日期:2014-05-19  浏览次数:20691 次

过滤器防止地址栏直接输入非法登录

我写了一个防止地址栏的非法登录的过滤器。 但是这个过滤器,他把我登录程序以后的以.JSP的所有请求也全部拦截了,
比如说我有个add.jsp的添加页面的请求,点击添加按钮,他也自动跳回到了login.jsp页面。

下面是代码:谁能帮我改下啊,谢谢

package filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class VerifyFilter implements Filter {

public void destroy() {

}

public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletRequest httpreq = (HttpServletRequest) request;
HttpServletResponse httpresp = (HttpServletResponse) response;
HttpSession session = httpreq.getSession();

// String path1=httpreq.getServletPath();
String path1 = httpreq.getRequestURI();
int n1 = path1.indexOf("login.jsp");
String path2 = httpreq.getServletPath();
int n2 = path2.indexOf("action/action");
if (n1 != -1 || n2 != -1)
chain.doFilter(request, response);
else {
String username = (String) session.getAttribute("username");
if (username == null)
httpresp.sendRedirect("login.jsp");
}

}

public void init(FilterConfig filterConfig) throws ServletException {

}

}


------解决方案--------------------