自定义taglib给jsp鉴权（适用于分布式系统鉴权）

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
<?xml version="1.0" encoding="UTF-8"?>
<taglib>
<tlib-version>1.0</tlib-version>
<jsp-version>2.0</jsp-version>
<short-name>ast</short-name><!-- taglib的名称，也称为前缀。比如<c:out value=""/> 里的“c” -->
<!-- autSecurityTag -->
<uri>aut-security</uri><!-- 标签引入使用uri -->
<tag>
<name>resAuthCheck</name><!-- tag的名字。例如<c:out value=""/> 里的"out”，我们的类也取名为out-->
<tag-class>com.smy.aut.security.interceptor.SmyAutCheckTag</tag-class><!-- 标签处理类 -->
<attribute><!-- 标签传参设置 -->
<name>resId</name> <!-- 标签传参名 -->
<required>false</required><!-- 是否必填 -->
<rtexprvalue>true</rtexprvalue><!-- 是否支持恶劣表达式 -->
<type>java.lang.String</type><!-- 字段类型 -->
<description>例如：AUTA000001</description><!-- 描述 -->
</attribute>
</tag>
</taglib>

1
2
3
4
5
6
7
8
9
10
<!-- 自定义文件放置在META-INF将META-INF放置main/resources目录 -->
<plugin>
<artifactId>maven-jar-plugin</artifactId>
<configuration>
<classesDirectory>target/classes/</classesDirectory>
<archive>
<addMavenDescriptor>false</addMavenDescriptor>
</archive>
</configuration>
</plugin>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
package com.smy.aut.security.interceptor;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.jsp.JspException;
import javax.servlet.jsp.tagext.BodyTagSupport;
import javax.servlet.jsp.tagext.TagSupport;
import org.apache.commons.lang3.StringUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.smy.aut.security.constant.ConstantSecurity;
import com.smy.aut.security.util.SmyAutCheck;
/**
* 权限鉴权jsp标签支持
* @author guoyunfeng
*
*/
public class SmyAutCheckTag extends TagSupport {
private static Logger log = LoggerFactory.getLogger(SmyAutCheckTag.class);
/**
* 资源编号
*/
private String
resId;
@Override
public int doStartTag() throws JspException {
log.info("jsp按钮鉴权开始 ... resId:" + resId
);
boolean reStatus = false;
HttpServletRequest request = (HttpServletRequest) pageContext.getRequest();
String userId = SmyAutCheck.getCookiesValues(request, "userId");
String userType = SmyAutCheck.getCookiesValues(request, "userType");
String resType = "A";
// 资源编号不为空
if (StringUtils.isNotBlank(resId)) {
// 鉴权
if (SmyAutCheck.hasAuthority(userId, resId, resType)) {
log.info("权限验证通过");
reStatus = true;
} else {
log.info("权限验证不通过");
}
}
log.info("jsp按钮鉴权结果:" + reStatus);
if (reStatus) {
// 允许访问标签body
return BodyTagSupport.EVAL_BODY_INCLUDE;// 返回此则执行标签body中内容，SKIP_BODY则不执行
} else {
return BodyTagSupport.SKIP_BODY;
}
}
@Override
public int doEndTag() throws JspException {
return BodyTagSupport.EVAL_BODY_INCLUDE;
}
public String getResId() {
return resId;
}
public void setResId(String resId) {
this.resId = resId;
}
}

1
2
3
4
5
6
<!-- jsp最上面引入 -->
<%@ taglib prefix="ast" uri="aut-security" %>
<!-- 需要鉴权的地方加上自定义标签 -->
<ast:resAuthCheck resId="resId" >
<button type="button" id="updateBtn" >修改状态</button>
</ast:resAuthCheck>