通过过滤器实现网站权限限制

首先是过滤器代码。这里关于权限的字段为user_role.对用户注册时，已经将此属性的值付给session。

package filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class MyFilter implements Filter {

    protected FilterConfig filterConfig;

    public void destroy() {

    }

    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        // 获取URI地址
           HttpServletRequest req = (HttpServletRequest) request;
           HttpServletResponse res = (HttpServletResponse) response;
           HttpSession session = req.getSession();
         String uri = req.getRequestURI();
           String ctx=req.getContextPath();
           uri = uri.substring(ctx.length());

         String role=(String)session.getAttribute("user_role");

         if(uri.startsWith("/show")) {
             if (role.equals("0")) {
                   //request.setAttribute("message","您没有这个权限");
                   request.getRequestDispatcher("/error1.jsp").forward(req,res);
                   return;
               }
             else
                   chain.doFilter(request,response);
           }


         if(uri.startsWith("/yhgl")) {
             if (!role.equals("2")) {
                   //request.setAttribute("message","您没有这个权限");
                   request.getRequestDispatcher("/error.jsp").forward(req,res);
                   return;
               }
             else
                   chain.doFilter(request,response);
           }
         if(uri.startsWith("/xwgl")) {
             if (!role.equals("2")) {
                   //request.setAttribute("message","您没有这个权限");
                   request.getRequestDispatcher("/error.jsp").forward(req,res);
                   return;
               }
             else
                   chain.doFilter(request,response);
           }
         if(uri.startsWith("/rcgl/write")){
             if (role.equals("1")) {
                   //request.setAttribute("message","您没有这个权限");
                   request.getRequestDispatcher("/error1.jsp").forward(req,res);
                   return;
               }
             else
                   chain.doFilter(request,response);
           }

        }
        //下面还可以添加其他的用户权限，省去。



    public void init(FilterConfig arg0) throws ServletException {

    }

}

web.xml

<filter>
     <filter-name>MyFilter</filter-name>
      <filter-class>filter.MyFilter</filter-class>
</filter>
<filter-mapping>
      <filter-name>MyFilter</filter-name>
      <url-pattern>/yhgl/*</url-pattern>
</filter-mapping>
<filter-mapping>
      <filter-name>MyFilter</filter-name>
      <url-pattern>/rcgl/write/*</url-pattern>
</filter-mapping>
<filter-mapping>
      <filter-name>MyFilter</filter-name>
      <url-pattern>/xwgl/*</url-pattern>
</filter-mapping>
    <filter-mapping>
      <filter-name>MyFilter</filter-name>
      <url-pattern>/show/*</url-pattern>
</filter-mapping>

权限1、2、3分别是三个不同的权限。
error.jsp和error1.jsp分别是两个错误页面。

<table align="center" border="6" bgcolor="#ffffff" width="300px" height="130">
  <tr align="center"><td><strong><font size="4" face="楷体">提示信息</font></strong></td></tr>
  <tr align="center"><td><font size="4" face="楷体">抱歉，您没有权限操作此功能！</font></td></tr>
  <tr><td align="right"><font size="2"><a href="indexsy.jsp">返回首页</a></font></td></tr>
  </table>

error1.jsp为：

<table align="center" border="6" bgcolor="#ffffff" width="300px" height="130">
  <tr align="center"><td><strong><font size="4" face="楷体">提示信息</font></strong></td></tr>
  <tr align="center"><td><font size="4" face="楷体">抱歉，您没有权限操作此功能！</font></td></tr>

  </table>

error带有一个返回首页的超链接。这完全取决于项目的需要。