struts下的多台web服务器登陆处理

单台web app 做登陆很简单，放到session里就可以。但稍微大的应用都是apache下挂着多台tomcat的，tomcat1的session 到tomcat2下就不管用了。tomcat间的session复制也比较费性能，我们尽量要保持web层的无状态。

上一篇apache_tomcat负载均衡配置完成后，我基于此业余做了基于struts的多台应用登陆/自动登陆处理，源码在附件中。

原理：
1、登陆后把信息用户名及密码加密放入cooekis(如果选择自动登陆)，同时把User 对象放入session。下上文中通过session.getAttribute("User")来判断是否登陆
2、在访问时会有两个拦截器来处理
a.loginInterceptor
   从cookies中取得加密过的username和password,验证是否正确，将Uesr放入session
b.authInterceptor
   对需要登陆才能有的操作加入验证处理，如果没登陆将跳转到登陆页，登陆完成后跳转要操作的页面。

代码实现：

1、LoginInterceptor

/**
*
* 从cookies中恢复登陆
*
* @author 锅巴
* @version 1.0 2010-6-29
*/
public class LoginInterceptor implements Interceptor {  
   
    public final static String CRYPTO_PWD = "865azo@44536_t";
      
    private UserDAO userDAO;
 
 
    public String intercept(ActionInvocation arg0) throws Exception {
       
       
      
        printCookies();
       
        process(arg0);
    
        return arg0.invoke();
    }

   

    private void process(ActionInvocation arg0) throws Exception {
        Map session = arg0.getInvocationContext().getSession();
       
        if(session != null && session.get(Statics.USER_SESSION_KEY) != null){
            System.out.println("========== user is have in session ");
            return ;
        }
           
       
        HttpServletRequest request = ServletActionContext.getRequest();
        Cookie[] cookies = request.getCookies();
       
        if(cookies == null)
            return;
       
       
        for (Cookie cookie : cookies) {
            if (Statics.COOKIE_REMEMBERME_KEY.equals(cookie.getName())
                    && !StringUtils.isEmpty(cookie.getValue())) {
                String[] split = cookie.getValue().split("-");
                String userName = DESCrypto.decrypt(split[0],CRYPTO_PWD);
                String password = DESCrypto.decrypt(split[1],CRYPTO_PWD);
                try {
                    User user = userDAO.attemptLogin(userName, password);
                    session.put(Statics.USER_SESSION_KEY, user);
                } catch (UserNotFoundException e) {
                    
                }
            }
        }
    }  
   
   
    private void printCookies(){
        System.out.println("========= printCookies statrt ========");
        Cookie[] cookies = ServletActionContext.getRequest().getCookies();
        if(cookies != null){
            for(Cookie cook : cookies){
                System.out.println(cook.getName() + " : " + cook.getValue() + " : " + cook.getMaxAge() );
            }
        }
      
        System.out.println("========= printCookies end ========");
    }
   
 
      
   

    public UserDAO getUserDAO() {
        return userDAO;
    }

    public void setUserDAO(UserDAO userDAO) {
        this.userDAO = userDAO;
    }

    public void destroy() {
        // TODO Auto-generated method stub
       
    }

    public void init() {
        // TODO Auto-generated method stub
       
    }
}

2、AuthInterceptor

/**
* 必须验证要登陆的拦截器
* @author 锅巴
* @version 1.0 2010-6-29
*/
public class AuthInterceptor implements Interceptor{

    private final static String ACTH_ERROR_TO_URL = "forwardLogin";
  
    private static Log log = LogFactory.getLog(AuthInterceptor.class);
   
   
    public void destroy() {
        // TODO Auto-generated method stub
       
    }

    public void init() {
        // TODO Auto-generated method stub
       
    }

    public String intercept(ActionInvocation arg0) throws Exception {
        // TODO Auto-generated method stub
       Map session = arg0.getInvocationContext().getSession();
       if(session == null || session.get(Statics.USER_SESSION_KEY) == null){
           return getAuthErrorReturn(arg0);
       }
       
       return arg0.invoke();
    }
   
    private String getAuthErrorReturn(ActionInvocation arg0){
     
        HttpServletRequest request  =  ServletActionContext.getRequest();  
       
