package main.filter;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.springframework.security.access.SecurityMetadataSource;
import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
import org.springframework.security.access.intercept.InterceptorStatusToken;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
public class MySecurityFilter extends AbstractSecurityInterceptor implements Filter {
//与applicationContext-security.xml里的myFilter的属性securityMetadataSource对应，
//其他的两个组件，已经在AbstractSecurityInterceptor定义
private FilterInvocationSecurityMetadataSource securityMetadataSource;
@Override
public SecurityMetadataSource obtainSecurityMetadataSource() {
return this.securityMetadataSource;
}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
FilterInvocation fi = new FilterInvocation(request, response, chain);
invoke(fi);
}
private void invoke(FilterInvocation fi) throws IOException, ServletException {
// object为FilterInvocation对象
//super.beforeInvocation(fi);源码
//1.获取请求资源的权限
//执行Collection<ConfigAttribute> attributes = SecurityMetadataSource.getAttributes(object);
//2.是否拥有权限
//this.accessDecisionManager.decide(authenticated, object, attributes);
InterceptorStatusToken token = super.beforeInvocation(fi);
try {
fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
} finally {
super.afterInvocation(token, null);
}
}
public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
return securityMetadataSource;
}
public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource securityMetadataSource) {
this.securityMetadataSource = securityMetadataSource;
}
public void init(FilterConfig arg0) throws ServletException {
// TODO Auto-generated method stub
}
public void destroy() {
// TODO Auto-generated method stub
}
@Override
public Class<? extends Object> getSecureObjectClass() {
//下面的MyAccessDecisionManager的supports方面必须放回true,否则会提醒类型错误
return FilterInvocation.class;
}
}
spring_security.zip （59个子文件） 
spring_security db 
db.sql 2KB test test TestDemo.java 595B TestJDBC.java 1KB .settings com.genuitec.eclipse.j2eedt.core.prefs 1KB org.eclipse.wst.jsdt.ui.superType.name 6B org.eclipse.wst.jsdt.ui.superType.container 49B .jsdtscope 500B org.eclipse.jdt.core.prefs 330B src main manager MyDaoAuthenticationProvider.java 1KB MyAccessDecisionManager.java 2KB filter MySecurityFilter.java 3KB MyLoginFilter.java 3KB model User.java 959B Role.java 506B Resource.java 751B Perm.java 506B consts daoImpl UserDaoImpl.java 2KB transaction TransactionDemo.java 590B security UserDetail.java 2KB controller FileUploadController.java 2KB TestController.java 649B service UserService.java 1KB source .project 1KB WebRoot loginError.jsp 923B META-INF MANIFEST.MF 36B timeout.jsp 844B WEB-INF config jdbc.properties 122B log4j.properties 2KB web.xml 3KB classes test TestJDBC.class 2KB TestDemo.class 820B main manager MyDaoAuthenticationProvider.class 2KB MyAccessDecisionManager.class 3KB filter MySecurityFilter.class 3KB MyLoginFilter.class 3KB model User.class 2KB Perm.class 895B Resource.class 1KB Role.class 895B consts daoImpl UserDaoImpl$2.class 2KB UserDaoImpl.class 2KB UserDaoImpl$1.class 2KB transaction TransactionDemo.class 526B security UserDetail.class 2KB controller TestController.class 1KB FileUploadController.class 3KB service UserService.class 1KB source lib spring spring_security.xml 3KB spring.xml 4KB springmvc-servlet.xml 3KB spring-dao.xml 655B spring-service.xml 862B login.jsp 1KB index.jsp 1KB accessDenied.jsp 855B fileUpload.jsp 1KB test1.jsp 858B .mymetadata 319B .classpath 8KB .myeclipse 资源评论
