拦截器权限校验

1.自定义拦截器, 实现HandlerInterceptor接口

判断用户是否登录; 判断用户是否有权限访问某url (基于角色的权限控制)

/**
 * 登陆拦截，判断用户是否有权限
 */
@Component
@Slf4j
public class AuthorityInterceptor implements HandlerInterceptor {

    @Autowired
    private AuMenuService auMenuService;

    private static ThreadLocalRandom threadLocalRandom = ThreadLocalRandom.current();

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        User user = SessionUtils.getSessionUser();
        if (user == null) {
            log.info("未登录");
            response.sendRedirect("/logout.html");
            return false;
        }
        String uri = request.getRequestURI();
        //判断当前访问的路径是否在该用户所属角色的权限列表里
        if (!auMenuService.validate(uri, user.getRoleId())) {
            log.info("暂无权限url: " + uri + "");
            response.sendRedirect("/nav/logout.html");
            return false;
        }
        if (threadLocalRandom.nextBoolean()) {
            SessionUtils.setSessionUser(user);
        }
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
    }
}

2.注册拦截器

@Configuration
@Slf4j
@ComponentScan(value="com.prj.interceptor")    //扫描拦截器所在的包
public class WebAppConfig implements WebMvcConfigurer {

    private AuthorityInterceptor authorityInterceptor;
    private AuMenuService auMenuService;

    @Autowired
    public WebAppConfig(AuthorityInterceptor authorityInterceptor, AuMenuService auMenuService) {
        this.authorityInterceptor = authorityInterceptor;
        this.auMenuService = auMenuService;
    }

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(authorityInterceptor).addPathPatterns("/**")    //拦截所有
                .excludePathPatterns(auMenuService.findCommonMenuUri())         //不拦截通用路径
                .excludePathPatterns("/","/static/**","/upload_file/**");    //不拦截主页和静态资源
    }
}

附录:

拦截器方法简介:

    preHandle: 该方法会在请求转发到Controller之前被执行
    postHandle: 该方法会在Controller处理之后但是视图还没有解析的时候执行
    afterCompletion: return后, 但是并未返回给用户时执行