过滤器 Filter vs 拦截器 Interceptor

@WebFilter(urlPatterns = {"/user/*", "/admin/*"}, filterName = "securityFilter") 
// 使用 @WebFilter 注解声明这是一个 Filter，并指定拦截路径和过滤器名称
public class SecurityFilter implements Filter { 

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        // 初始化资源，例如加载用户权限配置文件
        System.out.println("SecurityFilter 初始化...");
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
        // 1. 获取请求信息，例如请求路径、请求参数
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        String requestURI = httpRequest.getRequestURI();

        // 2. 执行业务逻辑，例如校验用户登录状态、权限验证
        System.out.println("SecurityFilter 拦截到请求: " + requestURI);
        if (!isAuthenticated(httpRequest)) { // 模拟用户认证逻辑
            // 未通过验证，跳转到登录页面或者返回错误信息
            HttpServletResponse httpResponse = (HttpServletResponse) response;
            httpResponse.sendRedirect("/login"); // 跳转到登录页面
            return; 
        }

        // 3. 放行请求到下一个 Filter 或目标资源
        chain.doFilter(request, response);

        // 4. 后置处理，例如记录日志
        System.out.println("SecurityFilter 处理请求完成: " + requestURI);
    }

    @Override
    public void destroy() {
        // 释放资源
        System.out.println("SecurityFilter 销毁...");
    }

    // 模拟用户认证逻辑
    private boolean isAuthenticated(HttpServletRequest request) {
        // 这里可以根据实际需求实现，例如检查 Session 中是否存在用户信息
        return true; 
    }
}

@SpringBootApplication
@ServletComponentScan //  启用 Servlet 组件扫描，自动发现并注册 Filter
public class MyApplication {
    public static void main(String[] args) {
        SpringApplication.run(MyApplication.class, args);
    }
}

public class AuthInterceptor implements HandlerInterceptor {

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        // 1. 获取请求信息，例如请求路径、请求参数
        String requestURI = request.getRequestURI();

        // 2. 执行业务逻辑，例如权限验证
        System.out.println("AuthInterceptor 拦截到请求: " + requestURI);
        if (!hasPermission(request)) { // 模拟权限验证逻辑
            //  如果验证失败，设置错误信息，并跳转到错误页面
            response.setStatus(HttpServletResponse.SC_FORBIDDEN); 
            request.setAttribute("message", "您没有权限访问该资源！");
            request.getRequestDispatcher("/error").forward(request, response);
            return false;
        }

        // 3. 放行请求
        System.out.println("AuthInterceptor 放行请求: " + requestURI);
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler, ModelAndView modelAndView) throws Exception {
        // 修改模型数据，例如添加用户信息
        if (modelAndView != null) {
            modelAndView.addObject("username", "John Doe");
        }
    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) throws Exception {
        // 记录日志信息
        System.out.println("AuthInterceptor 请求处理完成: " + request.getRequestURI());
        if (ex != null) {
            System.out.println("发生异常: " + ex.getMessage());
        }
    }

    // 模拟权限验证逻辑
    private boolean hasPermission(HttpServletRequest request) {
        // 这里可以根据实际需求实现，例如检查用户角色
        return true;
    }
}

@Configuration
public class MyWebMvcConfigurer implements WebMvcConfigurer {

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        // 添加拦截器，并配置拦截路径
        registry.addInterceptor(new AuthInterceptor())
                .addPathPatterns("/admin/**") // 拦截 /admin/ 下的所有请求
                .excludePathPatterns("/admin/login"); // 排除 /admin/login 请求
    }
}