验证过滤器和servlet进行登录 [英] Authentication filter and servlet for login

问题描述

我已经用于登录的过滤器。它执行文本检查，上田用户名和密码。当且仅当文本检查是做正确的请求发送给servlet。后者将执行具有与数据库进行交互控制。是这条产业链是否正确？

I've a filter used for the login. It performs a textual checking, on fields "Username" and "Password". If and only if the textual checking is correctly done the request goes to the Servlet. This latter performs the control that has to interact with the Database. Is this chain correct?

推荐答案

preface：我猜你使用自产自销的登录，而不是容器管理的登录。对于所有的方法，请参阅How与数据库中的用户处理身份验证/授权？

Preface: I gather you're using homegrown login instead of container managed login. For all ways, see How to handle authentication/authorization with users in a database?

过滤器（拦截）不应该检查用户名/密码组合的有效性。这是该servlet（控制器）的责任。

The filter (the interceptor) shouldn't check the validity of the username/password combo. That's the responsibility of the servlet (the controller).

过滤器应只检查，如果用户登录或不（通常只检查会话属性的presence），然后继续请求或通过重定向回到登录页面阻止它。

The filter should merely check if the user is logged-in or not (usually by just checking the presence of a session attribute) and then continue the request or block it by redirecting back to the login page.

@WebFilter("/*")
public class LoginFilter implements Filter {

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws ServletException, IOException {    
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        HttpSession session = request.getSession(false);
        String loginURI = request.getContextPath() + "/login";

        boolean loggedIn = session != null && session.getAttribute("user") != null;
        boolean loginRequest = request.getRequestURI().equals(loginURI);

        if (loggedIn || loginRequest) {
            chain.doFilter(request, response);
        } else {
            response.sendRedirect(loginURI);
        }
    }

    // ...
}

该servlet应该收集提交的数据，发现数据库中的关联用户，如果找到了，然后将其存储为一个会话属性，然后重定向到主页，否则重新显示形式验证错误。

The servlet should collect the submitted data, find the associated User in database and if found then store it as a session attribute and then redirect to the home page, else redisplay the form with validation errors.

@WebServlet("/login")
public class LoginServlet extends HttpServlet {

    @EJB
    private UserService userService;

    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        request.getRequestDispatcher("/WEB-INF/login.jsp").forward(request, response);
    }

    @Override
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");
        Map<String, String> messages = new HashMap<String, String>();

        if (username == null || username.isEmpty()) {
            messages.put("username", "Please enter username");
        }

        if (password == null || password.isEmpty()) {
            messages.put("password", "Please enter password");
        }

        if (messages.isEmpty()) {
            User user = userService.find(username, password);

            if (user != null) {
                request.getSession().setAttribute("user", user);
                response.sendRedirect(request.getContextPath() + "/home");
                return;
            } else {
                messages.put("login", "Unknown login, please try again");
            }  
        }

        request.setAttribute("messages", messages);
        request.getRequestDispatcher("/WEB-INF/login.jsp").forward(request, response);
    }

}

参见：

• 我们的servlet过滤器维基页面


• 我们的servlet的wiki页面



See also:

• Our servlet-filters wiki page
• Our servlets wiki page

这篇关于验证过滤器和servlet进行登录的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！