过滤页面、用户登录后、还是可以带参数请求后台、求解、

[My-Xing]

写了一个过滤器、没有登录的用户都会过滤掉、没问题、但是用户登录过后就可以进行任何的访问、携带参数直接访问后台都行、请高手指点下

[yimingxinshou]

至少应该贴一下过滤器代码和配置啊

[My-Xing]

public class InterceptorTools implements Filter { @Override public void destroy() {} @Override public void doFilter(ServletRequest arg0, ServletResponse arg1, FilterChain arg2) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest)arg0; HttpServletResponse response = (HttpServletResponse)arg1; User user = (User) request.getSession().getAttribute("user"); if (user == null) { request.getRequestDispatcher("/login.jsp").forward(request, response); } else { arg2.doFilter(request, response); } } @Override public void init(FilterConfig arg0) throws ServletException {} } 配置文件 <filter> <filter-name>InterceptorTools</filter-name> <filter-class>com.muyi.shopmanager.tools.InterceptorTools</filter-class> </filter> <filter-mapping> <filter-name>InterceptorTools</filter-name> <url-pattern>/html/*</url-pattern> </filter-mapping> <filter-mapping> <filter-name>InterceptorTools</filter-name> <url-pattern>/admin/*</url-pattern> </filter-mapping>