此方法//作为系统统一异常处理，进行方法执行性能监控，在preHandler中设置一个时间点 在afterCompletion设置一个时间点 二者时间差就是执行时长//实现系统，统一日志记录@Overridepublic void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception modelAndView)throws Exception {System.out.println("HandlerInterceptor2...afterCompletion");}}

资源授权拦截器PermissionInterceptor

package liuxun.ssm.controller.interceptor;import java.security.acl.Permission;
import java.util.List;import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;import liuxun.ssm.po.ActiveUser;
import liuxun.ssm.po.SysPermission;
import liuxun.ssm.util.ResourcesUtil;/*** 授权拦截器* @author liuxun**/
public class PermissionInterceptor implements HandlerInterceptor{//在执行handler之前执行的//用于用户认证校验、用户权限校验@Overridepublic boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {//得到请求的urlString url = request.getRequestURI();//判断是否是公开地址//实际开发中需要将公开地址配置在配置文件中//从配置文件中取出可以匿名访问的URLList<String> open_urls = ResourcesUtil.getKeyList("anonymousURL");for (String open_url : open_urls) {if (url.indexOf(open_url)>=0) {//如果是公开地址 则放行return true;}}//从配置文件中获取公用访问urlList<String> common_urls = ResourcesUtil.getKeyList("commonURL");//遍历公用地址 如果是公开地址则放行for (String common_url : common_urls) {if (url.indexOf(common_url)>0) {//如果是公开，则放行return true;}}//判断用户身份在Session中是否存在HttpSession session = request.getSession();ActiveUser activeUser = (ActiveUser) session.getAttribute("activeUser");//从Session中取出权限范围的URLList<SysPermission> permissions = activeUser.getPermissions();for (SysPermission sysPermission : permissions) {//权限urlString permission_url = sysPermission.getUrl();if (url.indexOf(permission_url)>0) {return true;}}//执行到这里拦截，跳转到无权访问的提示页面request.getRequestDispatcher("/WEB-INF/jsp/refuse.jsp").forward(request, response);//如果返回false表示拦截器不继续执行handler，如果返回true表示放行return false;}//在执行handler返回modelAndView之前执行//如果需要向页面提供一些公用的数据或配置一些视图信息，使用此方法实现 从modelAndView入手@Overridepublic void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView)throws Exception {System.out.println("HandlerInterceptor2...postHandle");}//执行handler之后执行此方法//作为系统统一异常处理，进行方法执行性能监控，在preHandler中设置一个时间点 在afterCompletion设置一个时间点 二者时间差就是执行时长//实现系统，统一日志记录@Overridepublic void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception modelAndView)throws Exception {System.out.println("HandlerInterceptor2...afterCompletion");}}

拦截器配置

<!-- 拦截器 --><mvc:interceptors><mvc:interceptor><!-- 用户认证拦截 --><mvc:mapping path="/**"/><bean class="liuxun.ssm.controller.interceptor.LoginInterceptor"></bean></mvc:interceptor><mvc:interceptor><!-- 资源拦截 --><mvc:mapping path="/**"/><bean class="liuxun.ssm.controller.interceptor.PermissionInterceptor"></bean></mvc:interceptor></mvc:interceptors>

使用URL拦截总结：