授权后获取用户详情及JSP、Servlet开发技术疑问咨询

Hey Sam, let's tackle your questions step by step—this stuff can feel tricky at first, but we'll get you through it!

1. 获取授权后的用户详情 #

Once your user completes authorization, the key is to store their details in a place accessible across your application. For standard Java Web apps, the HttpSession is the go-to solution:

• After successful login/authorization, save the user object to the session:

  // Assuming you have a UserDetails class with fields like username, email, etc.
  UserDetails userDetails = yourAuthService.authenticate(username, password);
  request.getSession().setAttribute("currentUser", userDetails);
  

• To retrieve the user details later (in a Servlet, JSP, or another filter), pull it from the session:

  UserDetails currentUser = (UserDetails) request.getSession().getAttribute("currentUser");
  

If you're using a security framework like Spring Security, you can also fetch the authenticated user directly from the security context:

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
UserDetails userDetails = (UserDetails) auth.getPrincipal();

2. 修复空白的user.jsp页面 #

A blank JSP usually means either no data is being passed to it, or the page itself has no content to render. Here's how to build a functional user.jsp that displays user info:

First, ensure you're passing user data to the page (we'll cover this in the Servlet section below). Then write the JSP to use that data with EL expressions:

<%@ page contentType="text/html;charset=UTF-8" language="java" isELIgnored="false" %>
<html>
<head>
    <title>Your Profile</title>
</head>
<body>
    <h1>Welcome back, ${currentUser.username}!</h1>
    <div class="user-details">
        <p><strong>Full Name:</strong> ${currentUser.fullName}</p>
        <p><strong>Email:</strong> ${currentUser.email}</p>
        <p><strong>Member Since:</strong> ${currentUser.joinDate}</p>
    </div>
</body>
</html>

• The isELIgnored="false" ensures EL expressions (the ${...} bits) are processed—this is sometimes disabled by default.
• If the page is still blank, add a debug print in your Servlet to confirm currentUser is actually being set in the request/session.

3. 编写Servlet并完善AuthenticationFilter #

Let's start by finishing your filter—it needs to check if a user is authenticated before letting them access protected pages like user.jsp:

完善后的AuthenticationFilter #

import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebFilter(urlPatterns = {"/user", "/user.jsp"}) // 拦截需要授权的路径
public class AuthenticationFilter implements Filter {
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // 可选：在这里初始化资源（比如加载配置）
    }

    @Override
    public void destroy() {
        // 可选：在这里清理资源
    }

    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        HttpServletResponse response = (HttpServletResponse) servletResponse;

        // 检查用户是否已登录（存在于session中）
        Object currentUser = request.getSession().getAttribute("currentUser");
        String requestURI = request.getRequestURI();

        // 允许访问登录页或已认证用户的请求
        if (requestURI.contains("login.jsp") || currentUser != null) {
            filterChain.doFilter(request, response); // 放行请求
        } else {
            // 未认证用户重定向到登录页
            response.sendRedirect(request.getContextPath() + "/login.jsp");
        }
    }
}

处理用户页面请求的User Servlet #

创建一个Servlet来获取用户数据并转发到user.jsp——这比直接访问user.jsp更好，因为它能控制访问权限和数据流：

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

@WebServlet("/user")
public class UserServlet extends HttpServlet {
    @Override
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // 从session中获取用户信息
        UserDetails currentUser = (UserDetails) request.getSession().getAttribute("currentUser");

        // 如果用户未登录，重定向到登录页
        if (currentUser == null) {
            response.sendRedirect(request.getContextPath() + "/login.jsp");
            return;
        }

        // 将用户数据传递给JSP
        request.setAttribute("currentUser", currentUser);
        // 转发请求到user.jsp
        request.getRequestDispatcher("/user.jsp").forward(request, response);
    }
}

• 现在用户应该访问你的应用URL/user而不是直接访问user.jsp——这样会触发过滤器和Servlet，确保只有已认证用户能看到页面，同时JSP也能获取到所需的数据。

内容的提问来源于stack exchange，提问作者Sam Kilanoff