先定义一个注解接口 VerifyToken.java :
package com.zero4j.annotation;
import java.lang.annotation.*;
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface VerifyToken {
String permission() default "";
package com.zero4j.annotation;
import java.lang.annotation.*;
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface VerifyToken {
//权限参数
String permission() default "";
}
package com.zero4j.annotation;
import java.lang.annotation.*;
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface VerifyToken {
//权限参数
String permission() default "";
}
再在同目录中定义一个切面类VerifyTokenAspect.java:
package com.zero4j.annotation;
import java.util.Enumeration;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import net.sf.json.JSONObject;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Pointcut;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import com.zero4j.model.account.Account;
import com.zero4j.model.permission.util.PermissionStaticUtil;
import com.zero4j.model.token.util.TokenStaticUtil;
import com.zero4j.util.ResponseStaticUtil;
public class VerifyTokenAspect {
@Pointcut("@annotation(com.zero4j.annotation.VerifyToken)") //这是annotation对应类的所在位置,若目录不同,则填写完整路径,如:com.zero4j.annotation.VerifyToken
@Around("pointcut()&&@annotation(verifyToken)")
public void around(ProceedingJoinPoint pjp, VerifyToken verifyToken) throws Throwable{
//System.out.println("annotation执行前");
//System.out.println("verifyToken.permission() = "+verifyToken.permission());
ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
HttpServletRequest request = attributes.getRequest();
HttpServletResponse response = attributes.getResponse();
String token = request.getParameter("token");
JSONObject out = new JSONObject();
if(token==null||token.equals("")){
out.put("message", "请先注册并登录后再进行此操作");
out.put("debug", "缺少参数token或为空");
ResponseStaticUtil.write(response,out);
//System.out.println(out.toString());
Account account = TokenStaticUtil.getAccount(token);
out.put("message", "请先注册并登录后再进行此操作");
out.put("debug", "token对应的account为空");
ResponseStaticUtil.write(response,out);
//System.out.println(out.toString());
if(!(verifyToken.permission()==null||verifyToken.permission().equals(""))){
if(PermissionStaticUtil.verify(account.getId(), verifyToken.permission())==false){
out.put("message", "你无权进行本操作");
out.put("debug", "你没有"+verifyToken.permission()+"权限");
ResponseStaticUtil.write(response,out);
//System.out.println(out.toString());
package com.zero4j.annotation;
import java.util.Enumeration;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import net.sf.json.JSONObject;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Pointcut;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import com.zero4j.model.account.Account;
import com.zero4j.model.permission.util.PermissionStaticUtil;
import com.zero4j.model.token.util.TokenStaticUtil;
import com.zero4j.util.ResponseStaticUtil;
@Aspect
@Component
public class VerifyTokenAspect {
@Pointcut("@annotation(com.zero4j.annotation.VerifyToken)") //这是annotation对应类的所在位置,若目录不同,则填写完整路径,如:com.zero4j.annotation.VerifyToken
private void pointcut(){
}
@Around("pointcut()&&@annotation(verifyToken)")
public void around(ProceedingJoinPoint pjp, VerifyToken verifyToken) throws Throwable{
//System.out.println("annotation执行前");
//System.out.println("verifyToken.permission() = "+verifyToken.permission());
ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
HttpServletRequest request = attributes.getRequest();
HttpServletResponse response = attributes.getResponse();
String token = request.getParameter("token");
JSONObject out = new JSONObject();
if(token==null||token.equals("")){
out.put("status", 401);
out.put("message", "请先注册并登录后再进行此操作");
out.put("debug", "缺少参数token或为空");
ResponseStaticUtil.write(response,out);
//System.out.println(out.toString());
return;
}
Account account = TokenStaticUtil.getAccount(token);
if(account==null){
out.put("status", 401);
out.put("message", "请先注册并登录后再进行此操作");
out.put("debug", "token对应的account为空");
ResponseStaticUtil.write(response,out);
//System.out.println(out.toString());
return;
}
if(!(verifyToken.permission()==null||verifyToken.permission().equals(""))){
