校园选举投票系统认证异常求助：登录后跳转问题

问题根源分析 #

登录成功后进入admin.html却被自动重定向，核心原因是前端JS调用的/checkAuthentication接口返回了未认证状态，而实际会话中authenticated属性已正确设置。常见诱因包括：

• 后端认证接口逻辑错误，误判会话状态
• 前端请求未携带Session Cookie，导致后端无法识别已登录会话
• 路由映射配置错误，接口未正确关联到AuthServlet
• 登录跳转方式不当，会话属性未及时生效

分步修复方案 #

1. 修正AuthServlet的认证判断逻辑 #

确保/checkAuthentication接口正确校验会话状态，避免空指针和逻辑反转：

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    // 不创建新会话，仅获取已存在的会话
    HttpSession session = request.getSession(false);
    boolean isAuthenticated = session != null && Boolean.TRUE.equals(session.getAttribute("authenticated"));
    
    response.setContentType("application/json");
    PrintWriter out = response.getWriter();
    out.write("{\"authenticated\": " + isAuthenticated + "}");
    out.flush();
}

2. 修复前端JS的认证请求 #

确保请求携带Session Cookie，避免后端无法识别会话：

window.addEventListener('load', () => {
    fetch('/你的应用上下文/checkAuthentication', {
        credentials: 'include' // 强制携带同域Cookie
    })
    .then(res => res.json())
    .then(data => {
        if (!data.authenticated) {
            window.location.href = 'index.html';
        }
    })
    .catch(() => window.location.href = 'index.html');
});

如果使用XMLHttpRequest，需设置withCredentials = true：

window.addEventListener('load', () => {
    const xhr = new XMLHttpRequest();
    xhr.open('GET', '/你的应用上下文/checkAuthentication', true);
    xhr.withCredentials = true;
    xhr.onreadystatechange = () => {
        if (xhr.readyState === 4) {
            if (xhr.status === 200) {
                const data = JSON.parse(xhr.responseText);
                if (!data.authenticated) window.location.href = 'index.html';
            } else {
                window.location.href = 'index.html';
            }
        }
    };
    xhr.send();
});

注意替换/你的应用上下文为实际项目的上下文路径，根路径直接用/checkAuthentication。

3. 校验web.xml的路由映射 #

确保AuthServlet同时关联/checkAuthentication接口和/admin.html拦截：

<servlet>
    <servlet-name>AuthServlet</servlet-name>
    <servlet-class>你的包路径.AuthServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>AuthServlet</servlet-name>
    <url-pattern>/checkAuthentication</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>AuthServlet</servlet-name>
    <url-pattern>/admin.html</url-pattern>
</servlet-mapping>

同时确认LoginServlet的映射正确：

<servlet>
    <servlet-name>LoginServlet</servlet-name>
    <servlet-class>你的包路径.LoginServlet</servlet-class>
</servlet>
<servlet-mapping>
    <servlet-name>LoginServlet</servlet-name>
    <url-pattern>/login</url-pattern>
</servlet-mapping>

4. 优化LoginServlet的跳转逻辑 #

登录成功后优先使用服务器端转发，确保会话属性立即生效：

protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    String username = request.getParameter("username");
    String password = request.getParameter("password");
    
    if ("gr".equals(username) && "password".equals(password)) {
        HttpSession session = request.getSession();
        session.setAttribute("authenticated", true);
        // 服务器端转发，会话数据直接生效
        request.getRequestDispatcher("admin.html").forward(request, response);
    } else {
        response.sendRedirect("index.html");
    }
}

若使用客户端跳转（sendRedirect），需拼接上下文路径：response.sendRedirect(request.getContextPath() + "/admin.html")。

5. 双重保障：禁用admin.html直接访问 #

在web.xml中添加安全约束，配合AuthServlet拦截未认证请求：

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Admin Pages</web-resource-name>
        <url-pattern>/admin.html</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
</security-constraint>

内容的提问来源于stack exchange，提问作者Pharaoh_2398