使用过滤器Filter实现请求拦截

早期使用servlet进行网络开发时，没有拦截器这些内容，那时做请求拦截都是使用Filter过滤器实现的，配置Filter要对哪些请求路径处理，有权限或不需要拦截的路径放行，没有权限的路径直接拦截请求。

一、Filter直接进行拦截

下面就是模拟使用Filter做权限控制的场景，由于现在都是使用spring进行开发，这里定义Filter就使用注解方式实现注入，代码如下：

import org.example.pojo.ApiResult;
import org.example.pojo.StatusCode;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import java.io.IOException;

/**
 * 过滤器处理
 * @Author xingo
 * @Date 2023/12/12
 */
@Order(value = Ordered.HIGHEST_PRECEDENCE)
@Component
@WebFilter(filterName = "myFilter", urlPatterns = "/*")
public class MyFilter implements Filter {

    private ServletContext context;

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        Filter.super.init(filterConfig);
        context = filterConfig.getServletContext();
    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;

        String uri = request.getRequestURI();
        // 静态资源直接放行
        if(uri.endsWith(".js") || uri.endsWith(".css") || uri.endsWith(".png") || uri.endsWith(".jpg")) {
            chain.doFilter(servletRequest, servletResponse);
            return;
        }
        // 登录请求或注册请求放行
        if(uri.startsWith("/login") || uri.startsWith("/register")) {
            chain.doFilter(servletRequest, servletResponse);
            return;
        }
        // 其他请求判断是否有权限拦截
        String userName = this.getLoginUserName(request);
        if(userName == null) {
            String sReqType = request.getHeader("X-Requested-With");
            String contentType = request.getHeader("Content-Type");
            if ("XMLHttpRequest".equalsIgnoreCase(sReqType) || (contentType != null && contentType.toLowerCase().contains("application/json"))) {
                servletResponse.setContentType("application/json; charset=utf-8");
                servletResponse.getWriter().print(JacksonUtils.toJSONString(ApiResult.fail(StatusCode.C_10001)));
            } else {
                servletResponse.setContentType("text/html;charset=utf-8");
                servletResponse.getWriter().print("用户未登录");
            }
        } else {
            // 执行调用链方法
            chain.doFilter(servletRequest, servletResponse);
        }
    }

    @Override
    public void destroy() {
        Filter.super.destroy();
    }

    /**
     * 获取登录用户信息
     * @param request   http请求体
     * @return
     */
    private String getLoginUserName(HttpServletRequest request) {
        try {
            String token = "";
            if (request.getCookies() != null) {
                for (Cookie c : request.getCookies()) {
                    if (null != c && "TOKEN".equals(c.getName())) {
                        token = c.getValue();
                        break;
                    }
                }
            }
            // 简单通过cookie中的token做权限判断，如果有token且符合要求就返回用户名，否则表示用户身份认证失败
            if(token != null && token.length() > 10) {
                String userName = token.substring(10);
                return userName.equals("admin") ? userName : null;
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }
}

测试接口还是使用之前的那个controller：

import org.example.handler.AuthLogin;
import org.example.handler.BusinessException;
import org.example.handler.ManagerAuthInteceptor;
import org.example.pojo.ApiResult;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

import java.text.SimpleDateFormat;
import java.util.*;
import java.util.concurrent.TimeUnit;

/**
 * @Author xingo
 * @Date 2023/12/7
 */
@RestController
public class DemoController {

    @GetMapping("/demo1")
    public Object demo1() {
        int i = 1, j = 0;

        return i / j;
    }

    @GetMapping("/demo2")
    public Object demo2() {
        if(System.currentTimeMillis() > 1) {
            throw BusinessException.fail(88888, "业务数据不合法");
        }

        return System.currentTimeMillis();
    }

    @GetMapping("/demo3")
    public Map<String, Object> demo3() {
        Map<String, Object> map = new HashMap<>();
        map.put("key1", "Hello,world!");
        map.put("key2", new Date());