if(PermissionStaticUtil.verify(account.getId(), verifyToken.permission())==false){
out.put("status", 403);
out.put("message", "你无权进行本操作");
out.put("debug", "你没有"+verifyToken.permission()+"权限");
ResponseStaticUtil.write(response,out);
//System.out.println(out.toString());
return;
}
}
if(out.size()==0){
pjp.proceed();
}
}
}
package com.zero4j.annotation;
import java.util.Enumeration;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import net.sf.json.JSONObject;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Pointcut;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import com.zero4j.model.account.Account;
import com.zero4j.model.permission.util.PermissionStaticUtil;
import com.zero4j.model.token.util.TokenStaticUtil;
import com.zero4j.util.ResponseStaticUtil;
@Aspect
@Component
public class VerifyTokenAspect {
@Pointcut("@annotation(com.zero4j.annotation.VerifyToken)") //这是annotation对应类的所在位置,若目录不同,则填写完整路径,如:com.zero4j.annotation.VerifyToken
private void pointcut(){
}
@Around("pointcut()&&@annotation(verifyToken)")
public void around(ProceedingJoinPoint pjp, VerifyToken verifyToken) throws Throwable{
//System.out.println("annotation执行前");
//System.out.println("verifyToken.permission() = "+verifyToken.permission());
ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
HttpServletRequest request = attributes.getRequest();
HttpServletResponse response = attributes.getResponse();
String token = request.getParameter("token");
JSONObject out = new JSONObject();
if(token==null||token.equals("")){
out.put("status", 401);
out.put("message", "请先注册并登录后再进行此操作");
out.put("debug", "缺少参数token或为空");
ResponseStaticUtil.write(response,out);
//System.out.println(out.toString());
return;
}
Account account = TokenStaticUtil.getAccount(token);
if(account==null){
out.put("status", 401);
out.put("message", "请先注册并登录后再进行此操作");
out.put("debug", "token对应的account为空");
ResponseStaticUtil.write(response,out);
//System.out.println(out.toString());
return;
}
if(!(verifyToken.permission()==null||verifyToken.permission().equals(""))){
if(PermissionStaticUtil.verify(account.getId(), verifyToken.permission())==false){
out.put("status", 403);
out.put("message", "你无权进行本操作");
out.put("debug", "你没有"+verifyToken.permission()+"权限");
ResponseStaticUtil.write(response,out);
//System.out.println(out.toString());
return;
}
}
if(out.size()==0){
pjp.proceed();
}
}
}
最后在需要切入的地方加上注解即可:
@VerifyToken(permission="adminLog_read")
@RequestMapping(value="", method=RequestMethod.GET)
public void list(HttpServletRequest request, HttpServletResponse response,
@RequestParam(required=false) String token,
@RequestParam(required=false) Integer offset,
@RequestParam(required=false) Integer limit,
@RequestParam(required=false) String startTime,
@RequestParam(required=false) String endTime,
@RequestParam(required=false) String accountNickname,
@RequestParam(required=false) String accountMobile,
@RequestParam(required=false) String description
@VerifyToken(permission="adminLog_read")
@RequestMapping(value="", method=RequestMethod.GET)
public void list(HttpServletRequest request, HttpServletResponse response,
@RequestParam(required=false) String token,
@RequestParam(required=false) Integer offset,
@RequestParam(required=false) Integer limit,
@RequestParam(required=false) String startTime,
@RequestParam(required=false) String endTime,
@RequestParam(required=false) String accountNickname,
@RequestParam(required=false) String accountMobile,
@RequestParam(required=false) String description
){
........
}
@VerifyToken(permission="adminLog_read")
@RequestMapping(value="", method=RequestMethod.GET)
public void list(HttpServletRequest request, HttpServletResponse response,
@RequestParam(required=false) String token,
@RequestParam(required=false) Integer offset,
@RequestParam(required=false) Integer limit,
@RequestParam(required=false) String startTime,
@RequestParam(required=false) String endTime,
@RequestParam(required=false) String accountNickname,
@RequestParam(required=false) String accountMobile,
@RequestParam(required=false) String description
){
........
}