1.在web.xml文件中配置登录过滤器



2.写一个loginFilter 用于实现过滤没有登录的用户

loginFilter 实现filter接口，重写doFilter方法

web.xml中的配置：
    <!-- 登录过滤器 -->
    <filter>
    	<filter-name>loginFilter</filter-name>
    	<filter-class>com.hcj.filter.LoginFilter</filter-class>
    </filter>
     <filter-mapping>  
        <filter-name>loginFilter</filter-name>  
        <url-pattern>/*</url-pattern>  
    </filter-mapping> 
    
    <!-- 编码过滤器 -->
    <filter>
    	<filter-name>encodingFilter</filter-name>
    	<filter-class>com.hcj.filter.EncodingFilter</filter-class>
    </filter>
     <filter-mapping>  
        <filter-name>encodingFilter</filter-name>  
        <url-pattern>/*</url-pattern>  
    </filter-mapping>  


登录过滤器：
package com.hcj.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

import com.hcj.dto.User;

public class LoginFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // TODO Auto-generated method stub

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        // 获得在下面代码中要用的request,response,session对象
        HttpServletRequest servletRequest = (HttpServletRequest) request;
        HttpServletResponse servletResponse = (HttpServletResponse) response;
        HttpSession session = servletRequest.getSession();

        // 获得用户请求的URI
        String path = servletRequest.getRequestURI();
        //System.out.println(path);
        
        // 从session里取登录用户信息
        User user = (User) session.getAttribute("user");

        // 登陆页面无需过滤
        if(path.indexOf("/login.jsp") > -1) {
            chain.doFilter(servletRequest, servletResponse);
            return;
        }

        // 判断如果没有取到用户,就跳转到登陆页面
        if (user == null) {
            // 跳转到登陆页面
            servletResponse.sendRedirect("http://localhost:8080/Hikvision/user/login.jsp");
        } else {
            // 已经登陆,继续此次请求
            chain.doFilter(request, response);
        }

    }

    @Override
    public void destroy() {
        // TODO Auto-generated method stub

    }

}

编码过滤器：
package com.hcj.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class EncodingFilter implements Filter {

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // TODO Auto-generated method stub

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        // 获得在下面代码中要用的request,response对象
    	request.setCharacterEncoding("UTF-8");
        response.setCharacterEncoding("UTF-8");
        chain.doFilter(request, response);
    }

    @Override
    public void destroy() {
        // TODO Auto-generated method stub

    }

}

mvc登录过滤器
1.LoginActionAttribute类
2.FilterConfig
3.RouteConfig
4.Global
5.登录控制器

1.LoginActionAttribute类
public class LoginActionAttribute : ActionFilterAttribute
    {
        //判断是否是登录
        public bool IsOk { get; set; }
        public override void OnActionExecuting(ActionExecutingContext filterContext)
        {
            if (IsOk)
            {
                return;
            }

            if (filterContext.HttpContext.Session["user"] == null)
            {
                filterContext.Result = new RedirectResult("登录页");

                // filterContext.HttpContext.Response.Redirect("首页");
            }
        }
    }

2.FilterConfig
 public class FilterConfig
    {
        public static void RegisterGlobalFilters(GlobalFilterCollection filters)
        {
            //全局过滤器
            //filters.Add(new HandleErrorAttribute());

            //给全局加自己写的特性(过滤器)
            filters.Add(new LoginActionAttribute());
        }
    }

3.RouteConfig
 public class RouteConfig
    {
        public static void RegisterRoutes(RouteCollection routes)
        {
            routes.IgnoreRoute("{resource}.axd/{*pathInfo}");
            routes.MapRoute(
                name: "Default",
                url: "{controller}/{action}/{id}",
                defaults: new { controller = "Home", action = "Index", id = UrlParameter.Optional }
            );
        }
    }

4.Global
protected void Application_Start()
        {
            AreaRegistration.RegisterAllAreas();
            RouteConfig.RegisterRoutes(RouteTable.Routes);
            //AreaRegistration.RegisterAllAreas();
            //RouteConfig.RegisterRoutes(RouteTable.Routes);
            //FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
        }

5.登录控制器
 [LoginAction(IsOk = true)]

1、“登录过滤器”用途：
1）防止在用户未登录的情况下来访问网站。
2）举例：fire.html 这个网页是登录后才可以访问的，现在用户没有登录，直接可以访问fire.html。那么，这样的网站就存在安全问题？用户不用登录的情况下随随便便就访问。为了避免这样的情况，我们需要用过滤器来过滤一些需要登录后才可以访问的页面，可以理解为在门上加了一把锁。
2、实现操作：
1）简单一点，可以认定除了登录，注册页面，都需要过滤
2）判断用户有没有登录，已session为依据，来判断用户是否已登录。已登录，可以继续访问，没有登录返回到登录界面。
具体代码如下：
（1）LoginFilter.java
package com.filter;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class LoginFilter implements Filter{
	public void destroy() {
		// TODO Auto-generated method stub		
	}
	public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse,
			FilterChain filterChain) throws IOException, ServletException {
		HttpServletResponse response=(HttpServletResponse)servletResponse;
		HttpServletRequest request=(HttpServletRequest)servletRequest;
		HttpSession session=request.getSession(); 
		Object object=session.getAttribute("currentUser");//获取session中作为判断的字段
		String path=request.getServletPath();  //获取路径 request.getServletPath()返回：/main/list.jsp 
		// String path = req.getRequestURI();// 获得用户请求的URI， request.getRequestURI() 返回：项目名/main/list.jsp 
		             
		if(object==null&&path.indexOf("login")<0){
			//判断请求的 路径中是否包含了 登录页面的请求
	               //如果包含了，那么不过滤 继续执行操作
			//如果不是login.jsp进行过滤
			response.sendRedirect("forlogin.jsp");
		}else{
			
			filterChain.doFilter(servletRequest, servletResponse); // 已经登陆,继续此次请求
		}
	}

	public void init(FilterConfig arg0) throws ServletException {
		// TODO Auto-generated method stub		
	}
}
（2）web.xml
<filter>
  	<filter-name>loginFilter</filter-name>
  	<filter-class>com.filter.LoginFilter</filter-class>
  </filter>
  
  <filter-mapping>
  	<filter-name>loginFilter</filter-name>
  	<url-pattern>/*</url-pattern>
        <!-- <url-pattern>/*</url-pattern> 表示所有文件都需要过滤
        也可以写为--<url-pattern>/admin/*</url-pattern>这里的/admin/* 表示是指定路径下的文件需要过滤   >   
  </filter-mapping>