springmvc interceptor, does not intercept jsp files

The interceptor of spring mvc only intercepts the controller and does not intercept the jsp file. If the jsp file is not intercepted, it will also bring security problems to the system.

There are two solutions:

1. Put all jsp files into the WEB-INF folder, so that users cannot directly access the jsp files under the WEB-INF file. The concept of spring mvc is also to request related jsp pages through @RequestMapping in the controller, instead of users directly accessing the jsp pages.

Next, write the relevant configuration

Add in springmvc.xml

<mvc:interceptors>
        <mvc:interceptor>
            <mvc:mapping path="/**"/>

            <mvc:exclude-mapping path="/admin/login.do"/><!--Exclude interception page-->
            <bean class="com.ms.controller.LoginInterceptor"></bean>
        </mvc:interceptor>
    </mvc:interceptors>

public class LoginInterceptor implements HandlerInterceptor {

    public void afterCompletion(HttpServletRequest arg0,
            HttpServletResponse arg1, Object arg2, Exception arg3)
            throws Exception {
        // TODO Auto-generated method stub

    }

    public void postHandle(HttpServletRequest arg0, HttpServletResponse arg1,
            Object arg2, ModelAndView arg3) throws Exception {
        // TODO Auto-generated method stub

    }

    public boolean preHandle(HttpServletRequest req, HttpServletResponse res,
            Object handler) throws Exception {
        HttpSession session=req.getSession();
        Object obj=session.getAttribute("userId");
        if(obj==null||obj.toString().equals("")){
            req.getRequestDispatcher("/admin/login.do").forward(req, res);
            return false;
        }
        return true;
    }
}

at the controller layer

@Controller
@RequestMapping("/admin")
public class AdminController {
    
    
    @RequestMapping("/login")  
    public String login(){
        return "/WEB-INF/jsp/admin/login.jsp";
    }
}

The above can solve the problem of spring mvc intercepting jsp pages

2. There is another solution: if the jsp is not placed in the WEB-INF file, spring mvc cannot intercept it. In this case, the most primitive servlet Filter interface needs to be used. For details, please refer to

The following blog will not repeat them.

http://blog.csdn.net/lsx991947534/article/details/45499205 http://blog.csdn.net/lsx991947534/article/details/45499205