过滤器实现自动登陆

实现用户自动登陆

　　思路是这样的：

　　1、在用户登陆成功后，发送一个名称为user的cookie给客户端，cookie的值为用户名和md5加密后的密码。
　　2、编写一个AutoLoginFilter，这个filter检查用户是否带有名称为user的cookie来，如果有，则调用dao查询cookie的用户名和密码是否和数据库匹配，匹配则向session中存入user对象（即用户登陆标记），以实现程序完成自动登陆。

　　核心代码如下：

　　处理用户登录的控制器：LoginServlet

 1 package me.gacl.web.controller;
 2 
 3 import java.io.IOException;
 4 
 5 import javax.servlet.ServletException;
 6 import javax.servlet.http.Cookie;
 7 import javax.servlet.http.HttpServlet;
 8 import javax.servlet.http.HttpServletRequest;
 9 import javax.servlet.http.HttpServletResponse;
10 
11 import me.gacl.dao.UserDao;
12 import me.gacl.domain.User;
13 import me.gacl.util.WebUtils;
14 
15 public class LoginServlet extends HttpServlet {
16 
17     public void doGet(HttpServletRequest request, HttpServletResponse response)
18             throws ServletException, IOException {
19 
20         String username = request.getParameter("username");
21         String password = request.getParameter("password");
22         
23         UserDao dao = new UserDao();
24         User user = dao.find(username, password);
25         if(user==null){
26             request.setAttribute("message", "用户名或密码不对！！");
27             request.getRequestDispatcher("/message.jsp").forward(request, response);
28             return;
29         }
30         request.getSession().setAttribute("user", user);
31         //发送自动登陆cookie给客户端浏览器进行存储
32         sendAutoLoginCookie(request,response,user);
33         request.getRequestDispatcher("/index.jsp").forward(request, response);
34     }
35 
36     /**
37     * @Method: sendAutoLoginCookie
38     * @Description: 发送自动登录cookie给客户端浏览器
39     * @Anthor:孤傲苍狼
40     *
41     * @param request
42     * @param response
43     * @param user
44     */ 
45     private void sendAutoLoginCookie(HttpServletRequest request, HttpServletResponse response, User user) {
46         if (request.getParameter("logintime")!=null) {
47             int logintime = Integer.parseInt(request.getParameter("logintime"));
48             //创建cookie,cookie的名字是autologin，值是用户登录的用户名和密码，用户名和密码之间使用.进行分割，密码经过md5加密处理
49             Cookie cookie = new Cookie("autologin",user.getUsername() + "." + WebUtils.md5(user.getPassword()));
50             //设置cookie的有效期
51             cookie.setMaxAge(logintime);
52             //设置cookie的有效路径
53             cookie.setPath(request.getContextPath());
54             //将cookie写入到客户端浏览器
55             response.addCookie(cookie);
56         }
57     }
58     
59     public void doPost(HttpServletRequest request, HttpServletResponse response)
60             throws ServletException, IOException {
61 
62         doGet(request, response);
63     }
64 
65 }

　　处理用户自动登录的过滤器：AutoLoginFilter

 1 package me.gacl.web.filter;
 2 
 3 import java.io.IOException;
 4 
 5 import javax.servlet.Filter;
 6 import javax.servlet.FilterChain;
 7 import javax.servlet.FilterConfig;
 8 import javax.servlet.ServletException;
 9 import javax.servlet.ServletRequest;
10 import javax.servlet.ServletResponse;
11 import javax.servlet.http.Cookie;
12 import javax.servlet.http.HttpServletRequest;
13 import javax.servlet.http.HttpServletResponse;
14 
15 import me.gacl.dao.UserDao;
16 import me.gacl.domain.User;
17 import me.gacl.util.WebUtils;
18 
19 public class AutoLoginFilter implements Filter {
20 
21     public void doFilter(ServletRequest req, ServletResponse resp,
22             FilterChain chain) throws IOException, ServletException {
23         
24         HttpServletRequest request = (HttpServletRequest) req;
25         HttpServletResponse response = (HttpServletResponse) resp;
26         //如果已经登录了，就直接chain.doFilter(request, response)放行
27         if(request.getSession().getAttribute("user")!=null){
28             chain.doFilter(request, response);
29             return;
30         }
31         
32         //1.得到用户带过来的authlogin的cookie
33         String value = null;
34         Cookie cookies[] = request.getCookies();
35         for(int i=0;cookies!=null && i<cookies.length;i++){
36             if(cookies[i].getName().equals("autologin")){
37                 value = cookies[i].getValue();
38             }
39         }
40         
41         //2.得到 cookie中的用户名和密码 
42         if(value!=null){
43             String username = value.split("\\.")[0];
44             String password = value.split("\\.")[1];
45             
46             //3.调用dao获取用户对应的密码
47             UserDao dao = new UserDao();
48             User user = dao.find(username);
49             String dbpassword = user.getPassword();
50             
51             //4.检查用户带过来的md5的密码和数据库中的密码是否匹配,如匹配则自动登陆
52             if(password.equals(WebUtils.md5(dbpassword))){
53                 request.getSession().setAttribute("user", user);
54             }
55         }
56         
57         chain.doFilter(request, response);
58     }
59     
60     public void destroy() {
61         
62     }
63 
64     public void init(FilterConfig filterConfig) throws ServletException {
65 
66     }
67 }

　　如果想取消自动登录，那么可以在用户注销时删除自动登录cookie，核心代码如下：

 1 package me.gacl.web.controller;
 2 
 3 import java.io.IOException;
 4 
 5 import javax.servlet.ServletException;
 6 import javax.servlet.http.Cookie;
 7 import javax.servlet.http.HttpServlet;
 8 import javax.servlet.http.HttpServletRequest;
 9 import javax.servlet.http.HttpServletResponse;
10 
11 public class CancelAutoLoginServlet extends HttpServlet {
12 
13     public void doGet(HttpServletRequest request, HttpServletResponse response)
14             throws ServletException, IOException {
15         //移除存储在session中的user
16         request.getSession().removeAttribute("user");
17         //移除自动登录的cookie
18         removeAutoLoginCookie(request,response);
19         //注销用户后跳转到登录页面
20         request.getRequestDispatcher("/login.jsp").forward(request, response);
21     }
22 
23     /**
24     * @Method: removeAutoLoginCookie
25     * @Description: 删除自动登录cookie，
26     *     JavaWeb中删除cookie的方式就是新创建一个cookie，新创建的cookie与要删除的cookie同名，
27     *     设置新创建的cookie的cookie的有效期设置为0，有效路径与要删除的cookie的有效路径相同
28     * @Anthor:孤傲苍狼
29     *
30     * @param request
31     * @param response
32     */ 
33     private void removeAutoLoginCookie(HttpServletRequest request, HttpServletResponse response) {
34         //创建一个名字为autologin的cookie
35         Cookie cookie = new Cookie("autologin","");
36          //将cookie的有效期设置为0，命令浏览器删除该cookie
37         cookie.setMaxAge(0);
38         //设置要删除的cookie的path
39         cookie.setPath(request.getContextPath());
40         response.addCookie(cookie);
41     }
42     
43     public void doPost(HttpServletRequest request, HttpServletResponse response)
44             throws ServletException, IOException {
45         doGet(request, response);
46     }
47 }