      
        String urlValue = request.getRequestURL().toString();
        if (request.getQueryString() != null)
            urlValue += "?" + request.getQueryString();
        request.setAttribute(Statics.AUTH_LOGIN_GO, urlValue);
        log.debug("urlValue:" + urlValue);
        return ACTH_ERROR_TO_URL;
    }
   

  
   
}

3、Login 登陆action

/**
*
* 描述
*
* @author 锅巴
* @version 1.0 2010-7-5
*/
public class LoginAction extends ActionSupport implements SessionAware,CookiesAware,ServletResponseAware,ServletRequestAware{

    private Map session;
   
    private Map cookie;
   
    private HttpServletResponse response;
   
    private UserDAO userDAO;
   
    private String username;
   
    private String password;
   
    private String goUrl;
   
    private HttpServletRequest request;
   
    private boolean rememberMe;
   
   
   
    public boolean isRememberMe() {
        return rememberMe;
    }



    public void setRememberMe(boolean rememberMe) {
        this.rememberMe = rememberMe;
    }



    @Override
    public void setServletRequest(HttpServletRequest arg0) {
        // TODO Auto-generated method stub
        this.request = arg0;
    }



    public void setUserDAO(UserDAO userDAO) {
        this.userDAO = userDAO;
    }

   
   
    public String getGoUrl() {
        return goUrl;
    }



    public void setGoUrl(String goUrl) {
        this.goUrl = goUrl;
    }



    public String getUsername() {
        return username;
    }



    public void setUsername(String username) {
        this.username = username;
    }



    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    @Override
    public void setServletResponse(HttpServletResponse arg0) {
        // TODO Auto-generated method stub
        this.response = arg0;
    }

    @Override
    public void setSession(Map arg0) {
        // TODO Auto-generated method stub
        this.session = arg0;
    }

    @Override
    public void setCookiesMap(Map arg0) {
        // TODO Auto-generated method stub
        this.cookie = arg0;
    }

    @Override
    public String execute() throws Exception {
        // TODO Auto-generated method stub
        return SUCCESS;
    }
   
   
   
    public String postLogin() throws Exception {
        User user = null;
        try{
            user = userDAO.attemptLogin(username, password);
        }catch(UserNotFoundException ex){
            addActionError("登陆失败！");
            return INPUT;
        }
       
        processCookie(user);
       
        return SUCCESS;
    }



    private void processCookie(User user) throws Exception {
        session.put(Statics.USER_SESSION_KEY, user);
       
        //cookie value 不能有==这种情况,不能ie会拒绝该cookies
        Cookie cookie = new Cookie(Statics.COOKIE_REMEMBERME_KEY, DESCrypto.desCrypto(username.getBytes(), LoginInterceptor.CRYPTO_PWD)+ "-" + DESCrypto.desCrypto(password.getBytes(), LoginInterceptor.CRYPTO_PWD));
        if (rememberMe){
            cookie.setMaxAge(60 * 60 * 24 * 14);
        }else{
            cookie.setMaxAge(0);
        }
        cookie.setPath("/");
        cookie.setDomain("t.com");
        response.addCookie(cookie);
    }

   
}

4、LoginOut 退出action

/**
*
* 描述
*
* @author 锅巴
* @version 1.0 2010-7-5
*/
public class LoginOutAction extends ActionSupport implements ServletResponseAware,ServletRequestAware{

    private HttpServletResponse response;
   
    private HttpServletRequest request;
   
   

    @Override
    public void setServletResponse(HttpServletResponse arg0) {
        // TODO Auto-generated method stub
        this.response=arg0;
    }

   
   
    @Override
    public void setServletRequest(HttpServletRequest arg0) {
        // TODO Auto-generated method stub
        this.request = arg0;
    }



    @Override
    public String execute() throws Exception {
        // TODO Auto-generated method stub
       
       
       
        Cookie[] cookies = request.getCookies();  
        if (cookies!=null) {  
            for (Cookie cookie : cookies) {  
                if (Statics.COOKIE_REMEMBERME_KEY.equals(cookie  
                        .getName())) {
                    //清除cookie时要与增加时步骤一致 如path,domain
                    cookie.setPath("/");
                    cookie.setDomain("t.com");
                    cookie.setValue("");  
                    cookie.setMaxAge(0);  
                    response.addCookie(cookie);
                }  
            }  
        }  