        return map;
    }

    @GetMapping("/demo4")
    public List<Object> demo4() {
        List<Object> list = new ArrayList<>();
        list.add(new Date());
        list.add("Hello,world!");
        list.add(Long.MAX_VALUE);
        list.add(Integer.MAX_VALUE);

        return list;
    }

    @GetMapping("/demo5")
    public Map<String, Object> demo5() throws InterruptedException {
        Map<String, Object> map = new HashMap<>();
        map.put("method", "demo5");
        map.put("start", new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS").format(new Date()));
        TimeUnit.SECONDS.sleep(1);
        map.put("end", new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS").format(new Date()));

        return map;
    }

    @GetMapping("/demo6")
    public ApiResult demo6() throws InterruptedException {
        Map<String, Object> map = new HashMap<>();
        map.put("method", "demo6");
        map.put("start", new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS").format(new Date()));
        TimeUnit.SECONDS.sleep(1);
        map.put("end", new SimpleDateFormat("yyyy-MM-dd HH:mm:ss.SSS").format(new Date()));

        return ApiResult.success(map);
    }

    @AuthLogin
    @GetMapping("/demo7")
    public Map<String, Object> demo7() {
        Map<String, Object> map = new HashMap<>();
        map.put("method", "demo7");
        map.put("userName", ManagerAuthInteceptor.LocalUserName.get());
        map.put("time", new Date());

        return map;
    }
}

使用/demo6接口进行测试，当有权限和无权限时的请求返回内容如下：
成功请求
错误的token
无token请求

二、Filter配合注解实现拦截

仿造前面的拦截器实现，在过滤器中配合注解实现拦截，这种方式更加灵活，不用在代码中编写拦截和放行的请求路径，它的实现原理与拦截器类似：

定义注解

import java.lang.annotation.*;

/**
 * 登录检查注解注解
 * @author xingo
 * @date 2023/12/12
 *
 */
@Target({ ElementType.METHOD, ElementType.TYPE })
@Retention(RetentionPolicy.RUNTIME)
@Inherited
public @interface AuthLogin {
	
	/**
	 * 检查是否已经登录
	 * @return
	 */
	boolean check() default false;

}

使用过滤器对请求进行拦截处理

import org.example.pojo.ApiResult;
import org.example.pojo.StatusCode;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.stereotype.Component;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.filter.OncePerRequestFilter;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerMapping;
import org.springframework.web.servlet.mvc.condition.PathPatternsRequestCondition;
import org.springframework.web.servlet.mvc.condition.RequestMethodsRequestCondition;
import org.springframework.web.servlet.mvc.method.RequestMappingInfo;
import org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.lang.reflect.Method;
import java.util.Map;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;

/**
 * 过滤器处理
 * @Author xingo
 * @Date 2023/12/12
 */
@Order(value = Ordered.HIGHEST_PRECEDENCE)
@Component
@WebFilter(filterName = "authFilter", urlPatterns = "/*")
public class AuthFilter extends OncePerRequestFilter {

//        //获取WebApplicationContext，用于获取Bean
//        WebApplicationContext webApplicationContext = WebApplicationContextUtils.getWebApplicationContext(this.getServletContext());
//        //获取spring容器中的RequestMappingHandlerMapping
//        RequestMappingHandlerMapping requestMappingHandlerMapping = (RequestMappingHandlerMapping) webApplicationContext.getBean("requestMappingHandlerMapping");

    @Autowired
    private RequestMappingHandlerMapping requestMappingHandlerMapping;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
        // 在 chain.doFilter(request, response) 执行前调用返回null
        Object handler1 = request.getAttribute(HandlerMapping.BEST_MATCHING_HANDLER_ATTRIBUTE);
        System.out.println(handler1);

        // 获取处理请求
        HandlerMethod handler = getHandlerMethod(request);
        if(handler != null) {
            Method method = handler.getMethod();
            Class<?> clazz = handler.getBeanType();