        HttpSession session = request.getSession(false);  
        if (session!=null)  
            session.removeAttribute(Statics.USER_SESSION_KEY);  
       
   
        System.out.println("============== login out ================");
        return SUCCESS;
    }

   
}

5、struts.xml配置
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE struts PUBLIC
    "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
    "http://struts.apache.org/dtds/struts-2.0.dtd">

<struts>

<package name="default" namespace="/" extends="struts-default">

<interceptors>  
            <interceptor name="loginInterceptor" class="com.my.interceptor.LoginInterceptor"></interceptor>
            <interceptor name="authInterceptor" class="com.my.interceptor.AuthInterceptor"></interceptor>  
           
         
            <!-- 默认拦截器堆栈 -->
            <interceptor-stack name="loginDefaultStack">
            <interceptor-ref name="loginInterceptor"></interceptor-ref>    
                <interceptor-ref name="authInterceptor"></interceptor-ref>  
                <interceptor-ref name="defaultStack"></interceptor-ref>  
            </interceptor-stack>
           
            <!-- 需要登陆验证的拦截器堆栈 -->
            <interceptor-stack name="autowireDefault">
            <interceptor-ref name="loginInterceptor"></interceptor-ref>
                <interceptor-ref name="defaultStack"></interceptor-ref>  
            </interceptor-stack>
              
        </interceptors>
       
        <default-interceptor-ref name="autowireDefault"></default-interceptor-ref>
       
        <global-results>
        <!-- 验证未通过跳转全局result -->  
            <result name="forwardLogin" type="chain">
            <param name="actionName">forwardLogin</param>
           <param name="namespace">/common</param>
    </result>  
        </global-results>

</package>

<include file="struts-conf/common.struts.xml"></include>
</struts>

6、common.struts.xml 配置
  <?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE struts PUBLIC
    "-//Apache Software Foundation//DTD Struts Configuration 2.0//EN"
    "http://struts.apache.org/dtds/struts-2.0.dtd">

<struts>

<package name="common" namespace="/common" extends="default">

<!--  跳转登录 -->
<action name="forwardLogin" class="com.my.action.JumpLoginAction">
<result name="success" type="redirect">
/common/login.html?goUrl=${goUrl}
</result>
</action>

<!-- 登陆页面 -->
<action name="login" class="com.my.action.LoginAction">
<result name="success" type="dispatcher">
/common/login.jsp
</result>
</action>

<!-- 退出 -->
<action name="loginOut" class="com.my.action.LoginOutAction">
<result name="success" type="dispatcher">
/common/login_out.jsp
</result>
</action>

<!-- 登陆post操作 -->
<action name="postLogin" class="com.my.action.LoginAction" method="postLogin">
<result name="success" type="redirect">
${goUrl}
</result>
<result name="input" type="dispatcher">
/common/login.jsp
</result>
<interceptor-ref name="autowireDefault" />
<interceptor-ref name="validationWorkflowStack" />
</action>

<!-- 需要登陆验证的页面 -->
<action name="home" class="com.my.action.HomeAction">
<result name="success" type="dispatcher">
/index.jsp
</result>
<interceptor-ref name="loginDefaultStack" />
</action>

</package>
</struts>

注意事项:

1、LoginAction-postLogin-validation.xml ，可以按action 方法名来验证。
2、cookies 中不能含有"=="，否则IE会写不进去。
3、写cookies与清cookies的操作要完全一致，否则清不了。
   如:              
   写cookies
    //cookie value 不能有==这种情况,不能ie会拒绝该cookies
    Cookie cookie = new Cookie(Statics.COOKIE_REMEMBERME_KEY, DESCrypto.desCrypto(username.getBytes(), LoginInterceptor.CRYPTO_PWD)+ "-" + DESCrypto.desCrypto(password.getBytes(), LoginInterceptor.CRYPTO_PWD));
        if (rememberMe){
            cookie.setMaxAge(60 * 60 * 24 * 14);
        }else{
            cookie.setMaxAge(0);
        }
        cookie.setPath("/");
        cookie.setDomain("t.com");
        response.addCookie(cookie);

    清cookies
                    cookie.setPath("/");
                    cookie.setDomain("t.com");
                    cookie.setValue("");  
                    cookie.setMaxAge(0);  
                    response.addCookie(cookie);