            // 判断添加了注解的方法或类才进行拦截
            boolean annotationType = clazz.isAnnotationPresent(AuthLogin.class);
            boolean annotationMethod = method.isAnnotationPresent(AuthLogin.class);
            if(annotationType || annotationMethod) {
                // 拦截到的请求需要判断用户名是否为空，如果为空表示用户身份验证失败，表示用户无访问权限
                String userName = this.getLoginUserName(request);
                if(userName == null) {
                    String sReqType = request.getHeader("X-Requested-With");
                    String contentType = request.getHeader("Content-Type");
                    if ("XMLHttpRequest".equalsIgnoreCase(sReqType) || (contentType != null && contentType.toLowerCase().contains("application/json"))) {
                        response.setContentType("application/json; charset=utf-8");
                        response.getWriter().print(JacksonUtils.toJSONString(ApiResult.fail(StatusCode.C_10001)));
                    } else {
                        response.setContentType("text/html;charset=utf-8");
                        response.getWriter().print("用户未登录");
                    }
                    return;
                } else {
                    // 执行调用链方法
                    chain.doFilter(request, response);
                }
            } else {
                // 没有添加注解的请求直接放行
                chain.doFilter(request, response);
            }
        }

        // 在 chain.doFilter(request, response) 执行后调用可以返回值
        Object handler4 = request.getAttribute(HandlerMapping.BEST_MATCHING_HANDLER_ATTRIBUTE);
        System.out.println(handler4);
    }

    /**
     * 获取登录用户信息
     * @param request   http请求体
     * @return
     */
    private String getLoginUserName(HttpServletRequest request) {
        try {
            String token = "";
            if (request.getCookies() != null) {
                for (Cookie c : request.getCookies()) {
                    if (null != c && "TOKEN".equals(c.getName())) {
                        token = c.getValue();
                        break;
                    }
                }
            }
            // 简单通过cookie中的token做权限判断，如果有token且符合要求就返回用户名，否则表示用户身份认证失败
            if(token != null && token.length() > 10) {
                String userName = token.substring(10);
                return userName.equals("admin") ? userName : null;
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }

    /**
     * 缓存handler
     */
    public static final ConcurrentHashMap<String, HandlerMethod> handlerMap = new ConcurrentHashMap<>();
    /**
     * 获取请求对应的handler方法
     * @param request
     * @return
     */
    private HandlerMethod getHandlerMethod(HttpServletRequest request) {
        String uri = request.getRequestURI();
        String method = request.getMethod();

        String key = (method + ":" + uri).intern();
        HandlerMethod handler = handlerMap.get(key);
        if(handler == null) {
            //获取应用中所有的请求
            Map<RequestMappingInfo, HandlerMethod> handlerMethods = requestMappingHandlerMapping.getHandlerMethods();
            Set<Map.Entry<RequestMappingInfo, HandlerMethod>> entries = handlerMethods.entrySet();

            for(Map.Entry<RequestMappingInfo, HandlerMethod> entry : entries) {
                RequestMethodsRequestCondition methodsCondition = entry.getKey().getMethodsCondition();
                boolean checkMethod = false;
                if(methodsCondition.getMethods().isEmpty()) {
                    checkMethod = true;
                } else {
                    for(RequestMethod reqMethod : methodsCondition.getMethods()) {
                        checkMethod = reqMethod.name().equals(method);
                        if(checkMethod) {
                            break;
                        }
                    }
                }

                PathPatternsRequestCondition pathCondition = entry.getKey().getPathPatternsCondition();
                if(checkMethod && pathCondition.getDirectPaths().contains(uri)) {
                    handler = entry.getValue();
                }
            }
            if(handler != null) {
                handlerMap.put(key, handler);
            }
        }
        return handler;
    }
}

这里也可以使用Filter进行处理，但是我选择继承spring实现的OncePerRequestFilter，在每次请求时过滤器只会执行一次，这里面最主要的处理逻辑是获取到HandlerMethod，获取到这个对象后剩余的处理逻辑跟拦截器基本一致了，只不过拦截器是通过返回布尔值true或false来进行放行或拦截。而在Filter中是通过是否调用 chain.doFilter(request, response) 这个方法来进行放行和拦截的。
还是用上面的controller进行测试，这次只对添加了注解的方法进行拦截，没有添加注解的请求直接放行。

成功请求错误token
无token
不拦截的请求